---
title: Decentralized Secure Aggregation (DSA)
url: https://www.emergentmind.com/topics/decentralized-secure-aggregation-dsa
type: topic
---

# Decentralized Secure Aggregation (DSA)

Decentralized Secure Aggregation (DSA) refers to protocol frameworks that enable a network of mutually distrustful parties to collaboratively compute an aggregate value—typically the sum or average of private vectors—while provably protecting the confidentiality of individual inputs, ensuring integrity against malicious or faulty peers, and providing robustness even in the presence of collusion or Byzantine behavior. DSA generalizes secure aggregation from the centralized (server-mediated) federated learning setting to fully distributed (peer-to-peer or multi-aggregator) environments, where the aggregation step is performed without a trusted party, using information-theoretic, cryptographic, or hybrid techniques.

## 1. Threat Models, Security Goals, and Formal Definitions

DSA protocols formally address three intertwined challenges: data confidentiality, robustness to adversarial actors (including colluding and Byzantine peers), and correctness. The main adversarial models are:

- **Honest-but-curious (semi-honest):** Participants follow the protocol but attempt to infer other users’ inputs from observed messages. DSA guarantees that any coalition up to size $t$ (for some threshold $t$) learns nothing beyond the aggregate, usually formalized via a simulation argument. This is the primary target in protocols such as additive secret sharing [2201.07730], information-theoretic masking [2508.00596], and groupwise key schemes [2511.14444].
- **Byzantine (active/malicious):** Participants may arbitrarily deviate, sending malformed or malicious updates in an attempt to corrupt the aggregate. Modern DSA protocols integrate Byzantine-robust aggregation rules and cryptographically authenticated messages to defend against such attacks [2404.17970], [2409.17754].
- **Collusion:** Subsets of users may collude, combining their private randomness, keys, and received messages. DSA security definitions often demand $t$-privacy: no coalition of up to $t$ users (plus their keys/messages) learns more than the global sum [2508.00596], [2512.16112].

Formally, correctness requires that each user can reliably reconstruct the sum $S := \sum_{i=1}^K W_i$ given their own input and all observed protocol messages; security requires that no coalition learns any additional information about non-colluders' inputs beyond $S$.

## 2. Information-Theoretic Foundations and Key Rate Characterizations

Recent work has delineated the fundamental communication and key requirements for DSA under arbitrary collusion patterns. The canonical setting assumes $K$ users, each with input $W_k \in \mathbb{F}_q^L$, aiming to compute $S = \sum_{k=1}^K W_k$ with $t$-privacy [2508.00596]:

- **Minimal communication**: Each user must broadcast at least one symbol per input symbol ($R_X \geq 1$).
- **Optimal key rate**: Each user must hold at least one symbol of secret key; the system as a whole must generate at least $K-1$ independent key symbols ($R_{Z_\Sigma} \geq K-1$).
- **Achievability**: A linear one-time-pad masking of each $W_k$ with an independent key $Z_k$ (with the sum of all keys zero) is sufficient. The broadcast $X_k = W_k + Z_k$ allows each user to recover $S$ by summing all $X_k$ and removing their own key.

When the keying structure is generalized to groupwise keys (every subset of $G$ users shares an independent secret) [2511.14444], the optimal groupwise key rate for collusion threshold $T$ is $R_K \geq (K - T - 2) / \binom{K - T - 1}{G}$ for $2 \leq G < K-T$. For arbitrary security sets and collusion families, the source key rate is precisely characterized via a linear program, enabling DSA to flexibly target non-uniform privacy requirements [2512.16112].

## 3. Cryptographic Protocol Constructions

DSA protocols instantiate these foundations with constructions falling into three major categories:

- **Additive Secret Sharing and MPC**: Each user splits their update into random shares, distributing them to aggregators or peers. Only the full set of shares allows recovery of the original input (preventing any subset from learning anything), and the aggregate can be computed via local addition on shares [2201.07730], [2404.17970]. In SCOTCH [2201.07730], $n$ servers collect shares and compute a sum without revealing any client update, with $t$-privacy against collusion.
- **Additive Homomorphic Encryption (HE)**: Users encrypt their updates under a jointly generated key. The aggregator adds ciphertexts to obtain an encrypted sum, which can then be decrypted only with collaboration from a threshold of users [2111.10753]. Protocols such as DTAHE allow the aggregation of arbitrary linear combinations (e.g., convolutional layers in FL), with security against both dropouts and malicious modification enforced via blockchain smart contracts.
- **Hybrid Cryptography/TEE Architectures**: DSA can combine TEEs for efficient secure computation with cryptographic masking for operators or parties lacking hardware support [2504.08325]. Various configurations enable trade-offs between end-to-end cryptographic security and near-native performance. For example, parties may encrypt data directly to an aggregator enclave, or use FHE for aggregation and TEE-side decryption.

DSA for decentralized settings also encompasses consensus-based aggregation (e.g., ADMM [2012.07183]), decentralized key generation [2309.01828], and blockchain-based summation with zero-knowledge proofs [2308.15267].

