AID-H-008.001: Secure Aggregation Protocols for Federated Learning

Version 1.20261015 · Actionable sub-technique

Employs cryptographic methods in Federated Learning (FL) to protect the privacy of individual client contributions, such as model updates or gradients. These protocols are designed so the central server can compute the aggregate (sum or average) of all client updates but cannot inspect or reverse-engineer any individual contribution. This hardens the FL process against inference attacks by the server and preserves user privacy in collaborative learning environments.

Pillars: model

Lifecycle: building, operation

Scope boundary

Owns cryptographic confidentiality of individual federated client contributions while enabling policy-approved aggregate computation and dropout recovery.

AID-H-008.002: AID-H-008.001 hides individual client updates from the aggregator; AID-H-008.002 requires individual updates or equivalent verifiable statistics to filter Byzantine influence. Ordinary secure-sum and conventional per-client robust aggregation cannot both be claimed without a specifically reviewed compatible protocol or confidential boundary.

AID-H-008.003: AID-H-008.001 protects the confidentiality of contributions from participants already accepted into a round; AID-H-008.003 authenticates and admits the participant and exact round-bound update. Contribution privacy does not establish that a submitter is authorized or benign.

Implementation guidance

AID-H-008.001-G001: Deploy an additively homomorphic encrypted aggregation path when the architecture includes a separately controlled aggregate-decryption service.
AID-H-008.001-G002: Deploy a masked SecAgg+ workflow with policy-defined share and reconstruction thresholds, and prove aggregate recovery under the expected client-dropout envelope.

AID-H-008.001-G001

Deploy an additively homomorphic encrypted aggregation path when the architecture includes a separately controlled aggregate-decryption service.

Concept:

Partially Homomorphic Encryption (PHE) schemes, like Paillier, allow mathematical operations (such as addition) to be performed directly on encrypted data. In Federated Learning (FL), each client encrypts its local model update using a shared public key. The server can sum these encrypted updates without ever seeing any single client's raw update. Only the trusted private key holder can decrypt the final aggregate. This protects client privacy, even if the aggregation server is curious or compromised.

Step 1: Client-Side Encryption of Model Updates

# File: hardening/fl_client_he.py
from phe import paillier
import numpy as np

# Assume 'public_key' is distributed to all clients.
# Assume 'model_update' is a numpy array of gradients/weights.

def encrypt_update(model_update, public_key):
    """Encrypt each scalar in the model update vector using Paillier."""
    encrypted_update = [public_key.encrypt(float(x)) for x in model_update]
    return encrypted_update

# Example:
# client_update = np.array([0.05, -0.12, 0.33])
# encrypted_client_update = encrypt_update(client_update, public_key)
# Client sends 'encrypted_client_update' to the server.

Step 2: Server-Side Aggregation of Encrypted Updates

# File: hardening/fl_server_he.py
import numpy as np

# Server receives a list of encrypted updates from multiple clients:
# all_encrypted_updates is the authenticated complete cohort loaded from the signed round manifest.
# where each enc_update_clientX is a list of Paillier-encrypted numbers.

def aggregate_encrypted_updates(all_encrypted_updates):
    """Element-wise sum of encrypted updates, without ever decrypting them."""
    if not isinstance(all_encrypted_updates, list) or not all_encrypted_updates:
        raise ValueError("encrypted cohort must be a non-empty list")
    if any(not isinstance(update, list) or not update for update in all_encrypted_updates):
        raise ValueError("every encrypted update must be a non-empty vector")
    num_clients = len(all_encrypted_updates)
    num_params = len(all_encrypted_updates[0])
    if any(len(update) != num_params for update in all_encrypted_updates):
        raise ValueError("encrypted update shapes differ")

    # Sum ciphertexts coordinate-wise
    summed = []
    for param_idx in range(num_params):
        total_cipher = None
        for client_idx in range(num_clients):
            enc_val = all_encrypted_updates[client_idx][param_idx]
            total_cipher = enc_val if total_cipher is None else (total_cipher + enc_val)
        summed.append(total_cipher)

    return summed  # This is still encrypted

# NOTE:
# - Paillier ciphertexts support addition and multiplication by an integer.
# - For an average, a common pattern is:
#   1. Keep the encrypted SUM on the server.
#   2. Decrypt on a trusted key holder.
#   3. Divide by num_clients after decryption (in plaintext),
#      or use fixed-point encoding if you must scale while encrypted.

