A Privacy-Preserving Aggregation Mechanism with Multi-Key Support and Short Ciphertexts for Federated Learning

1  Introduction

Federated learning, represented by Federated Averaging (FedAvg) [1], has been extensively studied due to its straightforward framework and practical functionality. By transmitting and aggregating model parameters among different clients, this approach enables collaborative model training across multiple data owners. Although uploading only model parameters or gradients rather than the original local datasets can significantly reduce the risk of privacy leakage and communication cost during training, Subsequent studies have shown that these parameters and gradients may still expose sensitive information. Techniques such as Deep Leakage from Gradients (DLG) [2] have demonstrated that a semi-honest server or eavesdroppers from either internal or external sources can reconstruct original data from the transmitted parameters.

To better protect clients’ original data, various privacy-preserving techniques and corresponding federated learning methods have been developed. From the perspective of protection level, existing efforts can be categorized into participant anonymization [3], raw data protection [4], and protection of transmitted gradients. In terms of privacy-preserving methods, participant privacy can be safeguarded through approaches such as perturbation-based differential privacy [5], cryptography-based homomorphic encryption [6], and mask [7] based on secure multi-party computation.

In this paper, we construct a privacy-preserving aggregation scheme based on masking and homomorphic encryption. Homomorphic encryption is a special type of encryption algorithm that allows computations to be performed directly on ciphertexts without decrypting them. The result of these ciphertext operations corresponds to the result of operations on the original plaintexts. Existing homomorphic encryption schemes support operations such as addition between ciphertexts, multiplication between ciphertexts and plaintexts, and even multiplication between ciphertexts [8]. In federated learning, this property can be leveraged by encrypting raw model parameters into ciphertexts, performing aggregation in the cloud, and then decrypting the aggregated result locally. Through this process, collaborative training can be conducted without compromising privacy. Owing to the ease of deployment and strong security guarantees of this method, homomorphic encryption has become one of the key technologies for privacy preservation in federated learning [9]. In traditional homomorphic encryption schemes, the same set of public and private keys is used for all encryption and decryption operations. Under the common federated learning environment, if all parties hold the same key pair, the security of the entire system would be compromised if one client’s key is leaked. Moreover, the use of a shared key set introduces the risk that semi-honest clients could compromise each other’s data privacy. Currently, multi-key homomorphic encryption, which allows each client to use different keys for encryption and the server to use an aggregated key for decryption, is widely used in federated learning [10].

Although multi-key homomorphic encryption can alleviate the issue of key leakage inherent in conventional homomorphic encryption schemes within federated learning, its underlying encryption process and ciphertext structure remain fundamentally based on traditional designs [11]. Without targeted optimization, it still incurs high computational and communication costs. Reducing the high computational and communication costs caused by the use of homomorphic encryption in federated learning is still an urgent issue that needs to be addressed.

To reduce ciphertext size and the computational cost of encryption and decryption, this study constructs and a privacy-preserving method based on a symmetric encryption algorithm. In this work, to reduce the overall communication cost of federated learning and to prevent privacy leakage from internal participants, we propose a multi-key, short-ciphertext privacy-preserving aggregation mechanism for federated learning (MKPHE-FL). This algorithm is constructed based on a multi-party privacy-preserving mechanism, in which traditional encryption operators are extended to rings, thereby enabling homomorphism and supporting a multi-key setting. A secret sharing-based key negotiation protocol (SS-KNP) allows the aggregated key to be delivered to the server without revealing individual private keys. On this basis, a communication-efficient federated learning method is developed. The security and effectiveness of the proposed algorithm are validated through both theoretical analysis and experimental evaluation. The overall method preserves user privacy with negligible impact on the final model accuracy, while maintaining moderate computational cost and low communication overhead. The main contributions of this paper are as follows:

•   In the context of federated learning, a multi-key, short-ciphertext privacy-preserving aggregation mechanism is proposed. The short-ciphertext property stems from the use of a symmetric encryption framework, while the multi-key capability is achieved by incorporating an initialization vector mask during the encryption process. The main advantage of the mechanism lies in its ability to preserve homomorphism while maintaining a relatively short ciphertext length, all with an acceptable computational cost.

•   To aggregate the individual keys held by each client in the privacy-preserving aggregation mechanism into a unified decryption key accessible to the server, a key agreement protocol is designed based on the homomorphic properties of secret sharing. This design provides robustness against collusion, preventing any subset of clients and the server up to a certain threshold from reconstructing the private keys of others.

•   By integrating the proposed algorithm into the conventional federated learning framework, a novel method is developed that prevents collusion-based privacy leakage during both the aggregation and key agreement phases. This method is not only communication-efficient but also reduces the overall communication overhead of the system by delegating the decryption process to the server.

•   The security of the privacy-preserving aggregation mechanism is first demonstrated through linear algebraic modeling, as well as formal proofs regarding differential attacks, linear relationships, and the overall security of the mechanism. Subsequently, the overall security of the federated learning method is assessed based on the security properties of the privacy-preserving aggregation mechanism and the secret sharing scheme. Finally, experimental results further demonstrate the algorithm’s security and the communication efficiency of the proposed federated learning approach.

