Pith. sign in

REVIEW 4 major objections 4 minor 54 references

NFSA: Non-Forward Secure Aggregation with One Server via Two Layer Secret Sharing

T0 review · 4 major / 4 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read NFSA combines PRF-based two-layer secret sharing with CRT packing of almost key-homomorphic PRF masks to achieve single-server, one-shot secure aggregation without server-forwarded key shares.

desk verdict A genuinely simple TLSS trick removes server forwarding and CRT packing cuts KhPRF costs, but Thm 7's proof as written is invalid, and the CRT range assumption needs qualification before this is a complete paper. read the letter →

arxiv 2607.15052 v1 pith:XD6XADMG submitted 2026-07-16 cs.CR

Yufei Zhou This is my paper
classification cs.CR
keywords aggregationdatasecureoverheadsecretserversharingcommunication
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning trains a model across many phones or devices without moving their private data to a server. Instead, each device trains locally and sends only its model update. But those updates can leak information about the data, so secure aggregation protocols mask each update with a random key and let the server compute only the sum of the updates. The server needs the sum of all keys to unmask, so prior schemes split each client's key into secret shares and send those shares to helper nodes, called decryptors, through the server. That relaying costs bandwidth and creates a place where secrets are in transit.

This paper's first trick, called two-layer secret sharing (TLSS), changes where the shares go. Each client and each decryptor first exchange a public key and agree on a secret key in an offline setup. When a client wants to share its masking key, it splits each Shamir share into two additive pieces: one piece is just a pseudo-random number generated from the already-agreed key, and the other piece is sent to the server. During reconstruction, each online decryptor regenerates its pseudo-random piece from the pre-shared key and sends it to the server. The server adds the two pieces, recovers the Shamir share, and eventually reconstructs the sum of the masking keys. No secret share is ever forwarded by the server to the decryptors.

The second trick uses the Chinese Remainder Theorem (CRT) to pack several model parameters into one large number before masking. This reduces the number of key-homomorphic PRF calls and shrinks the size of the masked data. The paper reports simulations showing decryptor download traffic reduced by roughly 100x and user masking time reduced up to about 3.7x compared to a semi-honest version of the recent OPA protocol.

Extended reading notes

Core claim

The NFSA protocol correctly computes the secure aggregation x^(r)_0 = sum_{i in U} x^(r)_i mod p_m and leaks only the aggregate, in the semi-honest model with a single server and no server-forwarded secret sharing (Theorem 5, Section 5.4). The accompanying efficiency claim is that TLSS plus CRT packing reduces decryptor download traffic by about 100x and user masking time by up to about 3.7x versus semi-honest OPA (Tables 3-5).

Load-bearing premise

The CRT decoding in Lemma 1 assumes that the true aggregated sum of every coordinate over all online users lies strictly inside (-p_m/2, p_m/2). If the aggregate overflows this range, the modular wrap-around corrupts the decoded model. The paper justifies this with 'the maximum value of the final aggregated result is typically less than p_m/2' (Section 5.2.2), but this is a data-dependent, unverified premise: with N=100 users and p_m=2^32, large updates could violate it silently. This is structurally distinct from the cryptographic security claim; it is a modeling assumption on the input distribution that the protocol itself cannot check.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes NFSA, a single-server secure aggregation protocol for federated learning. It combines Shamir secret sharing and additive secret sharing (TLSS) to let users share their KhPRF keys without the server forwarding secret shares, and introduces a CRT-based packing method to reduce the communication and computation overhead of almost-KhPRF masking. The authors claim correctness and semi-honest privacy (Theorem 5), with efficiency improvements over OPA: about 100x lower decryptor download traffic and up to ~3.7x lower user masking time (Tables 3-5). The paper includes proofs, pseudocode (Algorithms 1-2), parameter analysis, and a GitHub repository with simulation code.

