Information-Theoretic Secure Aggregation: A New Privacy Solution for Federated Learning under Heterogeneous Quantization

Title

Information-Theoretic Secure Aggregation: A New Privacy Solution for Federated Learning under Heterogeneous Quantization

Meta Description

This article introduces an information-theoretic secure aggregation scheme that addresses privacy leakage caused by heterogeneous client quantization in federated learning. The scheme leverages threshold secret sharing to tolerate dropouts and collusion, ensuring the server only obtains the aggregate sum without revealing individual updates.

Article Content

In federated learning (FL), secure aggregation allows the server to compute the sum of local model updates from N clients without revealing any individual client's update information (beyond the sum). However, different clients may be constrained by heterogeneous bandwidth and thus choose different quantization levels to represent the information they send. Most secure aggregation schemes require clients to project their update parameter values onto a common finite group (or field), which cannot directly accommodate heterogeneous precision constraints. Existing heterogeneous quantization secure aggregation methods leak partial aggregates of model updates and may leak fragments of individual model updates under certain dropout and client-server collusion patterns. To prevent such privacy leakage, this paper proposes an information-theoretic secure aggregation scheme that tolerates client dropouts and collusion between up to T semi-honest clients and the server, while supporting heterogeneous client quantization. The protocol leverages a (T+1, N) threshold black-box secret sharing construction, in which the secret shares of client updates—despite belonging to different algebraic groups due to different quantization—are all generated from the same linear integer system.

Challenges of Secure Aggregation under Heterogeneous Quantization

In federated learning, clients' upload bandwidth varies significantly, leading them to potentially adopt different quantization levels to compress model updates. Traditional secure aggregation schemes typically require all clients to map their update values to the same finite group (e.g., integers modulo a prime), so that secret sharing and aggregation can be performed. This uniformity assumption no longer holds in heterogeneous quantization scenarios—different quantization levels produce different numerical ranges that cannot be directly incorporated into the same algebraic structure.

Existing secure aggregation methods for heterogeneous quantization attempt to circumvent this limitation through grouped aggregation or partial aggregation, but at the cost of degraded privacy. Specifically, these methods may leak partial aggregation results and even leak fragments of individual client updates when clients drop out or collude with the server. This violates the core goal of secure aggregation: the server should not obtain any information beyond the sum.

Finite Groups and Modular Arithmetic: In secure aggregation, a finite group typically refers to the additive group (\mathbb{Z}_p) consisting of integers modulo a prime (p), which has a finite number of elements and every nonzero element has a multiplicative inverse (if considering the multiplicative group). Projecting model updates onto a finite group means mapping real or integer parameters to elements in (\mathbb{Z}_p), thereby enabling secret sharing and homomorphic aggregation using group operations. Different quantization levels produce different numerical ranges (e.g., 8-bit quantization ranges from ([-128,127]), while 4-bit ranges from ([-8,7])). If forcibly unified to the same (p), low-precision clients' values may be "amplified" or high-precision clients' values may overflow, breaking correctness. Therefore, heterogeneous quantization requires each client to use a modulus matching its quantization range, causing secret shares to belong to different algebraic groups, and traditional secure aggregation protocols based on a single (\mathbb{Z}_p) cannot directly combine these shares.

Core Design of the Information-Theoretic Secure Aggregation Scheme

To address the above challenges, the paper proposes an information-theoretic secure aggregation scheme. The key innovation lies in leveraging a (T+1, N) threshold black-box secret sharing construction, such that even when clients use different quantization levels (i.e., secret shares belong to different algebraic groups), secret shares can still be generated from the same linear integer system.

Specifically, each client encodes its quantized update vector as an integer vector and then generates secret shares through a linear integer system. Although these shares belong to different groups (depending on the quantization level), the system design guarantees correct combination during aggregation. After the server collects shares from at least T+1 clients, it can recover the sum, while any combination of fewer than T+1 shares reveals no information.