The rest of this paper is organized as follows: Section 2 presents recent related work on communication efficiency optimization in federated learning and the use of homomorphic encryption for privacy preservation. Section 3 introduces the proposed encryption algorithm, the key agreement protocol, and the federated learning method, and provides the analysis of the communication cost and security of the method. Section 4 provides experiments and analysis on the security of the privacy-preserving aggregation mechanism as well as the computational and communication overhead of the proposed federated learning framework. Section 5 concludes the paper.

2  Related Work

2.1 Communication Efficiency Optimization in Federated Learning

The most straightforward approach to reducing the overall communication and computational costs in federated learning is to minimize the volume of data exchanged between the server and each client. This concern has evolved into a distinct line of research within federated learning, commonly referred to as efficiency optimization. Current studies on communication efficiency primarily employ techniques such as lazy aggregation, sparsification, and quantization. Despite their differences in implementation, these methods share a common objective: to discard redundant information and transmit only the most critical data required for model updates. Sun et al. [12] proposed the LAQ algorithm, which computes the gradient update (i.e., the difference between the current gradient and the previously quantized one). If a worker’s gradient update falls below a predefined threshold, communication of that worker’s gradient is skipped. In FetchSGD introduced by Rothchild et al. [13], dimensionality reduction is first performed locally using the sketch algorithm. The resulting parameters are then transmitted to the server, where a top-k operation eliminates the least significant ones. Subsequently, the reduced global model is further compressed and sent back to the local clients. Quantization aims to reduce communication cost by converting floating-point values typically responsible for high transmission costs into lower-bit integer representations. Jhunjhunwala et al. [14] argue that applying low-precision quantization during the early and intermediate training stages does not hinder model convergence. As long as precision is gradually increased during the later stages, the final model performance remains unaffected. Based on this insight, an adaptive quantization mechanism is proposed. Hu and Li [15] analyzes the importance of individual parameters in participants’ uploaded models to inference attacks through local model gradient, and achieves effective defense against inference attacks by encrypting only a very small subset of parameters.

Singh et al. [16] proposed a relay-chain-driven architecture that integrates context-aware smart contracts with an enhanced ciphertext-policy attribute-based encryption (CP-ABE) scheme. For highly sensitive events, the model enforces robust multi-attribute access policies, whereas lightweight policies are adopted for routine data updates to reduce computational overhead. In addition, the cryptographic framework provides traceability and low-latency privilege revocation. This distributed and scalable model achieves a sound balance between real-time responsiveness and security.

In addition to directly reducing the number of parameters transmitted, a range of lightweight strategies designed for specific encryption algorithms has been employed to alleviate the communication burden in federated learning systems. Zhang et al. [17] significantly reduces the size and quantity of ciphertexts generated during encryption by optimizing the encoding scheme. Specifically, multiple quantized gradients are packed into a single long integer, allowing for one-time encryption and thus minimizing communication cost for an encryption algorithm based on long integers. Zhang et al. [18] introduce a hybrid approach that leverages both homomorphic encryption and masking techniques. In this method, local data quality is used to weight model aggregation, accelerating convergence. The quality metrics are protected using homomorphic encryption, which, although computationally intensive, is negligible compared to the complete set of model parameters. Meanwhile, the model parameters are safeguarded employing a more lightweight masking technique, thereby balancing security, convergence speed, and computational efficiency. Burlachenko et al. [19] adopt the symmetric Advanced Encryption Standard (AES) encryption algorithm to secure parameter transmission, significantly reducing both computational and communication costs. In this scheme, the server merely collects and redistributes the encrypted gradient updates. Additionally, the stateless compressed sensing algorithm is employed to prevent data leakage to the host and further mitigate communication costs. Pan et al. [20] identify an optimal parameter configuration for the Cheon–Kim–Kim–Song (CKKS) homomorphic encryption scheme based on empirical analysis within a conventional federated learning framework, thereby improving computational efficiency and reducing communication cost.

Methods for reducing communication costs can be broadly categorized into general approaches that do not account for privacy considerations and specialized techniques designed to efficiently apply specific encryption algorithms. However, there has been relatively little research focused on directly improving encryption algorithms themselves to reduce communication cost. Chait et al. [21] proposed a symmetric homomorphic encryption algorithm whose ciphertext size is comparable to that of the plaintext and whose computational complexity is O(n). Ming et al. [22] applied an efficient symmetric homomorphic encryption scheme to federated learning, achieving reduced computational and communication overhead. Hariss and Noura [23] previously proposed a lightweight encryption algorithm tailored for resource-constrained IoT devices. However, due to differences in privacy requirements and hardware environments, this scheme is not fully suitable for federated learning applications. Building upon the structure of the algorithm, this paper introduces a homomorphic encryption algorithm adapted to federated learning by improving its parameter settings, encryption mode, and key negotiation protocol.

Azzouzi et al. [24] proposed fine-grained field-programmable gate array (FPGA) architectures for the MixColumns and InvMixColumns transformations in the Advanced Encryption Standard (AES) to improve performance and optimize resource utilization. The proposed designs exhibit competitive performance compared with state-of-the-art FPGA implementation schemes in the current literature and industry.