Action: Have each client encrypt its model update with an additively homomorphic scheme and send only ciphertext. Keep the private key outside the aggregation service, define vector shape and numeric bounds in versioned policy, reject malformed contributions before aggregation, and authorize decryption only after the minimum participant count is met.

Verification and evidence

Replay a fixed set of client vectors through both plaintext and encrypted aggregation and require equivalent aggregate values within the policy-owned numeric tolerance. Run a negative test proving the aggregation service cannot decrypt one client ciphertext. Preserve the protocol/library version, public-key fingerprint, participant count, vector schema, encrypted aggregate digest, decryptor authorization record, comparison result, and explicit PASS/FAIL/ERROR verdict.

Keep the action safely bounded

Authenticate bounded client ciphertexts/shares, bind them to one round/model, enforce minimum cohort and dropout/threshold rules, aggregate only the reconciled cohort, allow separated/threshold decryption of the aggregate only, and never expose individual updates.

AID-H-008.001-G002

Deploy a masked SecAgg+ workflow with policy-defined share and reconstruction thresholds, and prove aggregate recovery under the expected client-dropout envelope.

Use the maintained Flower SecAgg+ implementation

Flower 1.32 provides SecAggPlusWorkflow on the server and secaggplus_mod on clients. Start from the maintained reference app so the protocol phases, share reconstruction, and unmasking behavior are not reimplemented ad hoc.

python -m pip install "flwr[simulation]==1.32.1"
flwr new @flwrlabs/flower-secure-aggregation
cd flower-secure-aggregation
python -m pip install -e .
flwr run . --run-config "is-demo=false" --stream

Bind resilience parameters to policy

Set num-shares and reconstruction-threshold in the version-controlled Flower project configuration or through --run-config. Derive both values from the federation's minimum privacy cohort, expected concurrent participants, and tolerated dropout envelope. Reject a round as INSUFFICIENT_DATA when the surviving cohort cannot satisfy the configured reconstruction threshold; never fall back to plaintext updates.

Exercise healthy, dropout, and below-threshold cases

In staging, replay the same deterministic client updates in three runs: all clients present, a policy-allowed number of clients unavailable, and enough clients unavailable to cross the reconstruction threshold. The first two runs must produce the expected aggregate within the versioned numeric tolerance. The third must fail closed without exposing individual updates or publishing a partial model.

Evidence

Persist the Flower and application versions, configuration digest, cohort and dropout counts, reconstruction threshold, aggregate digest, round status, protocol logs with client payloads redacted, and an explicit PASS/FAIL/INSUFFICIENT_DATA/ERROR verdict. Promote the configuration only when the healthy and allowed-dropout cases pass and the below-threshold case is independently replayed as fail closed.

Open-source tools

Flower (Federated Learning Framework)
NVIDIA FLARE
FATE (Federated AI Technology Enabler)
PySyft (OpenMined)
Microsoft SEAL
OpenFHE
TenSEAL (encrypted tensor aggregation; federated dropout and collusion controls required)

Commercial / hosted tools

AWS Nitro Enclaves
Google Cloud Confidential Computing
Duality Platform
Enveil ZeroReveal Machine Learning

Threat mappings

MITRE ATLAS

AML.T0025 Exfiltration via Cyber Means (protects raw client training data and gradients from exposure)

MAESTRO

Data Exfiltration (L2)
Membership Inference Attacks (L1) (secure aggregation prevents inference on individual client data)
Data Leakage (Cross-Layer) (cryptographic protocols prevent data leakage between FL participants)

OWASP LLM Top 10 2026

LLM02:2026 Sensitive Information Disclosure

OWASP ML Top 10 2023

ML03:2023 Model Inversion Attack
ML04:2023 Membership Inference Attack

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

NISTAML.033 Membership Inference
NISTAML.032 Reconstruction (secure aggregation prevents data reconstruction from FL updates)
NISTAML.034 Property Inference (secure aggregation prevents property inference from FL updates)

Cisco Integrated AI Security and Safety Framework

AISubtech-10.2.1 Model Inversion (Hides individual client gradients from the aggregation server)
AITech-10.2 Model Inversion (Hides individual client gradients from the aggregation server)
AITech-8.2 Data Exfiltration / Exposure
AITech-8.3 Information Disclosure