---
title: Communication-Efficient Secure Aggregation
url: https://www.emergentmind.com/topics/communication-efficient-secure-aggregation
type: topic
---

# Communication-Efficient Secure Aggregation

Communication-efficient secure aggregation (CESA) encompasses a class of protocols and constructions for privacy-preserving model aggregation in federated and distributed learning, with an explicit focus on minimizing communication overhead per participant and per server. These protocols combine cryptographic, information-theoretic, and network-coding tools to allow aggregation of user-supplied updates (e.g., stochastic gradients or model weights) without exposing any individual’s contribution—while sharply reducing per-user and system bandwidth relative to classic secure aggregation such as SecAgg. CESA is of particular importance in large-scale cross-device federated learning, resource-constrained edge environments, and high-dimensional learning scenarios.

## 1. Architectural Principles and Models

Communication-efficient secure aggregation protocols are motivated by the scaling bottlenecks of classic solutions such as Bonawitz et al.’s SecAgg, where per-user communication and computation grow linearly in the number of participants $N$, and server-side costs can increase quadratically. CESA minimizes these costs via the following key design patterns:

- **Sparse or Pairwise Secret-Sharing Graphs:** Instead of all-to-all secret sharing, clients only establish key agreements and/or exchange Shamir shares with a logarithmic or constant number of other clients, e.g., as in sparse Erdős–Rényi graphs [2012.05433] or ring/chain topologies [2409.01722].
- **Hierarchical or Two-tier Aggregation:** Many methods exploit a user–relay–server architecture, where user updates are masked and aggregated at relay nodes before reaching the server. This supports key pre-aggregation and reduces bottleneck hop traffic [2511.20117, 2507.14768].
- **One-Shot or Single-Round Communication:** Certain hybrid and homomorphic schemes achieve a single upload per client per round, independent of the number of users and rounds [2511.23252, 2304.03841].
- **Minimal Masking Complexity:** Some protocols dispense with double-masking, Shamir secret sharing, and auxiliary user-to-user communication, relying instead on only two shared secrets per client per round [2409.01722, 2405.01144].
- **Communication-Optimized Compression:** Quantization, pruning, and product quantization are used under secure aggregation constraints to compress vector updates before secure summation [2404.13575, 2207.12779, 1912.00131].

## 2. Fundamental Information-Theoretic and Cryptographic Limits

Theoretical performance limits of secure aggregation are characterized both for centralized (server-based) and decentralized (peer-to-peer) models:

- **Decentralized Secure Aggregation:** For a fully connected $K$-user network with $T$-collusion resilience, the optimal rates are: per-user communication rate $R_X\geq1$, independent key rate $R_Z\geq1$, system-wide entropy $R_\Sigma\geq K-1$. This is achievable by masking each input with a unique key such that only the sum of all inputs is revealed upon aggregate decoding [2508.00596].
- **Hierarchical/Relay Models:** In $N$-user, $K$-relay structures with $n$ user-to-relay links per user and $m$ users per relay ($Nn=Km$), the cut-set lower bounds on the minimum per-user and per-relay communication are $(1/n, 1/n)$. Collusion thresholds for users and relays dictate matching lower bounds on key entropy per user [2511.20117]. Extensions permit heterogeneous security policies with minimized total key-generation rate [2507.14768].
- **Group-Based and Two-Level Sharing:** Partitioned ramp sharing or group-based secret sharing (“sharding”) can further push per-user communication down to sublinear in $N$, typically $O(d\log N)$ for $d$-dimensional vectors [2201.00864].

These results specify tight trade-offs between privacy, robustness (dropout-resilience), and communication for broad classes of aggregation networks.

## 3. Protocol Mechanisms and Optimizations

### 3.1 Key Agreement and Masking

Approaches include:

- **Sparse Graph Masking:** Each client establishes shared secrets only with $O(\log N)$ or $O(1)$ other clients, and masks its vector with two or a logarithmic number of PRG-generated masks. Mask cancellation is ensured by symmetric mask assignment [2409.01722, 2405.01144].
- **In-network Aggregation:** Programmable network devices (e.g., Tofino switches) serve as aggregation “gateways” that sum client’s random seeds “on-the-wire” [2501.01187].
- **Additive Secret Sharing and Ramp Codes:** Techniques based on Shamir and ramp secret sharing (over blocks/partitions of the update vector) minimize share size and allow communication down to per-block or per-group rates [2201.00864, 2305.12950].

### 3.2 Compression and Quantization

- **Secure Compression:** Scalar quantization, product quantization (PQ), and pruning operate under linear decompression constraints so that quantized updates can be securely summed under any secure aggregation primitive [2207.12779, 2404.13575].
- **Auto-tuning of Quantization:** Combining rotation (Walsh–Hadamard plus dithering) and quantization allows for reduced per-weight bitwidth, with bin-width determined via a wrapped-normal fit of the compressed update sum [1912.00131].
- **Secure Indexing (for PQ):** Secure histogramming over assignment indices of PQ, enabled by TEE or secure aggregation of masked code indices, yields extreme compression (up to 40×) without violating privacy [2207.12779].

### 3.3 One-Round and Single-Message Schemes

- **One-Shot Homomorphic Protocols:** Multi-key CKKS (MK-CKKS) homomorphic encryption, combined with ECDH additive masking, supports single-message aggregation per round, achieving a near-constant per-client communication expansion (e.g., ≈12× over plaintext) and removing the need for decryption-share exchange [2511.23252].
- **Verifiable Aggregation:** Cryptographic commitments or authenticated vector commitments (APVC) allow the server to prove correctness of aggregation to clients, typically at minimal extra communication [2304.03841].

## 4. Dropout Resilience, Robustness, and Security Guarantees

- **Dropout Handling:** The ability to tolerate random or adversarial user dropout without re-invoking expensive key or mask recomputation is achieved via group-based sharing [2201.00864], network-coding-based secret sharing [2009.11248], or direct switch aggregation [2501.01187].
- **Adaptive/Aggregator-Adversary Robustness:** Some protocols are designed for honest-but-curious servers (e.g., CESA, ACCESS-FL, NET-SA) [2409.01722, 2501.01187, 2405.01144], while others guarantee information-theoretic security even under collusions and Byzantine faults [2508.00596, 2302.09913, 2202.04169

Source: https://www.emergentmind.com/topics/communication-efficient-secure-aggregation