2.2 Federated Learning Combined with Encryption

In federated learning, secret-sharing primitives are commonly employed to achieve privacy preservation or tamper-resistance. However, encryption methods relying on a single key may be vulnerable to key leakage.An intuitive approach to mitigating key leakage is to enable each client to independently encrypt data using distinct keys, a concept known as multi-key encryption. Early studies in this area primarily focused on multi-key extensions of lattice-based cryptographic algorithms. Over time, multi-key homomorphic encryption algorithms based on various cryptographic frameworks have been increasingly adopted in federated learning.

Ma et al. [10] address the risks of data leakage and collusion associated with using a shared key by introducing a multi-key homomorphic encryption approach. This method permits participants to encrypt data using individual keys and ensures that the aggregated result can only be decrypted if all participants provide their respective decryption shares. Similarly, Park and Lim [25] propose a distributed homomorphic encryption method based on secure multi-party computation to mitigate the challenges introduced by a single-key setup, such as increased key distribution cost and heightened risk of key exposure. In this work, parameter aggregation is performed collaboratively by two non-colluding servers. Jiang et al. [26] construct a multi-key homomorphic encryption system utilizing a double trapdoor function and design a federated learning method involving two non-colluding servers. The privacy of the ciphertext is further protected by incorporating ciphertext perturbation between the servers. Cai et al. [27] replace the trusted third party traditionally required in homomorphic encryption-based federated learning methods with a trusted execution environment (TEE) deployed on the server. By enhancing the existing multi-key homomorphic encryption algorithms, this method improves both efficiency and robustness against mid-training dropouts, thus achieving a fault-tolerant, privacy-preserving federated learning system. Kumbhar and Rao [4] employs the PAOA optimization algorithm to generate cryptographic keys that perform reasonably well and applies multi-key homomorphic encryption directly to the datasets of each participant. Pham et al. [28] utilize multi-key homomorphic encryption to secure each participant’s model, while additionally employing random masking with xor operations to protect local data. Li et al. [29] implement model aggregation via re-encryption, allowing participants to encrypt with distinct public keys. A federated learning method is built upon this technique using two non-colluding servers. In terms of application, Walskaar et al. [30] provide a practical implementation of Ma’s [10] scheme using numpy and the Flower framework, and demonstrate its applicability in medical data scenarios.

In addition to preventing single-point key leakage, other cryptographic tools can also be employed in encryption algorithms to meet diverse functional requirements in federated learning. Wu et al. [31] utilized blockchain and multi-authority attribute-based encryption (MA-ABE) to construct a highly secure encryption system, supporting dynamic revocation under partial policy hiding, verifiable lightweight operations, and resistance to offline dictionary attacks and multiple collusion attacks within the system. Tian et al. [32] proposed a dynamic privilege attribute-based encryption scheme based on a multi-authority architecture, enabling changes in decryption privileges and auditable records of access behaviors. Finally, after the training of federated learning is completed, homomorphic encryption can also be used to perform model inference in the ciphertext state while protecting the privacy of participants. Kong et al. [33] implemented a fully privacy-preserving machine-learning-based model predictive control method. They constructed a homomorphic encryption recurrent neural network (HE-RNN), which supports training and inference on ciphertext inputs.

In current privacy-preserving federated learning methods based on multi-key homomorphic encryption, some require multiple rounds of fixed communication, which reduces the overall robustness of the process. Others rely on third parties, such as non-colluding dual servers, to perform privacy operations, resulting in a relatively complex system. In this work, the above issue is mitigated by designing a federated learning method that includes only semi-honest, potentially colluding participants and a server with the same characteristics. Furthermore, the privacy-preserving components employed in our federated learning approach consist solely of the proposed encryption algorithm and key negotiation protocol, along with an eavesdropping-resistant secure channel for key transmission and negotiation.

The specific innovations of this study, as compared with the aforementioned studies, are presented in Table 1.

In summary, based on the work of Hariss and Noura [23], we have developed a short-ciphertext lightweight multi-key privacy-preserving aggregation mechanism suitable for federated learning. Compared with the aforementioned work, this algorithm features a lightweight ciphertext length and a moderate computational cost, and can be easily combined with other federated learning lightweight methods to further reduce communication overhead. Meanwhile, by designing a key agreement algorithm, our system avoids introducing additional trusted parties, can operate under the classic FedAvg architecture, and maintains its simplicity.

3  Proposed Method

This section first provides an overview of the proposed federated learning method. Subsequently, we introduce two modules proposed in this work that deviate from the traditional federated learning framework, including the proposed privacy-preserving aggregation mechanism and the key agreement protocol designed to integrate the encryption scheme into the federated setting. In this process, we analyze the communication cost and security of the proposed method. As a relatively large number of symbols are used in this paper, the tables listing the symbols employed in this and subsequent sections are provided in Appendix B, organized into several tables according to the respective modules to which the symbols belong.

