🤖 machine learning

Privacy-Enhanced Zero-Order Federated Learning via xMK-CKKS over Wireless Channels

This paper proposes a four-phase protocol that enables privacy-enhanced zero-order federated learning over wireless channels by leveraging the xMK-CKKS multi-key homomorphic encryption scheme to achieve secure, channel-estimation-free aggregation with $O(1/\sqrt{K})$ convergence rates, even when the server colludes with up to $N-1$ clients.

Original authors: Anthony Ayli, Khalil Harris, Jihad Fahs, Mohamad Assaad

Published 2026-05-29

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Anthony Ayli, Khalil Harris, Jihad Fahs, Mohamad Assaad

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of friends trying to solve a giant puzzle together, but they are all in different rooms and can't show each other their pieces. This is Federated Learning: everyone trains a model on their own private data and sends updates to a central "teacher" (the server) to improve the group's solution.

The problem? Sending those updates usually leaks secrets. If someone intercepts the message, they might figure out what your private data looks like.

To fix this, the authors propose a new way to send these updates using mathematical magic (Homomorphic Encryption) over wireless airwaves. Here is how their solution works, explained simply:

1. The Problem with "One Key to Rule Them All"

Most existing privacy methods use a Single Key. Imagine everyone in the group shares one master key to lock and unlock their messages.

The Flaw: If even one friend is "honest-but-curious" (they follow the rules but secretly peek at others' messages), they can unlock everyone's updates because they hold the same key. If one person's phone is hacked, the whole group is exposed.

2. The Solution: "Everyone Has Their Own Lock"

This paper introduces a Multi-Key system (specifically called xMK-CKKS).

The Analogy: Instead of one master key, every friend has their own unique lock and key. To open the final box of answers, the server needs a tiny "unlocking piece" from every single friend.
The Benefit: Even if the server is curious, or if $N-1$ friends collude with the server, they still can't open the box without the one missing friend's piece. This makes the system much safer.

3. The Wireless Challenge: The "Fading" Room

Usually, when you send a message over the air (like Wi-Fi), the signal gets distorted by walls, distance, and interference. This is called fading.

The Old Way: To fix this, you usually need to measure the room's acoustics (Channel Estimation) and adjust your voice (Pre-equalization) so the teacher hears you clearly.
The Paper's Twist: Measuring the room perfectly is hard, and if you get it slightly wrong, the "mathematical magic" breaks. The huge numbers used for encryption get scrambled, and the message is lost.

4. The Magic Trick: "Singing in the Same Key"

The authors realized that if they send two things at the same time through the exact same distortion, the distortion cancels itself out.

Think of it like this:

Phase 1: You send a "reference note" (a partial public key) through the air. The teacher hears it distorted.
Phase 2: You send your "secret message" (the encrypted update) through the air.
Phase 3: You send a "helper note" (a decryption share) through the air.

The Secret Sauce: Because the "reference note" and the "secret message" travel through the exact same airwaves at the exact same moment, they get distorted in the exact same way. When the teacher combines them later, the distortion mathematically cancels out, just like noise-canceling headphones.

Result: They don't need to measure the room or adjust their voices. They just send everything at once, and the math fixes the signal automatically.

5. Zero-Order Learning: The "Blind" Approach

To keep things fast and light, they use a technique called Zero-Order (ZO) learning.

The Analogy: Instead of sending a detailed map of the entire puzzle (which is huge), each friend just sends a single number: "If I move my piece slightly left, does the picture get better or worse?"
Why it matters: This means the amount of data sent is tiny (just one number per person), regardless of how complex the puzzle is. This makes the encryption overhead small and manageable.

6. The Results: Does it Work?

The authors tested this on a standard image recognition task (identifying numbers 0 vs. 1).

The Outcome: The system learned just as well as if they weren't using encryption at all. The "noise" added by the math magic was so small it was practically invisible.
The Comparison: When they tried the old method (measuring the room and adjusting), the system failed completely because the tiny errors in measuring the room got magnified by the huge encryption numbers, destroying the message.

Summary

This paper presents a secure way for devices to learn together without sharing private data. It solves two big problems:

Security: It ensures that even if most users are curious or one is hacked, the group's data stays safe (Multi-Key).
Wireless Reality: It allows this heavy encryption to work over wireless channels without needing to perfectly measure the signal, by sending reference and data signals together so they cancel out interference naturally.

It's like a group of spies passing secret notes in a noisy room: instead of trying to shout over the noise, they whisper a code that only makes sense when two specific parts of the whisper are combined, effectively silencing the room's noise for the receiver.

Technical Summary: Privacy-Enhanced Zero-Order Federated Learning via xMK-CKKS over Wireless Channels

1. Problem Statement

Federated Learning (FL) allows edge devices to collaboratively train models without sharing raw data, but transmitted model updates remain vulnerable to inference attacks. While Homomorphic Encryption (HE) enables privacy-preserving aggregation by allowing servers to compute on encrypted data, existing "HE-over-the-air" methods face two critical limitations:

Security Vulnerability: Most methods rely on single-key HE, where all clients share a secret key. This makes the system vulnerable to "honest-but-curious" (HBC) clients who can decrypt other users' updates, and a compromise of a single client endangers the entire network.
Channel Estimation Dependency: Existing multi-key HE implementations (specifically xMK-CKKS) require large cryptographic parameters (e.g., modulus $q \approx 2^{109}$ to $2^{218}$ ). When combined with over-the-air (OTA) aggregation, standard channel estimation and pre-equalization techniques fail. Any residual channel estimation error is multiplied by the large modulus $q$ during decryption, burying the message signal (scaled by $\Lambda \approx 2^{40}$ ) under a massive noise floor, causing decryption failure.