Significance. If the security proof is repaired, the paper makes a useful practical contribution: it removes server-mediated share forwarding in SS-based secure aggregation and reduces KhPRF masking overhead via CRT packing. The TLSS construction is simple and the reported efficiency gains are substantial. The paper is also transparent in providing an open-source simulation and comparing against a closely related baseline (OPA). However, the central privacy proof is incomplete as written, and the correctness of the CRT decoding relies on an explicitly stated but unverified input-range assumption. These are load-bearing issues for the advertised claims, though both appear repairable without changing the protocol's core design.

major comments (4)
  1. [Section 5.4, Theorem 7] The proof of Theorem 7 is not a valid reduction. It posits a distinguisher A for (c_i^(r), k^(r)) vs (c_i^(r), k'^(r)) and constructs B that gives A the pair (c_B, k'^(r)) where the second component is always uniform. A's assumed distinguishing power is never applied to the actual distinction B must decide: F_H(k_i^(r), r) vs uniform. Since both inputs to A have the same uniform key component, A's behavior cannot be used to distinguish the KhPRF output. The later transitivity paragraph simply restates the target. Thus the theorem, and with it the central privacy claim, is not established as written. The statement is plausible and can likely be repaired by a standard reduction that samples S = sum_{j != i} k_j^(r) uniformly and sets k_i^(r) = k^(r) - S, making k_i^(r) uniform conditioned on k^(r); but this argument is absent.
  2. [Appendix D.2, step S4] The hybrid proof of Theorem 5 repeats the same gap. It asserts that by KhPRF security, F_H(k_i^(r), r) and a random value are indistinguishable, so c_i^(r) and a random value are indistinguishable. The server's view, however, includes the reconstructed aggregate key k^(r) = sum_i k_i^(r). The value c_i^(r) = Delta * CRT(x_i^(r)) - F_H(k_i^(r), r) is correlated with k^(r) through k_i^(r). KhPRF security alone does not imply indistinguishability of c_i^(r) from uniform when the distinguisher is also given k^(r). The simulator must condition on the reconstructed key; this requires a more careful argument, e.g., the sampling repair described above. Without this step, the transition from S3 to S4 is unjustified.
  3. [Section 5.2.2, Lemma 1 and parameter selection] Correctness of the CRT decoding depends on the assumption that every coordinate of every user's input and the aggregate of all online users lie in (-p_m/2, p_m/2). The paper states that the maximum value of the final aggregated result is typically less than p_m/2 but provides no concrete bound or protocol-level check. If the true aggregate overflows this range, Lemma 1 fails and the decoded model is silently corrupted. This is a data-dependent modeling assumption, distinct from the cryptographic security claims. The manuscript should either state this as an explicit correctness condition with parameter selection guidance (e.g., choose p_m based on a public upper bound on updates) or add a mechanism to detect overflow. As written, the correctness claim in Eq. (1) and Theorem 4 is not unconditional.
  4. [Section 6.3, Table 5] The evaluation text says that the key sharing process is the same in both schemes, using TLSS, so the overhead for key sharing remains identical across all approaches. This contradicts both the earlier comparison with OPA in Section 2 (where OPA is described as using server-forwarded encrypted Shamir shares, not TLSS) and the reported numbers: Table 5 shows OPA decryptor traffic of 19.25 MB versus 0.19 MB for the proposed scheme. If both schemes used TLSS, the decryptor traffic would be nearly identical and the 100x improvement would disappear. If OPA does not use TLSS, the sentence is inaccurate and the comparison methodology needs to be stated precisely. The experimental claim about improving communication efficiency by nearly 100 times in the abstract is not meaningful until this is clarified.
minor comments (4)
  1. [Section 5.2.1, Theorem 3] The error bound e <= n is correct but loose; when q > n, e <= n - 1. The statement e in [0,n] is fine as a conservative bound, but the wording that q is typically much larger than n could be replaced by the exact maximum. Also, the symbol n is used for both the number of additions and the polynomial ring dimension n_lambda; please disambiguate.
  2. [Algorithm 2, lines 10-17] The sets P1 and P2 are not defined precisely: P1 is used for the decryptors the server contacts, and P2 for those who respond. The relationship between P1 and P2 (presumably P2 subset of P1) should be stated. Also, the server reconstructs k^(r) using TLSS but the reconstruction requires T correct shares; the threshold condition on P2 should be explicit.
  3. [Section 4, Setup phase] The paper says the dealer generates a random tag v_m in the sharing phase and later says v_m can be either the same for all holders or a public parameter agreed upon in advance. This is slightly ambiguous: if the same tag is reused across multiple secrets with the same key, the one-time-pad security of TLSS would fail. The unique-tag requirement (per secret and per user-decryptor pair) should be stated explicitly.
  4. [General] The title 'Non-Forward Secure Aggregation' is unusual; 'Non-Forward' is not a standard term. If the intended meaning is 'without server forwarding,' consider 'Forwarding-Free Secure Aggregation' or similar to avoid confusion with 'forward secure' in the cryptographic sense.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the NFSA/TLSS derivation is self-contained; the only self-citation is non-load-bearing. A separate Theorem 7 proof gap is a correctness issue, not circularity.