3.1 Threat Model

During the training process of federated learning, we assume that the system operates under the Honest-but-Curious threat model, also known as the Semi-honest model, and we take potential internal collusion attacks into account. Specifically, the assumptions regarding the entities and the adversarial capabilities are defined as follows. We assume that the server is semi-honest. This means that the server will strictly follow the protocol specification and honestly execute all prescribed aggregation computations and communication procedures, and will not intentionally discard messages, tamper with computation results, or launch denial-of-service attacks. However, the server is curious in that it may attempt to infer the original private data of individual participants by exploiting all underlying data collected during the execution of the protocol, including the received ciphertext streams, public parameters, and intermediate computational views in the aggregation process. We assume that the participants in the system consist of honest, curious nodes. Curious also follows the apparent protocol flow, but they may collude with each other. Specifically, some malicious participants, the exact number of which will be discussed later in the security analysis, may secretly collude by sharing their private inputs, internal states, local masks, and key information, in an attempt to recover the private data of other honest participants through algebraic solving or statistical analysis. We assume that the number of Curious is bounded by the system security threshold. Finally, the system assumes that the underlying network connections used for transmitting highly sensitive information among all entities, such as key negotiation and initial parameter configuration during the initialization phase, are established over standard secure channels, for example, mutually authenticated links based on TLS/SSL (Transport Layer Security/Secure Sockets Layer).

3.2 Federated Learning Method with Multi-Key Encryption

This subsection presents the overall method of our proposed efficient federated learning algorithm. Our overall federated learning system and the corresponding information transmission steps are illustrated in Fig. 1. The entire training process consists of four main components: initialization, local training, key agreement, and aggregation. The arrows in the figure illustrate the communication steps involved throughout the entire process. Each component is described in detail as follows:

Figure 1: The functional modules of system components and the overall training workflow.

Initialisation: The server firstly generates the initial global model and secret key, and then distributes them to clients as indicated by line ①. Each client performs key expansion locally.

Local training: Each participant conducts a certain number of rounds of training using the local dataset. After training, the gradients are extracted, quantized, and encrypted to produce ciphertexts. These ciphertexts, along with the aggregated key shares, are then transmitted to the server, as illustrated in line ②.

Key negotiation: Each client refreshes a subset of its subkeys using a local random state and packages its subkeys into shares based on the share generation mechanism. As illustrated in line ③, the clients then exchange the corresponding shares with each other. After the exchange, the shares are aggregated accordingly.

If the number of participants in federated learning exceeds the threshold nagg, the server randomly divides the participants into multiple groups, ensuring that each group contains at least two participants. Key negotiation is then conducted independently within each group.

Aggregation: The server first reconstructs the decryption key from the aggregated key shares, aggregates the encrypted gradients, and then performs decryption. Finally, the model is updated, and the new global model is sent to the clients selected for the next round, as shown in ④.

If there are multiple groups in the current training process, decryption is first performed within each group, and the ciphertexts are then aggregated again.

Initialisation is only performed once, while the other three steps are repeated until the training is complete. Since the gradients are already encrypted, they can be transmitted directly. However, to prevent potential eavesdropping, the initial key distribution and negotiation are supposed to be conducted over secure communication channels.

The following subsections will provide a detailed description of our encryption algorithm and key negotiation protocol, along with an analysis of the method’s security and communication efficiency.

3.3 Multi-Key Privacy-Preserving Mechanism

This subsection presents the proposed MKPHE-FL algorithm. Its parameters can be tuned according to the requirements of federated learning to reduce ciphertext length. By incorporating a randomization mechanism and encryption modes into the privacy-preserving aggregation mechanism, the security of the mechanism is significantly enhanced. Moreover, the algorithm allows each client to encrypt data using a distinct initialization vector, provided that these vectors are properly aggregated during decryption.

3.3.1 Key Expansion and Refresh

This subsubsection describes how to generate the cryptographic keys required by the privacy-preserving aggregation mechanism based on the parameters and keys in federated learning.

First, define the following parameters: the number of clients in the federated learning system, n; the lower and upper bounds of the interval of integers to which the model’s floating-point parameters are mapped, [−α,α]; the bound of the injected noise, [−β,β]; the block size of the ciphertext matrix, sizeblock; and the number of encryption rounds, nr.

Set a single-group aggregation threshold ngroup for the privacy-preserving aggregation mechanism, and set a minimal ciphertext space of the privacy-preserving aggregation mechanism as Nmin=2ngroupα×2ngroupβ. To reduce computational complexity and ciphertext length, choose a prime modulus N that is marginally greater than Nmin. A key sk of at least 128 bits is generated and used as the input to a key derivation function (KDF), which produces a pseudorandom byte string of sufficient length. The required length of the byte string, denoted as lstring, is determined by the encryption parameters and is computed as shown in Eq. (1):

lstring=((3nr+1)×sizeblock2)×⌈log2⁡N⌉+lπ(1)

where the number of matrices needed is determined by the encryption round count nr, and the required key length lπ for generating the permutation matrix π depends on the specific permutation generation algorithm adopted. Specifically, for nr rounds of encryption, the scheme requires nr diffusion matrices (DM), nr permutation matrices (π), and nr+1 round key matrices (RK). Each element of RK is selected from the nonzero elements of the ring.

In this work, the KSA algorithm proposed by Noura et al. [34], an enhanced variant of RC4, is employed for generating permutation boxes. The method by Hariss and Noura [35] is employed to construct permutation matrices that can be used to perform reversible permutation operations. The bit string is divided into substrings, which are then used to generate the individual subkeys. Once the matrices are generated, their corresponding inverse keys are also derived, and all cryptographic keys are stored in their respective lists for subsequent use.