The central question addressed is: Can multi-key HE be combined with over-the-air aggregation without estimating or compensating for the wireless channel?

2. Methodology

The authors propose a four-phase protocol that integrates xMK-CKKS (a multi-key HE scheme) with Zero-Order (ZO) FL over slowly varying, Line-of-Sight (LoS) dominant wireless channels (e.g., short-range indoor THz).

Core Mechanism: Algebraic Cancellation via Channel Retransmission

The protocol avoids channel estimation by ensuring that the partial public keys and the ciphertexts experience the exact same channel realization within a single communication round. This allows the dominant large-modulus encryption terms to cancel algebraically during decryption.

The Four Phases:

Fresh Key Aggregation (Uplink): Each device $i$ transmits its partial public key $b_i$ simultaneously. The server receives the superposition $\tilde{b}_k = \sum h_{i,k} b_i + \text{noise}$ . Crucially, the server does not estimate $h_{i,k}$ ; it simply broadcasts $\tilde{b}_k$ .
Encryption (Uplink): Devices encode their ZO gradient estimates ( $m_{i,k}$ ) using the received $\tilde{b}_k$ as the public key and transmit ciphertexts $(c_{0}, c_{1})$ . The server aggregates these over the air.
Decryption Share (Uplink): The server broadcasts the aggregated $c_1$ . Devices compute partial decryption shares $D_j$ using their secret keys and transmit them.
Recovery (Downlink): The server combines the aggregated ciphertext and the decryption shares. Because the public key $\tilde{b}_k$ and the decryption shares were generated using the same channel coefficients $h_{i,k}$ , the term involving the large modulus $q$ cancels out algebraically:
$\tilde{b}_k + \tilde{S}_k a = \text{small noise terms}$
where $\tilde{S}_k$ is the channel-weighted sum of secret keys. The result is a bounded noise term independent of $q$ , allowing the server to recover the aggregated message.

Zero-Order Integration

The protocol utilizes ZO gradient estimation, where each device transmits only a single encrypted scalar per round. This ensures that communication and encryption overhead are independent of the model dimension $d$ , making the scheme scalable. The channel disturbance is treated as a bounded perturbation within the learning algorithm rather than an error to be removed.

3. Key Contributions

Channel-Agnostic Multi-Key HE: The paper proposes the first protocol enabling xMK-CKKS aggregation over a shared wireless channel without Channel State Information (CSI) acquisition or pre-equalization.
Algebraic Cancellation: It demonstrates that retransmitting partial public keys and ciphertexts through the same channel realization causes the $q$ -scale encryption terms to cancel algebraically. This prevents channel uncertainty from appearing as a $q$ -amplified error that would otherwise destroy decryption.
Convergence Analysis: The authors prove that the protocol preserves the standard ZO-FL convergence rate of $O(1/\sqrt{K})$ up to a negligible noise floor. The residual channel and encryption noise enter the gradient estimator as bounded perturbations.
Enhanced Security: The scheme is secure against an HBC server colluding with up to $N-1$ clients, a significant improvement over single-key HE schemes where a single compromised client breaks the system.
Feasibility Validation: Numerical results on MNIST validate that the protocol works with standard RLWE parameters ( $n=4096, 8192$ ) and that the decoded noise is negligible compared to channel noise.

4. Results

Convergence: Theoretical analysis (Theorem 2) shows the algorithm converges to a neighborhood of the optimal solution with a noise floor $\rho$ . For the tested parameters ( $n=4096/8192$ , $\Lambda=2^{40}$ ), the noise floor is approximately $10^{-16}$ , which is negligible compared to typical channel noise.
Performance: Experiments on MNIST (0-vs-1 classification) show that the encrypted protocol achieves test accuracy within 1% of the unencrypted baseline.
Failure of Alternatives: The paper demonstrates that standard CSI-based pre-equalization (Zero-Forcing or MMSE) fails completely in the multi-key setting. Even with small channel estimation errors ( $\sigma_{pilot}=0.1$ ), the residual error is multiplied by $q$ , causing the training loss to diverge immediately (saturating near $10^{14}$ ).
Overhead: The communication overhead per device is independent of the model dimension. With a 1 THz bandwidth, transmission times are under 8 ms, fitting within the coherence time of static indoor THz channels.

5. Significance and Claims

The paper claims that single-key CKKS can scale to large moduli over the air using beamforming, but the multi-key setting is fundamentally different. In multi-key HE, the cancellation of large key terms relies on an algebraic identity between the aggregated public key and decryption shares. If these terms experience different channel coefficients (due to estimation errors or time-varying channels), the cancellation fails, and the $q$ -scale residual destroys the message.

The significance of this work lies in resolving this conflict by sacrificing channel estimation for channel consistency. By retransmitting keys and data through the same fading realization, the protocol ensures the algebraic cancellation holds without needing to know the channel. This enables:

Stronger Security: Multi-key protection against collusion.
Robustness: Operation without complex CSI acquisition or beamforming.
Scalability: Zero-order communication overhead that does not grow with model size.

The authors conclude that while the protocol is currently suited for slowly varying LoS-dominant links (like fixed indoor THz), it establishes a foundational method for combining strong cryptographic privacy with the efficiency of over-the-air computation. Future work suggested includes reducing key retransmission overhead and combining the protocol with differential privacy.