🤖 machine learning

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning

The paper proposes DisAgg, a distributed aggregation protocol that utilizes a small client committee to perform local secret-sharing-based aggregation, thereby eliminating expensive cryptographic operations and significantly reducing communication and computation overhead compared to existing secure aggregation methods like OPA.

Original authors: Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos, Karthikeyan Saravanan, Jie Xu, Anastasios Drosou, Mete Ozay

Published 2026-05-14

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos, Karthikeyan Saravanan, Jie Xu, Anastasios Drosou, Mete Ozay

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Learning Together Without Sharing Secrets

Imagine a group of neighbors who all want to learn how to bake the perfect cake. Instead of everyone bringing their secret family recipes to a central kitchen (which risks someone stealing a recipe), they keep their recipes at home. They send the server only the result of their baking attempt (e.g., "add 2 more grams of sugar") so the group can figure out the perfect recipe together. This is Federated Learning.

However, there's a problem: even if they only send the "sugar adjustment," a nosy server (or a hacker) could sometimes reverse-engineer the original recipe from those small adjustments.

To fix this, we use Secure Aggregation. It's like putting every neighbor's note into a locked box, mixing them all up, and only opening the box to see the total amount of sugar needed, without ever seeing who sent what.

The Problem with Current Methods

The paper argues that the current ways of doing this "locked box" mixing are too slow and heavy.

The Old Way (SECAGG): Imagine every neighbor has to shake hands with every other neighbor to exchange secret keys before they can send their notes. If there are 100 neighbors, that's nearly 10,000 handshakes! It's a massive traffic jam.
The "One-Shot" Way (OPA): This is faster. Everyone sends their note in one go. But to unlock the final mix, the math required is incredibly heavy, like trying to solve a giant Sudoku puzzle just to read a grocery list. It puts a huge burden on everyone's computer.

The Solution: DISAGG (The "Taste-Testers")

The authors propose a new method called DISAGG. Instead of the central server doing all the heavy lifting, or everyone shaking hands with everyone, they introduce a small group of trusted neighbors called Aggregators.

Here is how DISAGG works, step-by-step:

The Setup: The server picks a small group of neighbors (say, 10 people) to be the Aggregators. These are like the "Taste-Testers" of the group.
The Secret Split: Every regular neighbor takes their secret recipe note and cuts it into 10 tiny, scrambled pieces (like shredding a document). They send one piece to each of the 10 Aggregators.
- Crucial Point: No single Aggregator sees the whole note. They only see a tiny, meaningless fragment.
The Local Mix: Each Aggregator collects the fragments from all the neighbors. They add up their 10 pieces locally. Now, instead of 100 notes, the Aggregators have just 10 "partial sums."
The Final Reveal: The Aggregators send these 10 partial sums back to the server. The server combines them to get the final answer (the total sugar needed).

Why This is Better (The Analogy)

Think of it like a potluck dinner:

Old Way: Everyone brings a dish, but before they can eat, they all have to stand in a giant circle, passing ingredients back and forth to verify everyone's identity. It takes hours.
OPA Way: Everyone brings a dish, but the chef has to use a super-complex, heavy-duty blender to mix them all safely. The blender is so loud and slow it takes forever.
DISAGG Way: Everyone brings their dish to a small table of 10 "Taste-Testers." The Taste-Testers mix their own small bowls of ingredients. Then, they just hand the 10 mixed bowls to the Chef. The Chef mixes those 10 bowls and serves the meal.

The Result:

Regular Neighbors (Clients): They do very little work. They just cut their note and send it. No heavy math.
The Chef (Server): They don't have to do the heavy lifting of mixing thousands of notes. They just mix the 10 bowls the Taste-Testers sent.
The Taste-Testers (Aggregators): They do the extra work, but since there are only 10 of them, the group handles it easily.

The Results

The paper tested this against the current best method (OPA) using massive numbers (100,000 clients and huge models).

Speed: DISAGG was 4.6 times faster than the previous best method.
Efficiency: It reduced the heavy computer work for the regular users and the server significantly.
Privacy: It remains just as secure. Even if a few Taste-Testers collude (try to cheat), they can't figure out what any single neighbor's recipe was.

Summary

DISAGG is a smarter way to mix secret data in a group. Instead of making everyone do heavy math or forcing the server to do all the work, it delegates the mixing to a small, specialized team. This makes the whole process much faster and lighter, allowing millions of people to learn together without slowing down their phones or revealing their secrets.

Technical Summary: DISAGG – Distributed Aggregators for Efficient Secure Aggregation

1. Problem Statement

Federated Learning (FL) enables collaborative model training while keeping raw data local, but standard FL exposes client updates to a central server, creating privacy risks against "honest-but-curious" servers via gradient inversion attacks. Secure Aggregation (SA) protocols address this by ensuring the server learns only the aggregate of updates, not individual contributions.

However, existing SA protocols face significant scalability and efficiency bottlenecks in production environments characterized by large client populations, intermittent connectivity, and client dropouts:

Multi-round protocols (e.g., SECAGG, SECAGG+): Rely on pairwise key exchanges and multi-phase recovery mechanisms. These incur $O(N^2)$ or $O(N \log N)$ communication overhead and introduce synchronization barriers, making them sensitive to stragglers and dropouts.
One-shot protocols (e.g., OPA): Reduce round complexity to a single interaction per iteration but shift the burden to heavy cryptographic operations (e.g., Learning With Errors-based masking, packed Shamir secret sharing). This results in substantial computational and communication overhead that scales with model dimension and committee size, particularly for clients and the server.