After the completion of local training in each training round, just before the encryption phase begins, each client refreshes their initial vectors. They independently generate a sufficiently long pseudorandom bit string using the key sk and a locally maintained random state, denoted as nonce. This bit string is then parsed into nr+1 matrices for IVround, one matrix for IVpcbc, and two matrices for IVcbc. These three components are respectively used for round keys, plaintext cipher block chaining (PCBC), and cipher block chaining (CBC). Collectively, these are referred to as the IVs set. The complete key generation process is illustrated in Fig. 2. It consists of two parts: a one-time key expansion (upper part) and a key refresh (lower part) that is repeated in each round.

Figure 2: The process of expanding secret keys and nonce into subkeys.

An example of the derived key and corresponding subkeys for the case where N=127 and sizeblock=4 is provided in Fig. 3. They are eventually encoded into subkey matrices. Each element of RK is multiplicatively invertible, DM is an invertible matrix over a ring, each element of π represents a non-repeating coordinate value, and each element of IVs is additively invertible.

Figure 3: A numerical example of keys, nonce, bit strings, and subkeys for a given parameter.

3.3.2 Block Encryption with Multiple Encryption Modes

This subsubsection details the encryption procedure of the proposed algorithm. The extracted gradient data are first mapped onto the integers in the interval [−α,α] to form the plaintext. In this work, the mapping is performed using the dACIQ [17] mechanism. Given a plaintext vector of length larray, it is first partitioned into lmatrix=⌈larray/sizeblock2⌉ matrices of size sizeblock×sizeblock. Any remaining entries are padded with random elements uniformly sampled from the ring ZN to complete the final matrix. After preprocessing, the input is represented as a list of lmatrix matrices: [M0,M1,…,Mlmatrix−1]. Each matrix in the list is then encrypted one by one. The preceding matrices influence the subsequent ciphertexts through the encryption modes. To enhance the randomness of the encryption process and improve resistance against linear cryptanalysis, a randomization mechanism is introduced, as shown in Eq. (2).

Cdisturb,i=Mi∗scale+Ri(2)

where each matrix Mi is masked with a randomly generated matrix Ri, scale is chosen such that the homomorphic operation does not result in overflow. This constraint is satisfied by setting scale=2nβ. In order to improve the diffusion effect of the plaintext on the ciphertext and avoid specific patterns, the PCBC (Plaintext Cipher Block Chaining) mode like the AES algorithm is employed. With the IVpcbc generated in the previous subsubsection,the plaintext Mi and ciphertext Ci from the previous phase are used to influence the ciphertext of the next phase. The concrete operator is shown in Eq. (3)

Cpcbc,i={Cdisturb,i+IVpcbc,i=0Cdisturb,i+Cdisturb,i−1+Ci−1,i>0(3)

where Cdisturb,i denotes the ciphertext corresponding to the i-th plaintext matrix Mi after applying the disturbance mechanism, while Ci−1 refers to the ciphertext of the (i−1)-th matrix Mi−1 obtained through encryption. In the encryption of the first plaintext matrix, since there is no previous ciphertext available, the previously generated subkey IVpcbc is used.

Following this, the initial round key addition As shown in Eq. (4) is performed using the round key (RK) and the initial vector (IVround) indexed by orderinit=imod(nr+1) from the key list. The formal encryption process consists of nr rounds of encryption blocks then begins. In each round, three operations are sequentially executed: P-box permutation, column diffusion, and round key addition. These operations are formally defined in Eqs. (4)–(6).

Cadd,i=Mi⊙RK+IVround(4)

Cdm,i=DM−1×Mi×DM(5)

Cpi,i=π(Mi)(6)

where Mi denotes the plaintext input to the operator, Cadd,i, Cdm,i, and Cpi,i represent the corresponding outputs of the round key addition, diffusion matrix multiplication, and permutation operations, respectively. The operator ⊙ denotes element-wise (Hadamard) multiplication between matrices, whereas × indicates standard matrix multiplication. The function π(⋅) denotes a permutation operation applied to the flattened version of Mi, where the element at position i is moved to the position specified by the permutation vector π[i]. When the number of encryption rounds reaches ⌈nr2⌉, an additional layer of protection against differential attack on ciphertexts generated from a single encryption round is introduced by incorporating a second invocation of the CBC (Cipher Block Chaining) mechanism, inspired by the PCBC structure. This mid-stage CBC operation is formalized in Eq. (7)

Ccbc,i={Ci′+IVcbc,1+IVcbc,0i=0Ci′+Ci−1′+IVcbc,1i=1Ci′+Ci−1′+Ci−2t′i>1(7)

where Ci−1′ and Ci−2′ represent the ciphertexts obtained from the immediately preceding and the second preceding encryption rounds, respectively. When the encryption process begins and no previous ciphertext is available, the previously generated key IVcbc is used.