full rationale

The derivation chain is TLSS -> CRT encoding -> NFSA. TLSS security (Thm. 1, Sec. 4.1) is proven by simulation from external primitives (Shamir SS, PRF, KA); it does not assume NFSA's target. The CRT packing correctness (Lemma 1, Thm. 4, Sec. 5.2.2) is an algebraic homomorphism proof whose only non-algebraic premise is the range condition on the true aggregate (-p_m/2, p_m/2); that is an input-distribution assumption, not a circular step. The efficiency claims (Tables 3-5) are measurements, and the 'fewer KhPRF calls' statement is the direct consequence of packing d_c inputs into one modulus, not a fitted prediction. The main security proof (Thm. 5, Sec. 5.4/Appendix D.2) is a hybrid argument that invokes the assumed security of Hash/KA/TLSS and KhPRF; S4 applies KhPRF pseudorandomness to the per-user mask. No equation reduces to its own inputs. The only self-citation is [48] in the introduction ('homomorphic encryption [1, 48]'), the author's earlier RLWE packing work; it is illustrative and not load-bearing for any theorem or efficiency claim. I flag two non-circular defects explicitly: (1) Thm. 7's proof is a misdirected reduction: B gives A a pair (c_B,k') whose second component is always uniform, so A's assumed distinguishing power on the k-versus-k' distinction is never exercised; and the Note after Thm. 7 ('would contradict the above theorem') is, if read as evidence, circular. These are proof-level gaps in the advertised privacy guarantee, not a derivation that reduces to its inputs. (2) Lemma 1's range assumption is unverified but is a modeling assumption rather than circularity. Overall: no significant circularity; score 2 only for the minor non-load-bearing self-citation.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The protocol introduces no new cryptographic entity; TLSS is a mode of composition over existing primitives (KA, PRF, Shamir SS, additive SS, KhPRF). The key load-bearing assumptions are standard: secure KA, PRF security, the approximate key-homomorphism error bound, and the data-range condition for CRT decoding. The free parameters are design choices rather than fitted values; none is tuned to make the experimental claims true.

