Pushing Forward Multi-Secret-Key Homomorphic Encryption for Private Average Aggregation
Miguel Morona-Mínguez, Fernando Pérez-González, Alberto Pedrouzo-Ulloa
cs.CR · cs.LG
Quick verdict
Proposes multi-secret-key RLWE (BFV/CKKS) aggregation avoiding λ-smudging noise, with simulation proof and Lattigo code; semi-honest only, baselines limited.
Summary
The paper targets private average aggregation in cross-silo federated learning. Standard single-key homomorphic encryption (HE) forces a non-collusion assumption, while multiparty HE (MHE) requires λ-dependent large-variance smudging noise during collaborative decryption to defend against recent CPAD key-recovery attacks, easily doubling transmitted data size at λ≥128. The authors propose a multi-secret-key protocol on RLWE-based HE with BFV and CKKS instantiations: no collective public key is generated; each client encrypts under its own secret key plus a zero-sharing linear secret-sharing component, all ciphertexts share a common public polynomial a so aggregation is key-homomorphic (ExtAdd), and because encryptors know their own ciphertext noise, a client-local oracle tracks and cancels the aggregate noise at decryption, removing the smudging term. A simulation-based proof (semi-honest adversary corrupting the aggregator and up to L−1 clients) reduces security to RLWE with explicit advantage bound (6L−1)·N_ctx·ε_RLWE. Experiments in Go/Lattigo (code released) show total per-round runtime of 6.12 s versus 37.65 s for the MHE baseline (BFV, L=32, 16.38M parameters), roughly halved ciphertext expansion, and client setup under 1 s even at L=512. Limitations: semi-honest model only, aggregation weights fixed at setup, and baselines confined to the authors' own MHE implementation and prior work.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A multi-secret-key RLWE protocol (BFV and CKKS instantiations) for private average aggregation removes the λ-dependent smudging noise of MHE by having clients track and cancel their own ciphertext noise during collaborative decryption.
- The protocol is simulation-based secure in the semi-honest model against an adversary corrupting the aggregator and up to L−1 clients, with advantage bounded by (6L−1)·N_ctx·ε_RLWE under the RLWE assumption.
- In Lattigo experiments (L=32, 16.38M parameters), total per-round runtime is 6.12 s vs 37.65 s for BFV (proposed: n=2048, 42-bit q; MHE: n=8192, 120-bit q) and 6.35 s vs 53.03 s for CKKS.
- The protocol transmits a single polynomial component per encrypted update and roughly halves ciphertext expansion, with the relative gain tending to the structural factor 2 at very high precision (Appendix C, Eq. 23).
- Removing the smudging term enlarges the parameter region where CKKS beats BFV: R_mhe ⊂ R_prop (Section 6.4, Figures 4–7).
Strengths
Removes the λ-smudging bottleneck with a concrete mechanism
The client-local oracle O_i (Def. 13, Section 5.2.1) lets each client record and cancel its own encryption noise e_i during collaborative decryption, eliminating the 2^λ-variance smudging term required by [43,45]; the effective decryption noise bound drops from B_mhe = O(L·2^(λ/2)) to B_prop = O(L) (Sections 6.3–6.4).
Full simulation-based security treatment
Appendix G builds hybrids HYB0–HYB3 with an explicit total advantage (6L_H−1)·N_ctx·ε_RLWE; the bijection T_i in Claim 2 carefully handles the joint distribution of ciphertext and partial decryption, the delicate step when partial decryptions are protected only by fresh noise.
Reproducible artifact
Dual exact/approximate instantiation with quantitative regime analysis
Candid implementation discussion
Weaknesses
Semi-honest only, and the core trick assumes honest noise recording
Aggregation weights and membership fixed at setup
Dropout resilience not shown in the provided text
Narrow baseline scope
Freshness discipline concentrated in a PRF seed
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a method paper in applied cryptography for federated learning (FL), from atlanTTic (Universidade de Vigo), extending the authors' preliminary survey [43] into a concrete protocol: multi-secret-key (MSK) RLWE-based homomorphic encryption for private **average aggregation** in cross-silo FL. The motivating gap: MHE (threshold HE following [45]) removes single-key non-collusion assumptions, but the 2024-era CPAD/IND-CPAD key-recovery attacks [16, 17] force collaborative decryption to add smudging noise with variance exponential in λ — an overhead the authors note "can easily double the transmitted data size" for λ≥128. Central claims: (1) a symmetric-key protocol without a collective public key, where each client encrypts under sk_i + r_i (zero-sharing LSSS, Def. 11) and all ciphertexts share one public polynomial a, making ExtAdd key-homomorphic (Def. 10); (2) a client-local oracle O_i (Def. 13) letting each client cancel its own known noise at decryption, removing the λ-dependent smudging term; (3) simulation-based semi-honest security against an adversary corrupting the aggregator plus up to L−1 clients; (4) BFV/CKKS instantiations beating MHE in ciphertext size and runtime.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Why does multiparty homomorphic encryption for federated learning need 'smudging' noise, and what does this paper change?
Recent CPAD attacks recover secret keys from leaked decryption results, so standard multiparty HE adds decryption noise with variance exponential in the security parameter λ, easily doubling transmitted data size at λ≥128. This paper's protocol has each client record and cancel its own encryption noise during collaborative decryption, so decryption noise stays small and λ-independent — cutting total per-round runtime from 37.65 s to 6.12 s (BFV, L=32, 16.38M parameters) in the authors' experiments.
Is there open-source code for this multi-secret-key aggregation protocol?
Yes. The authors released a Go implementation built on the Lattigo library at github.com/miguelmorona/MSKHE-priavgagg, covering both BFV and CKKS variants, with concrete parameter sets (128-bit security, σ=3.2) and single-threaded runtimes reported in the paper.
What adversary model does the protocol protect against?
A static semi-honest (follows-the-protocol-but-curious) adversary corrupting the central aggregator plus up to L−1 of the L clients, with security proven by a simulation argument reduced to the RLWE assumption. It does not cover malicious clients, forged aggregates, or Byzantine-robust aggregation beyond public weighted averaging.
Should I instantiate the protocol with BFV or CKKS?
The paper gives a criterion (Eq. 10): at low plaintext precision BFV and CKKS are similar; as target precision grows, CKKS needs a smaller ciphertext modulus, and because the proposed protocol avoids the large smudging term, this CKKS-favorable transition moves to lower precision than under MHE-based aggregation (Figures 4–7).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The embedded text is a sampled excerpt with several [...sampling gap...] regions (parts of Sections 2.2, 4.1–5.1, 5.3–6.2, some references, and parts of Appendix G); statements touching those regions rely on cross-references visible elsewhere in the excerpt.
- The noise-bound derivations of Sections 6.1–6.2 (Eqs. 3–4 and the ciphertext-expansion tables) were skipped by sampling; expansion assessments here use the visible restatements in Sections 6.3–6.4 and Appendix C.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.