Upon completion of the CBC mechanism, the remaining nr−⌈nr2⌉ encryption rounds are executed sequentially. At the conclusion of this process, the final ciphertext Ci corresponding to the current plaintext matrix Mi is produced. The encryption procedure then proceeds to the next plaintext matrix Mi+1. To enhance the key sensitivity of the encryption scheme—thereby obfuscating the functional roles of individual subkeys and mitigating the risk of key inference—key rotation is employed throughout the encryption process. Specifically, for each plaintext matrix Mi, the index of the round key used for additive operations is computed as ordera=(1+i+roundenc)mod(nr+1), where rounde=0,1,…,nr−1 denotes the current encryption round. Similarly, the index of the key used for permutation and diffusion is given by orderdm=orderπ=(i+roundenc)modnr. This dynamic indexing strategy ensures that key reuse follows a non-trivial pattern, contributing to the cryptographic robustness of the algorithm. The complete encryption procedure is detailed in Algorithm 1.

The decryption process strictly follows the inverse procedure of encryption. Upon receiving the ciphertext bitstream, the decrypting party first decodes the bitstream into vectors according to the encryption parameters determined during key initialization, and subsequently reconstructs it into a list of ciphertext matrices. The ciphertext list is then traversed in the same order as the encryption phase for decryption. During the decryption of each ciphertext block, multiple rounds of inverse operations are performed sequentially, including round key addition, substitution, and permutation. When the process reaches the ⌊nr2⌋ round, the inverse CBC operation is executed, after which decryption continues with the same inverse sequence of round key addition, substitution, and permutation. Upon completing all rounds, a final round key addition is performed, followed by inverse PCBC and scaling operations to eliminate random perturbations, thereby recovering the original plaintext.

3.3.3 Correctness and Homomorphic Properties of the Proposed Algorithm

This subsubsection introduces the source of correctness and homomorphism in the proposed encryption algorithm.

In Section 3.3.1, we choose the modulus N of the ciphertext domain to be a prime number slightly greater than 2nα×2nβ, which means that the entire ciphertext space is a finite field Fp. This space supports addition, subtraction, multiplication, and division of its elements. All elements in this space possess additive inverses (the additive inverse of an element a is −amodN); therefore, the addition of IV, the applied random mask, and the CBC and PCBC mechanisms can all be reversed by adding the corresponding additive inverse. Each nonzero element in this space also has a multiplicative inverse, which means that the elements of RK all possess multiplicative inverses, and thus the adopted round-key addition operator is reversible. By employing the algorithm of Hariss and Noura [35], the invertibility of the matrix multiplication of the confusion matrix DM is also guaranteed. The invertibility of the permutation operation is not affected by the algebraic space and always holds. In addition, by properly configuring the parameters of random obfuscation, the impact of random bit overflow on ciphertext bits during decryption or intermediate computation can be effectively avoided. Ultimately, the correctness of the overall encryption and decryption process of the algorithm is guaranteed. Specifically, the invertibility of each encryption operator and the corresponding decryption methods are shown in Eqs. (8)–(12). Among them, Eq. (10) is performed over the real field, while the remaining operations are performed over the modular ring.

Mi≡(Mi⊙RK+IVround−IVround)⊙RKinvmodN(8)

Mi≡DM×DM−1×Mi×DM×DM−1modN(9)

Mi≡⌊(Mi∗scale+Ri)/scale⌋(10)

Cdisturb,i={(Cdisturb,i+IVpcbc)−IVpcbcmodN,i=0(Cdisturb,i+Cdisturb,i−1+Ci−1)−Cdisturb,i−1−Ci−1modN,i>0(11)

Ci′={(Ci′+IVcbc,1+IVcbc,0)−IVcbc,1−IVcbc,0modN,i=0(Ci′+Ci−1′+IVcbc,1)−Ci−1′+IVcbc,1modN,i=1(Ci′+Ci−1′+Ci−2′)−Ci−1′+Ci−2′modN,i>1(12)

Leveraging the associativity of addition over a ring and the distributive properties of both scalar and matrix multiplication, the round key addition and column mixing steps in the encryption process inherently preserve additive homomorphism. Moreover, the permutation operation, being a position-based transformation that does not alter the actual values of ciphertext elements, also maintains homomorphic properties, provided that an identical subkey is used across ciphertexts. Consequently, it becomes feasible to perform plaintext addition within the encrypted domain simply by executing additive operations on the corresponding ciphertexts. Following encryption, as long as the sum of the original plaintexts remains within the bounds of the minimal plaintext space 2nα, the decryption procedure can accurately recover the plaintext sum. During homomorphic addition, the round key (RK) and diffusion matrix (DM) components naturally combine without additional processing. In contrast, the subkey IVs does not directly merge; rather, it accumulates incrementally across successive homomorphic additions, as illustrated in Eqs. (13)–(15).

∑Ci=∑Mi⊙RK+∑IVi(13)

∑Cpcbc,i={∑Cdisturb,i+∑IVpcbc,i=0∑(Cdisturb,i+Cdisturb,i−1+Ci−1),i>0(14)

∑Ccbc,i={∑Ci′+∑IVcbc,0+∑IVcbc,1,i=0∑Ci′+∑IVcbc,1+∑Ci−1′,i=1∑(Ci′+Ci−1′+Ci−2′),i>1(15)

where the symbols is consistent with their previous definitions.