free parameters (5)
  • Delta (amplification factor) = 2^10 (default; must exceed maximum number of aggregated users n)
    Scaling factor for KhPRF masking; must satisfy Delta > n to absorb the key-homomorphism error. Chosen by hand, and it directly affects masked-data size.
  • d_c (CRT batch size) = 2, 3, 4 in experiments
    Chosen to trade off packing density against modulus growth; larger d_c reduces the number of KhPRF calls but forces a larger q and larger KhPRF keys.
  • p_m (plaintext modulus) = 2^32 for FL experiments
    Precision parameter for gradient representation; affects the range assumption in Lemma 1 and communication size.
  • T (Shamir threshold) = 3 (default in experiments)
    Determines dropout tolerance and the privacy threshold (fewer than T colluding decryptors); chosen by the protocol designer, not fitted to data.
  • M (number of decryptors/holders) = 5 (NFSA experiments), 50 (TLSS experiments)
    System parameter; larger M increases sharing cost but improves dropout tolerance. Not fitted.
assumptions (6)
  • domain assumption Secure key agreement (ECDH/DH) exists.
    TLSS Setup phase (Section 4) relies on KA to establish kappa_{d,m}; security requires the DDH assumption.
  • domain assumption The PRF (AES in CTR mode) is pseudorandom.
    Used in TLSS Sharing phase to generate the one-time pad s_A1; indistinguishability of shares depends on PRF security.
  • domain assumption The LWR/RLWR-based KhPRF satisfies approximate key-homomorphism with error e in [0,n] for n aggregated keys.
    Invoked in Theorem 3 and the NFSA masking step (Section 5.2.1); the whole unmasking pipeline depends on this error bound.
  • domain assumption The sum of all online users' updates for every coordinate lies strictly inside (-p_m/2, p_m/2).
    Required by Lemma 1 and Theorem 4 for CRT decoding to return the correct aggregate without modular wrap-around; the paper states this is 'typically' true but does not verify it.
  • domain assumption Semi-honest adversary; the server colludes with fewer than T decryptors.
    Explicit threat model in Section 5.1. Theorems 5-6 and the threshold argument are predicated on this.
  • domain assumption No direct communication channel between users; each participant has a secure (SSL-like) channel to the server.
    The protocol assumes all messages to/from the server are confidential and tamper-resistant (Section 5.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of NFSA: Non-Forward Secure Aggregation with One Server via Two Layer Secret Sharing." pith.science (2026). https://pith.science/paper/XD6XADMG

@misc{pith2026260715052,
  author       = {Pith},
  title        = {Pith review of: NFSA: Non-Forward Secure Aggregation with One Server via Two Layer Secret Sharing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XD6XADMG}},
  note         = {Machine review of arXiv:2607.15052}
}
abstract

Federated Learning (FL) enables collaborative model training while preserving privacy by keeping data local. However, the risk of sensitive data leakage through model updates necessitates the use of secure aggregation protocols. Existing server-based secure aggregation protocols typically require the server to forward sensitive data shared between users, which increases communication overhead and introduces potential security risks. In this work, we propose a novel secure aggregation protocol based on two-layer secret sharing to address these issues. By combining Shamir's Secret Sharing with 2-out-of-2 additive secret sharing using a Pseudo-Random Function (PRF), our protocol eliminates direct communication between users, thereby removing the need for the server to forward data. We further extend the protocol with Key-homomorphic PRF (KhPRF) to support high-dimensional data aggregation and apply it to FL, enabling one-shot secure aggregation with a single server and no intermediary data forwarding. To reduce user overhead, we design a new encoding method based on the Chinese Remainder Theorem for the almost KhPRF-based mask, reducing the number of KhPRF calls and mitigating the model update expansion issue after masking. Experimental results show that our scheme significantly outperforms existing methods in terms of auxiliary node overhead. For instance, when the number of users is 100, our scheme improves communication efficiency by nearly 100 times and reduces computational overhead by approximately 17\%. Moreover, user computation time can be reduced by 51\% to 75\% when the input length is $2^{18}$.

Figures

Figures reproduced from arXiv: 2607.15052 by the authors.

Figure 1
Figure 1. Comparison between our TLSS and traditional [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Details of our TLSS. For simplicity, we assume that all [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Comparison of total overhead for different secret [PITH_FULL_IMAGE:figures/full_fig_p012_4.png] view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: Comparison of total overhead for different numbers [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Overhead comparison of KhPRF-based masking [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Overhead comparison of KhPRF-based masking [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 9
Figure 9. Figure 9: Comparison of server overhead for one round of [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 8
Figure 8. Figure 8: Comparison of user overhead for one round of [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]
Figure 10
Figure 10. Figure 10: Holder performance with modulus bit length 128. [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: Comparison of total overhead under different se [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

54 extracted references · 1 linked inside Pith

  1. [1]

