Towards Privacy-Preserving Federated Learning using Hybrid Homomorphic Encryption

1. Problem Statement

Federated Learning (FL) allows collaborative model training without sharing raw data, but local model updates can still leak sensitive information (e.g., via gradient inversion attacks). To mitigate this, Hybrid Homomorphic Encryption (HHE) has been proposed, combining lightweight symmetric encryption (for data) with Homomorphic Encryption (HE) (for key protection) to reduce client-side overhead.

However, existing HHE-FL systems (e.g., Correia et al., Nguyen et al.) suffer from a critical security flaw: they rely on a single shared homomorphic key pair for all clients.

• The Vulnerability: If a malicious client intercepts another client's communication, they can use the shared homomorphic secret key to decrypt the encrypted symmetric key, recover the symmetric key, and subsequently decrypt the victim's model updates.
• The Gap: Current systems assume an "honest-but-curious" threat model where clients do not act maliciously against each other. This is unrealistic for cross-device FL scenarios (e.g., IoT) where devices may be compromised.

2. Methodology

The authors propose two alternative key-protection mechanisms to eliminate the shared-key liability, extending security to settings with malicious participants without introducing a Trusted Key Dealer.

A. System Architecture

The system involves three entities:

1. Third-Party Authority (TPA): Generates and distributes keys (BFV keys, PASTA keys, masks, or RSA keys).
2. Server: Coordinates FL, performs Homomorphic Evaluation of Symmetric Decryption (HESD), and aggregates updates.
3. Clients: Train local models, encrypt updates, and send them to the server.

B. Proposed Countermeasures

Both methods protect the symmetric key ($sk_i$) used to encrypt the client's model weights before it is sent to the server under the homomorphic public key.

1. Masking Mechanism:

   • Process: The TPA generates a unique random mask $M_i$ for each client. The client computes $HE.Enc(sk_i + M_i)$ and sends this to the server.
   • Server Action: The server, knowing $M_i$, homomorphically subtracts the mask: $HE.Enc(sk_i + M_i) - M_i = HE.Enc(sk_i)$.
   • Benefit: The server can retrieve the encrypted key without learning the plaintext key, and other clients cannot derive $sk_i$ even if they intercept the message (as they lack $M_i$).

2. RSA Encapsulation Mechanism:

   • Process: The client first encrypts the symmetric key with the homomorphic scheme ($sk_i^{HE} = HE.Enc(sk_i)$). Since $sk_i^{HE}$ is too large for direct RSA encryption, it is split into chunks. Each chunk is then encapsulated using the Server's RSA Public Key: $RSA.Enc(sk_i^{HE})$.
   • Server Action: The server uses its RSA Secret Key to decrypt the chunks, reconstruct $sk_i^{HE}$, and proceed with HESD.
   • Benefit: Relies on standard public-key cryptography; only the server can unwrap the key, preventing malicious clients from accessing the homomorphic key.

3. Key Contributions

1. Threat Model Extension: Identified and addressed the vulnerability of shared homomorphic keys in HHE-FL, moving from an honest-but-curious model to one supporting malicious clients capable of intercepting traffic.
2. Novel Mechanisms: Integrated Masking and RSA Encapsulation into the HHE-FL workflow to protect client-specific keys.
3. Security Analysis: Provided formal security proofs showing that under the IND-CPA security of BFV, semantic security of PASTA, and RSA assumptions, the system guarantees confidentiality of individual updates and aggregated models even against malicious clients.
4. Implementation & Evaluation: Implemented both approaches on the Flower framework using the PASTA/BFV HHE scheme and evaluated them on the MNIST dataset with 12 clients.

4. Experimental Results

The evaluation compared the proposed methods against the baseline (Correia et al.) and between the two new mechanisms.

• Model Accuracy:

  • Masking: Achieved the highest accuracy (98.35%), slightly outperforming the baseline (97.39%).
  • RSA-4096: Achieved 97.28%, showing minimal accuracy degradation.
  • Conclusion: Both mechanisms preserve model quality effectively.

• Communication Overhead:

  • Masking: Negligible increase (same ciphertext size as baseline, ~1.79 MB).
  • RSA Encapsulation: Increased client communication by 1.31× (RSA-3072) and 1.22× (RSA-4096) due to the extra layer of encryption and chunking.

• Computation Overhead:

  • Client Side:
    • Masking: Negligible cost (~0.018s for key masking).
    • RSA: Added ~0.35–0.38s for key chunking and RSA encryption.
    • Total client runtime remained low (~12s), only slightly higher than the baseline.
  • Server Side:
    • The dominant cost remains the HESD step (~1400s per client).
    • Masking added ~0.001s (unmasking).
    • RSA added ~12s (RSA-3072) to ~19s (RSA-4096) for decryption per client. While measurable, this is insignificant compared to the HESD bottleneck.

5. Significance and Conclusion

This work is significant because it hardens HHE-FL against realistic adversarial settings without sacrificing the efficiency benefits that make HHE attractive for resource-constrained devices (IoT).

• Practicality: The Masking approach is highlighted as the most efficient solution, offering strong security with negligible overhead, making it ideal for large-scale cross-device FL.
• Robustness: The RSA Encapsulation approach offers a robust alternative based on standard PKI, suitable for environments where mask management is difficult, despite slightly higher computational costs.
• Future Impact: The study demonstrates that secure aggregation in FL can be achieved without relying on a Trusted Key Dealer or assuming all clients are honest, paving the way for more secure deployment of privacy-preserving AI in sensitive domains like healthcare and IoT.

Future Work Directions: Exploring lightweight multi-key HE, dropout-robust training via secret sharing, and hardware-assisted HESD to further reduce server bottlenecks.