For the entire encryption algorithm, its homomorphic property can be referred to in the equation in the Appendix A.1.2. For multiple participants using the same public key, the subkeys derived from the public key are identical, and the generated AiM and AiR are also the same. Therefore, the overall homomorphic addition of the ciphertext can be transformed into the following form.

∑C→i=AiM[∑M→scale,i∑M→scale,i−1∑M→scale,i−2]+AiR[∑(R→i+R→i−1)∑(R→i−1+R→i−2)∑(R→i−2+R→i−3)]+AiIV[∑IV→i,0∑IV→i−1,0∑IV→i−2,0](16)

Therefore, a key negotiation step is required following homomorphic operations to ensure the correct decryption of the aggregated result. On the other hand, this characteristic also enables each client to utilize a distinct subkey IVs for encryption. As long as the server ultimately receives the correctly aggregated version of the subkeys, it can successfully decrypt the final ciphertext.

3.4 Key Negotiation of Initialization Vectors

The previous subsection introduced the improved encryption algorithm proposed in this paper. However, as observed in the decryption phase, it is necessary to aggregate the different IVs values after homomorphic encryption in order to correctly decrypt the ciphertext. Given the presence of curious servers and potential external eavesdroppers, directly transmitting each participant’s initialization vector for aggregation is not viable within the federated learning method. In this subsection, a key negotiation protocol based on secret sharing (SS-KNP) is constructed to address this issue.

Secret sharing allows a secret to be divided into n parts and distributed to n different entities. The original secret can only be reconstructed when at least t of these parts are combined. This implies that an adversary must collude with more than t clients in the federated learning system to successfully recover another client’s secret.

The security of Shamir’s secret sharing scheme relies on the uniqueness of the solution to a system of linear equations or equivalently, the uniqueness of the coefficients in polynomial interpolation. In this scheme, the secret S is embedded as a coefficient in a randomly generated polynomial f(x) of degree t−1. The values of this polynomial at distinct points X={x1,x2,…,xn} are computed and distributed as secret shares to individual entities. The secret can later be reconstructed by solving for the coefficients using Lagrange interpolation.

When applying secret sharing for key agreement, the entire protocol consists of three phases: share generation, aggregation, and reconstruction of the secret.

Generation the Sharing of Subkeys: For the aforementioned privacy-preserving aggregation mechanism, the secret that needs to be shared and aggregated is the initial vector IVs in the subkeys. Flatten and concatenate the IVs to form a vector S=[s0,s1,…,sls] containing lsecret=(nr+4)×sizeblock2 secret values. During each sharing, t coefficients can be packed into a single polynomial value as the coefficients of a t−1 degree polynomial, e.g., f(x,s)=s0+s1x+s2x2+...+st−1xt−1. When the polynomial degree is high, there is a considerable risk that the secret generation and reconstruction operations will overflow, so all operations are performed in the ring ZN.

Key Aggregation: Once all clients have shared their secrets, the j-th client’s corresponding share sharesj=f(xj,s) is sent to the corresponding client. Finally, each client uses the received polynomial value to complete the aggregation. The theoretical basis for this operation is the homomorphism property of Shamir secret sharing, i.e., when different clients use the same set of random number coordinates X={x1,x2,…,xn}. For client i, all the polynomials received by it follow Eq. (17)

∑j=0n−1f(xi,sj)=∑j=0n−1∑k=0t−1sj,kxik=∑k=0t−1(∑j=0n−1sj,k)xik=f(xi,∑j=0n−1sj)(17)

where i and j represent the designated recipient and sender of the share, respectively. Therefore, for multiple clients using the same set of X, each client i can add up all the shared values it receives to get the aggregated shared value through sharesagged,i=∑j=0n−1sharej,i.

Reconstruction of the Aggregated Key: After the sharing and aggregation are complete, the aggregated and sufficient sharing values are sent to the required entity (server) for secret reconstruction. This process is typically performed using the Lagrange interpolation polynomial. By collecting at least t share values, constructing the Lagrange interpolation polynomial with them, and combining the coefficients of terms of the same degree, the coefficients can be extracted to reconstruct the aggregated IVs. Since the threshold t can be smaller than the total number of shares n, our method is theoretically capable of flexibly adjusting the threshold according to practical scenarios, such as handling potential participant dropouts. For example, by discarding offline participants and retaining only those with stable communication to allow the negotiation to proceed normally, rather than aborting the entire training round due to a few participants dropping out. However, this is not the main focus of this work and is therefore not explicitly reflected in the training process. This step is performed after each client sends the aggregated shares to the server, which then executes the reconstruction operation to complete the process.

3.5 Security Analysis

In this subsection, the security of the proposed method based on the security properties of the privacy-preserving aggregation mechanism and the secret sharing protocol is analysed. By examining the information generated and exchanged by each participant throughout the federated learning process, it has been demonstrated that the proposed method effectively preserves the privacy of individual clients.

Lemma 1: For the proposed privacy-preserving aggregation mechanism, even if an entity has access to a set of plaintext-ciphertext pairs, as well as knowledge of the key sk and its derived keys RK, DM, and π, it remains computationally infeasible to infer the initial vectors IVs used by other participants or to recover any unknown plaintexts.

Proof: See Appendix A.3. ◻

Lemma 2: For any subset of fewer than t participants in a Shamir secret sharing scheme, the shares they obtain provide no statistical advantage in inferring the secret.