    Yoshinori Aono, Takuya Hayashi, Lihua Wang, Shiho Moriai, et al. 2017. Privacy- preserving deep learning via additively homomorphic encryption.IEEE transac- tions on information forensics and security13, 5 (2017), 1333–1345

    2017

  2. [2]

    Abhishek Banerjee, Chris Peikert, and Alon Rosen. 2012. Pseudorandom functions and lattices. InAnnual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 719–737

    2012

  3. [3]

    James Bell, Adrià Gascón, Tancrède Lepoint, Baiyu Li, Sarah Meiklejohn, Mariana Raykova, and Cathie Yun. 2023. ACORN: input validation for secure aggregation. In32nd USENIX Security Symposium (USENIX Security 23). 4805–4822. NFSA: Non-Forward Secure Aggregation with One Server via Two Layer Secret Sharing CCS ’26, November 15–19, 2026, The Hague, Netherlands

    2023

  4. [4]

    James Henry Bell, Kallista A Bonawitz, Adrià Gascón, Tancrède Lepoint, and Mariana Raykova. 2020. Secure single-server aggregation with (poly) logarithmic overhead. InProceedings of the 2020 ACM SIGSAC conference on computer and communications security. 1253–1269

    2020

  5. [5]

    James Bell-Clark, Adrià Gascón, Baiyu Li, Mariana Raykova, and Phillipp Schopp- mann. 2025. Willow: Secure aggregation with one-shot clients. InAnnual Inter- national Cryptology Conference. Springer, 285–318

    2025

  6. [6]

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017. Prac- tical secure aggregation for privacy-preserving machine learning. Inproceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 1175–1191

    2017

  7. [7]

    Dan Boneh, Kevin Lewi, Hart Montgomery, and Ananth Raghunathan. 2013. Key homomorphic PRFs and their applications. InAnnual Cryptology Conference. Springer, 410–428

    2013

  8. [8]

    Lennart Braun, Ivan Damgård, and Claudio Orlandi. 2023. Secure multiparty com- putation from threshold encryption based on class groups. InAnnual International Cryptology Conference. Springer, 613–645

    2023

Show all 54 references
  1. [9]

    Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečn`y, H Brendan McMahan, Virginia Smith, and Ameet Talwalkar. 2018. Leaf: A benchmark for federated settings.arXiv preprint arXiv:1812.01097(2018)

    2018 arXiv

  2. [10]

    Ignacio Cascudo and Bernardo David. 2024. Publicly verifiable secret sharing over class groups and applications to DKG and YOSO. InAnnual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 216–248

    2024

  3. [11]

    August Deer, Ramy E Ali, and A Salman Avestimehr. 2022. On Multi-Round Privacy in Federated Learning. In2022 56th Asilomar conference on signals, systems, and computers. IEEE, 764–769

    2022

  4. [12]

    Johannes Ernst and Alexander Koch. 2021. Private stream aggregation with labels in the standard model.Proceedings on Privacy Enhancing Technologies(2021)

    2021

  5. [13]

    Hamid Fazli Khojir, Dima Alhadidi, Sara Rouhani, and Noman Mohammed. 2023. FedShare: secure aggregation based on additive secret sharing in federated learn- ing. InProceedings of the 27th international database engineered applications symposium. 25–33

    2023

  6. [14]

    Paul Feldman. 1987. A practical scheme for non-interactive verifiable secret sharing. In28th Annual Symposium on Foundations of Computer Science (sfcs 1987). IEEE, 427–438

    1987

  7. [15]

    Craig Gentry, Shai Halevi, and Nigel P Smart. 2012. Homomorphic evaluation of the AES circuit. InAnnual Cryptology Conference. Springer, 850–867

    2012

  8. [16]

    Alex Graves. 2012. Long short-term memory.Supervised sequence labelling with recurrent neural networks(2012), 37–45

    2012

  9. [17]

    Zhangshuang Guan, Yulin Zhao, Zhiguo Wan, and Jinsong Han. 2025. OPSA: Efficient and verifiable one-pass secure aggregation with TEE for federated learning.IEEE Transactions on Dependable and Secure Computing(2025)

    2025

  10. [18]