The scheme tolerates client dropouts and can resist collusion between up to T semi-honest clients and the server. The semi-honest model means these clients follow the protocol but may attempt to infer other clients' privacy from received information. The scheme's security is information-theoretic and does not rely on computational assumptions, so privacy cannot be compromised even if the adversary has unbounded computational power.

Black-Box Secret Sharing and Linear Integer Systems: Black-box secret sharing refers to treating a secret sharing scheme as a black box, utilizing only its linear properties (shares are linear functions of the secret) for combination, without relying on specific constructions (such as Shamir or replicated secret sharing). In a linear integer system, each client's secret share can be expressed as (s_i = a_i \cdot x + b_i), where (x) is the quantized update vector and (a_i, b_i) are integer coefficients. Even if different clients have different quantization levels (i.e., (x) has different value ranges), as long as all shares come from the same linear system (with identical coefficients or satisfying compatibility), the server can still recover the sum through linear combination. The ((T+1, N)) threshold means that at least (T+1) shares are required to reconstruct the secret, while any (T) shares reveal no information, providing an information-theoretic guarantee against collusion between up to (T) semi-honest clients and the server.

Comparison with Existing Methods and Advantages

Compared with existing heterogeneous quantization secure aggregation methods, this scheme is more rigorous in privacy protection. Existing methods leak partial aggregates or individual update fragments under specific dropout or collusion patterns, whereas this scheme maintains information-theoretic security under all permitted dropout and collusion patterns.

Furthermore, the scheme does not require clients to unify their quantization levels, thereby better adapting to the heterogeneous bandwidth environments in practical federated learning. Clients can independently choose quantization levels based on their own bandwidth conditions without affecting the security and correctness of aggregation.

Semi-Honest Model and Information-Theoretic Security: The semi-honest (honest-but-curious) model assumes that all parties strictly follow the protocol steps but may infer other parties' privacy from received intermediate information. Information-theoretic security (also called unconditional security) means that even an adversary with unbounded computational power cannot obtain any information about the secret from ciphertexts or shares, and its security does not depend on computationally hard problems (such as discrete logarithms). In secure aggregation, information-theoretic security is typically achieved through the threshold property of secret sharing: fewer than the threshold number of shares are indistinguishable from random numbers, so the server cannot obtain any additional information about any individual client's update even when colluding with up to (T) clients. This contrasts with schemes based on computational assumptions (such as Diffie-Hellman), which may fail in the face of quantum computing.

Practical Applications and Future Directions

This scheme is suitable for federated learning scenarios with extremely high privacy requirements, such as healthcare and finance, where client devices may have different network conditions. Information-theoretic security provides stronger privacy guarantees but may introduce certain communication or computation overhead. The paper does not specifically discuss quantitative metrics of overhead but points out that the scheme is based on a black-box secret sharing construction and is practically feasible.

Future work may include optimizing the efficiency of secret sharing and exploring security under more complex collusion models (such as malicious clients).

Note: This article is written based on the paper abstract; please refer to the original paper for specific technical details.

One-line Summary

Proposes an information-theoretic secure aggregation scheme that supports heterogeneous quantization and tolerates dropouts and collusion.

Paragraph Summary

This article addresses the problem that in federated learning, clients adopting different quantization levels due to heterogeneous bandwidth causes traditional secure aggregation to fail, and proposes an information-theoretic secure aggregation scheme. Existing heterogeneous quantization methods leak partial aggregates or individual update fragments, especially in dropout and collusion scenarios. The new scheme leverages a (T+1, N) threshold black-box secret sharing construction, enabling secret shares from different quantization levels (belonging to different algebraic groups) to all be generated from the same linear integer system, thereby combining correctly during aggregation. The scheme tolerates client dropouts and resists collusion between up to T semi-honest clients and the server, providing information-theoretic security without relying on computational assumptions. Compared with existing methods, this scheme is more rigorous in privacy protection and adapts to heterogeneous bandwidth environments, though it may introduce additional overhead.