## 4. Robustness Against Byzantine and Active Adversaries

Achieving integrity and convergence in the presence of Byzantine/malicious peers is essential for DSA in decentralized learning:

- **Byzantine-robust aggregation**: Protocols such as WFAgg [2409.17754], SecureDL [2404.17970], and Sentinel [2310.08097] replace naive averaging with robust statistics—median, trimmed mean, cosine similarity thresholds, temporal anomaly filters, or validation-based weighting—to filter poisoned or anomalous updates. Typically, acceptance thresholds are derived so that, as long as the number of Byzantine users per neighbor set is less than half, consensus and convergence are maintained.
- **Cryptographic protections**: Information-theoretic MACs [2404.17970] or zero-knowledge proofs [2308.15267] ensure the integrity of exchanged messages or enforce correct computation in the presence of arbitrary deviation.
- **Interaction with privacy**: Byzantine-robust schemes must avoid information leakage from the aggregation process; e.g., SecureDL implements all filtering (cosine similarity, normalization) over secret-shared inputs, ensuring that only the aggregate is ever revealed.

These approaches are empirically demonstrated to preserve model accuracy and consensus even with aggressive attack models (e.g., 80% Byzantine), far outperforming centralized or non-private robust aggregators.

## 5. Communication Models, Complexity, and Scalability

DSA protocols are highly sensitive to network structure, communication complexity, and scalability constraints:

| Protocol Family     | Per-User Communication | Key/State Overhead | Scalability                                     |
|---------------------|-----------------------|--------------------|------------------------------------------------|
| Additive SS/MPC     | $O(n)$                | $O(1)$             | Linear in $n$ servers/users [2201.07730]        |
| Info-theoretic DSA  | $O(1)$                | $O(K-1)$           | Optimal, as each user only broadcasts 1 symbol (sum masking) [2508.00596] |
| Groupwise Keys      | $O(1)$                | $O(n^G)$           | Scales with group size, requires careful design [2511.14444] |
| HE/FHE-based        | $O(n)$ to $O(n^2)$    | Ciphertext-size    | High, for large $n$ and large input dimension   |
| Blockchain-based    | $O(\log n)$           | $O(\log n)$        | Efficient on-chain (hypercube), but expensive proofs [2308.15267] |
| ADMM/group design   | $O(s)$                | Low                | Efficient via combinatorial block design [2012.07183] |

Careful design choices impact runtime, memory, and communication overhead. Decentralized aggregation with sparsification (e.g., CESAR [2405.07708]) enables dramatic reductions in communication by transmitting only sparse parameter subsets, requiring protocol adaptations to ensure masks still cancel.

## 6. Specialized DSA Architectures and Applications

DSA has been deployed and evaluated in diverse application-driven topologies:

- **Federated Learning and Multi-Server/Peer Models**: In general FL over unreliable or partitioned networks, DSA implements confidentiality and aggregation among clients and aggregators [2201.07730].
- **Space/Satellite Constellations**: FedSecure [2309.01828] introduces decentralized key generation and on-orbit aggregation, efficiently handling satellite visibility dynamics and eavesdropping.
- **Blockchain/SNARK-driven Aggregation**: Protocols using Ethereum and Pedersen commitments combined with hypercube topologies and SNARK proofs provide fully trustless aggregation with scalable (logarithmic) overhead [2308.15267].
- **Graph-based and Combinatorial Designs**: Privacy-preserving decentralized ADMM aggregation leverages block design theory to restrict message patterns, preventing inference from repeated communication [2012.07183].
  
Each implementation tunes trade-offs among privacy, robustness, communication, and deployment complexity.

## 7. Future Directions and Open Problems

Fundamental and applied research in DSA continues to advance on multiple fronts:

- **Key-rate minimization and personalized security**: Linear-program-based optimizations now allow DSA to minimize key overhead under heterogeneous, non-uniform security requirements [2512.16112].
- **Joint privacy and robustness**: Achieving accurate learning under both strict $t$-privacy and Byzantine adversaries remains an active area; compositional or hybrid schemes are under investigation [2404.17970], [2409.17754].
- **Practical scalability**: Efficient key generation, state management, and protocol orchestration for thousands of users are receiving intensified focus.
- **Integration with blockchain and hardware roots-of-trust**: On-chain aggregation and trusted hardware are being explored for auditability and performance [2504.08325], [2308.15267].
- **Asynchronous and dynamic topologies**: Addressing privacy and fault tolerance in asynchrony and under network churn is a significant technical challenge [2408.08628].

DSA now provides a theoretical and practical foundation for private, robust collaborative computation in decentralized settings, with provable security guarantees supported by rigorous communication and key-rate optimality theorems [2508.00596], [2511.14444], [2512.16112], and demonstrated empirical viability in federated and peer-to-peer machine learning deployments [2201.07730], [2404.17970], [2405.07708].

Source: https://www.emergentmind.com/topics/decentralized-secure-aggregation-dsa