The core challenge is to design a protocol that maintains the low round complexity and dropout resilience of one-shot approaches while significantly reducing the computational and cryptographic overhead on regular clients and the server.

2. Methodology: The DISAGG Protocol

The authors propose DISAGG (Distributed Aggregators), a novel secure aggregation protocol that distributes the aggregation workload to a small, randomly selected committee of clients called Aggregators.

Core Mechanism

Unlike traditional schemes where the server performs the final aggregation or clients mask their updates with pairwise keys, DISAGG leverages Lagrange Coded Computing (LCC) and Secret Sharing:

Setup (Round 0): The server selects a set of participating clients ( $U$ ) and distributes system parameters.
Secret Sharing & Upload (Round 1):
- The server randomly selects a subset of clients ( $A$ ) to act as Aggregators.
- Regular clients encode their model update vectors ( $x_i$ ) into secret shares using Lagrange interpolation.
- Each client encrypts its shares using the public keys of the Aggregators and sends them to the server.
- Crucially, clients do not perform local masking or pairwise key exchanges with all other clients.
Distributed Aggregation (Round 2):
- The server forwards the received shares to the Aggregators.
- Aggregators decrypt the shares, locally compute the partial sum of the shares they received, and return these aggregated shares to the server.
- The server reconstructs the global model update by combining the aggregated shares from a sufficient number of surviving Aggregators.

Security and Robustness

Threat Model: The protocol assumes an honest-but-curious server and tolerates a fraction $\gamma$ of colluding clients and $\delta$ of dropped clients.
Privacy: It provides information-theoretic security (T-privacy). Even if up to $t_c$ Aggregators collude, they learn nothing about individual client updates beyond the sum, achieved by adding random masking vectors during the secret sharing process.
Correctness: The protocol is robust to dropouts. As long as the number of surviving Aggregators exceeds the reconstruction threshold ( $t_r$ ), the server can successfully reconstruct the sum.

3. Key Contributions

Novel Protocol Design: DISAGG is the first protocol to apply committee-based distributed summation directly to model aggregation using secret sharing, eliminating the need for local cryptographic masking and complex dropout-recovery mechanisms found in SECAGG/SECAGG+.
Theoretical Analysis: The authors extend theoretical analyses for secret-share threshold selection to include realistic constraints, modeling both dropped and corrupt clients as random variables and incorporating Byzantine fault-tolerance limits to derive optimal parameters for the Aggregator committee size.
Performance Framework: A timing analysis framework is developed to compare DISAGG against state-of-the-art protocols (specifically OPA) without requiring full-scale simulations, accounting for both computation and communication complexities under realistic network constraints (e.g., 5G speeds).

4. Results and Performance

The paper evaluates DISAGG against SECAGG, SECAGG+, LIGHTSECAGG, and OPA across various model sizes ( $M$ ) and client counts ( $N$ ).

Speedup: In realistic cross-device settings (e.g., $N=100k$ clients, $M=100k$ parameters, 5G connectivity), DISAGG achieves a 4.6x speedup over OPA, the previous best protocol. Theoretical analysis suggests potential speedups of up to 25x under specific configurations ( $M=1M, N=1M$ ).
Complexity Reduction:
- Client Side: DISAGG reduces client computation from $O(\lambda M)$ (in OPA, where $\lambda$ is a security parameter) to $O(M \log A)$ , removing heavy cryptographic operations.
- Server Side: Server computation is reduced from $O(NM + \lambda A)$ to $O(M \log A)$ , as the server avoids decoding heavy ciphertexts.
- Trade-off: The efficiency gains come at the cost of increased communication and computation for the Aggregators. However, the paper demonstrates that by tuning the packing factor ( $\rho$ ) and the number of Aggregators ( $A$ ), this overhead can be managed while maintaining significant overall system speedups.
Robustness: DISAGG maintains a speedup of over 4x over OPA even under combined dropout and collusion factors ( $k = \gamma + \delta$ ) up to 0.3.
Model Utility: Experiments on diverse datasets (MNIST, CIFAR, CelebA, SST2) confirm that DISAGG achieves convergence and accuracy comparable to plaintext aggregation and OPA, with negligible degradation due to quantization.

5. Significance and Claims

The paper claims that DISAGG successfully bridges the gap between the low round complexity of modern one-shot protocols and the computational efficiency required for large-scale, cross-device Federated Learning.

Efficiency: By offloading the aggregation burden to a small, specialized committee, DISAGG eliminates the "heavy" cryptographic overhead that has hindered the adoption of one-shot protocols on resource-constrained edge devices.
Scalability: The protocol scales effectively to millions of clients and parameters, addressing the synchronization barriers and straggler sensitivity that plague multi-round protocols.
Practicality: The authors assert that DISAGG offers a practical solution for real-world FL deployments where network heterogeneity and client volatility are common, providing a strong balance between privacy guarantees (information-theoretic security) and system performance.

The work concludes that distributed aggregation via secret sharing is a viable and superior alternative for efficient secure aggregation in federated learning, particularly in scenarios demanding high throughput and low latency.