    Yue Guo, Antigoni Polychroniadou, Elaine Shi, David Byrd, and Tucker Balch

  11. [19]

    Lein Harn and Changlu Lin. 2014. Efficient group Diffie–Hellman key agreement protocols.Computers & Electrical Engineering40, 6 (2014), 1972–1980

    2014

  12. [20]

    Mohamud Ahmed Jimale, Muhammad Reza Z’aba, Miss Laiha Binti Mat Kiah, Mohd Yamani Idna Idris, Norziana Jamil, Moesfa Soeheila Mohamad, and Mohd Saufy Rohmad. 2022. Authenticated encryption schemes: A systematic review.IEEE Access10 (2022), 14739–14766

    2022

  13. [21]

    Harish Karthikeyan and Antigoni Polychroniadou. 2025. OPA: one-shot pri- vate aggregation with single client interaction and its applications to federated learning. InAnnual International Cryptology Conference. Springer, 319–353

    2025

  14. [22]

    Jonathan Katz and Yehuda Lindell. 2020. Introduction to modern cryptography crc press.Taylor & Francis. DOI10, 9781351133036 (2020), 1

    2020

  15. [23]

    2023.An Introduction to Secret Sharing

    Stephan Krenn and Thomas Lorünser. 2023.An Introduction to Secret Sharing. Springer

    2023

  16. [24]

    Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

    2009

  17. [25]

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. 2002. Gradient- based learning applied to document recognition.Proc. IEEE86, 11 (2002), 2278– 2324

    2002

  18. [26]

    Joohyung Lee, Faranaksadat Solat, Tae Yeon Kim, and H Vincent Poor. 2024. Federated learning-empowered mobile network management for 5G and beyond networks: From access to core.IEEE Communications Surveys & Tutorials26, 3 (2024), 2176–2212

    2024

  19. [27]

    Hanjun Li, Huijia Lin, Antigoni Polychroniadou, and Stefano Tessaro. 2023. LERNA: secure single-server aggregation via key-homomorphic masking. In International Conference on the Theory and Application of Cryptology and Infor- mation Security. Springer, 302–334

    2023

  20. [28]

    Shijie Li, Qimei Cui, Xiong Li, Yaxin Liao, Xiyu Zhao, and Xiaofeng Tao. 2024. A Novel Federated Transfer Learning Framework Based on Collaborative GAN for Smart Manufacturing. In2024 IEEE Wireless Communications and Networking Conference (WCNC). IEEE, 1–6

    2024

  21. [29]

    Kai Liang, Songze Li, Ming Ding, Feng Tian, and Youlong Wu. 2025. Privacy- Preserving Coded Schemes for Multi-Server Federated Learning With Straggling Links.IEEE Transactions on Information Forensics and Security20 (2025), 1222–

    2025

  22. [30]

    Yehuda Lindell. 2017. How to simulate it–a tutorial on the simulation proof technique.Tutorials on the Foundations of Cryptography: Dedicated to Oded Goldreich(2017), 277–346

    2017

  23. [31]

    Hidde Lycklama, Lukas Burkhalter, Alexander Viand, Nicolas Küchler, and Anwar Hithnawi. 2023. Rofl: Robustness of secure federated learning. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 453–476

    2023

  24. [32]

    Yiping Ma, Jess Woods, Sebastian Angel, Antigoni Polychroniadou, and Tal Rabin

  25. [33]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. InArtificial intelligence and statistics. PMLR, 1273–1282

    2017

  26. [34]

    Ahmet Can Mert, Erdinç Öztürk, and Erkay Savaş. 2019. Design and implemen- tation of a fast and scalable NTT-based polynomial multiplier architecture. In 2019 22nd Euromicro Conference on Digital System Design (DSD). IEEE, 253–260

    2019

  27. [35]

    Moni Naor and Omer Reingold. 2004. Number-theoretic constructions of efficient pseudo-random functions.Journal of the ACM (JACM)51, 2 (2004), 231–262

    2004

  28. [36]

    Dinh C Nguyen, Ming Ding, Pubudu N Pathirana, Aruna Seneviratne, Jun Li, and H Vincent Poor. 2021. Federated learning for internet of things: A comprehensive survey.IEEE communications surveys & tutorials23, 3 (2021), 1622–1658

    2021

  29. [37]

    2023.SSL and TLS: Theory and Practice

    Rolf Oppliger. 2023.SSL and TLS: Theory and Practice. Artech House

    2023

  30. [38]

    Adil Oualid, Youssef Qasmaoui, Youssef Balouki, and Lahcen Moumoun. 2025. Federated Learning and Open Banking for Inclusive Credit Scoring in Morocco: A Systematic Review. InInternational Conference on intelligent systems and digital applications. Springer, 242–256

    2025

  31. [39]

    Torben Pryds Pedersen. 1991. Non-interactive and information-theoretic secure verifiable secret sharing. InAnnual international cryptology conference. Springer, 129–140

    1991

  32. [40]

    Hanchi Ren, Jingjing Deng, and Xianghua Xie. 2022. Grnn: generative regression neural network—a data leakage attack for federated learning.ACM Transactions on Intelligent Systems and Technology (TIST)13, 4 (2022), 1–24

    2022

  33. [41]

    Miruna Rosca, Damien Stehlé, and Alexandre Wallet. 2018. On the ring-LWE and polynomial-LWE problems. InAnnual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 146–173

    2018

  34. [42]

    Adi Shamir. 1979. How to share a secret.Commun. ACM22, 11 (1979), 612–613

    1979

  35. [43]

    Jinhyun So, Ramy E Ali, Başak Güler, Jiantao Jiao, and A Salman Avestimehr

  36. [44]

    Timothy Stevens, Christian Skalka, Christelle Vincent, John Ring, Samuel Clark, and Joseph Near. 2022. Efficient differentially private secure aggregation for federated learning via hardness of learning with errors. In31st USENIX security symposium (USENIX Security 22). 1379–1395

    2022

  37. [45]

    Jie Xu, Benjamin S Glicksberg, Chang Su, Peter Walker, Jiang Bian, and Fei Wang. 2021. Federated learning for healthcare informatics.Journal of healthcare informatics research5, 1 (2021), 1–19

    2021

  38. [46]

    Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. 2019. Federated machine learning: Concept and applications.ACM Transactions on Intelligent Systems and Technology (TIST)10, 2 (2019), 1–19

    2019

  39. [47]

    InProceedings of the AAAI Conference on Artificial Intelligence, Vol

    Securing secure aggregation: Mitigating multi-round privacy leakage in federated learning. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 9864–9873

  40. [48]

    Yufei Zhou, Peijia Zheng, Xiaochun Cao, and Jiwu Huang. 2024. Two-Tier Data Packing in RLWE-based Homomorphic Encryption for Secure Federated Learning. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. 2844–2858

    2024

  41. [49]

    Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep leakage from gradients. Advances in neural information processing systems32 (2019). A Ethical Considerations In this section, we discuss the potential ethical issues. Disclosures.Our research does not involve any system or soft...

    2019

  42. [51]

    Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. 2020. BatchCrypt: Efficient homomorphic encryption for Cross-Silo federated learning. In2020 USENIX annual technical conference (USENIX ATC 20). 493–506

    2020

  43. [64]

    However, the computation time for the holders, under different secret lengths, remains noticeably lower than Shamir, as shown in Fig. 10a. The communication overhead for the holders is also much lower than Shamir, even more significantly so compared to 10 20 30 40 50 60 70 80 ...

  44. [1236]

    doi:10.1109/TIFS.2024.3524160

    2024

  45. [2022]

    IACR Cryptol

    MicroFedML: Privacy Preserving Federated Learning for Small Weights. IACR Cryptol. ePrint Arch.2022 (2022), 714

    2022

  46. [2023]

    In2023 IEEE Symposium on Security and Privacy (SP)

    Flamingo: Multi-round single-server secure aggregation with applications to private federated learning. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 477–496

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.