Proof: This property has been formally proven in Shamir’s original work [36]. ◻

First, we present the views observable to the server and the colluding participants: Let Π denote the aggregation protocol proposed by us. During the execution of Π, all the information observable to the privacy-stealing party constitutes its “view.” Below, by analyzing the execution process of the framework, we present the views of the server and the colluding participants.

Initialization: During the initialization phase, the server generates a system-wide shared key sk and securely distributes it to each client. The global model θ0 is generated and distributed to each client. Since both the public key and the global model are randomly generated, no private information is leaked.

Local training: In the local training phase, no information is transmitted, so naturally, no information leakage occurs. During the encryption and uploading process, each client’s local random state and the generated initial vector are both randomly instantiated. According to Lin et al. [37], the gradients generated during deep learning training tend to be sparse and contain a large number of zero entries. This sparsity may leak additional information to an adversary within the system regarding the plaintext corresponding to a given ciphertext, which could potentially be exploited to construct a known-plaintext attack.

Key negotiation: In this phase, each client packages its own IVs (initial vector) information as a secret and generates shares to be sent to other clients. Without collusion, each client holds its own shares and the secret share values received from other participants corresponding to is identity.

Aggregation: The server can acquire the local encrypted weighted gradients [[wigi]] from each participant, their sum [[∑i=1nselectwigi]], and the final decrypted gradient. As demonstrated in the multi-key encrypted federated learning framework proposed by Ma et al. [10], the server’s acquisition of aggregated parameters does not result in the privacy leakage of participants. Since the privacy-preserving aggregation mechanism itself is key-sensitive, the server cannot obtain gradient information through incorrect decryption without knowledge of the IVs.

In summary, we can characterize the views (leakage assumptions) of an honest-but-curious server and a subset of participants who are also honest-but-curious but may engage in collusion among themselves, when the number of participants has not yet reached the level required for group aggregation. The server 𝒮 strictly follows the execution of protocol Π, but attempts to infer the unknown true gradients from all the data it collects. The view of the server, View𝒮Π(g→), is defined as the complete set of its “internal state” and “observed information” during the execution of the protocol:

View𝒮Π(g→)=(ℛ𝒮,Paramspub,ℳ𝒮recv,𝒮comp)(18)

where each component is specified as follows:

ℛ𝒮: the internal randomness generated by the server during the execution of the protocol. Paramspub: the aforementioned globally public training context and key information. ℳ𝒮recv: the set of messages received by the server from all clients i∈{1,2,…,n}, including the uploaded encrypted gradients and aggregated key shares:

ℳ𝒮recv={([[wigi]],sharesagg,i)}i=1n(19)

𝒮comp: the intermediate states produced by the server during the aggregation computation phase and the final decryption results:

𝒮comp=(∑i=1n[[wigi]],∑i=1nIVi,∑i=1ngi)(20)

Let Gcoll⊂{1,2,…,n} denote the set of Curious that collude among the participants (with |Gcoll|<t, that is, the number of colluding participants does not reach the reconstruction threshold of secret sharing). The situation is different when the number of participants exceeds nagg and grouping is required; this case will be discussed separately in the proof. It is assumed that this set does not collude with the server. Moreover, the protocol stipulates that all clients will receive the globally decrypted gradient ∑i=1ngi after aggregation is completed. The overall view of the colluding set ViewGcollΠ(g→) is defined as the union of the individual views of all colluding members:

ViewGcollΠ(g→)=⋃k∈GcollViewkΠ(g→)=(ℛcoll,Paramspub,𝒟collself,ℳcollrecv,Outagg)(21)

where each component is specifically expanded as follows:

ℛcoll: the set of internal randomness of all colluding participants, ⋃k∈Gcollℛk. Paramspub: the globally public parameters. 𝒟collself: all private data generated by the colluding subset itself and shared internally:

𝒟collself={gk,[[wkgk]],IVs,k,sharek,i|k∈Gcoll,i∈{1,2,…,n}}.(22)

Here, IVs,k and sharek,i are the keys and shares generated by the colluding participants themselves.

ℳcollrecv: all key share fragments received by the colluding parties during the key negotiation and sharing phase:

ℳcollrecv={sharei,j∣i∈{1,…,n},j∈Gcoll}.(23)

Outagg: the global plaintext aggregation result received by the colluding parties from the server in the final stage of the protocol, namely ∑i=1ngi.

Definition 1 (Privacy against Honest-but-Curious Server): Let Π be the aggregation protocol proposed in this paper, n be the total number of participants, and g→=(g1,g2,…,gn) be the true local gradients of all participants. We say that the protocol Π is computationally secure against an honest-but-curious server 𝒮 if there exists a probabilistic polynomial-time (PPT) simulator 𝒮ℐℳ𝒮 such that, given the globally public parameters Paramspub and the final legitimate output (i.e., the aggregated gradient ∑i=1ngi), the simulated view generated by 𝒮ℐℳ𝒮 is computationally indistinguishable from the server’s view in the real execution of the protocol, denoted by View𝒮Π(g→). That is, for any security parameter λ, it holds that

𝒮ℐℳ𝒮(1λ,Paramspub,∑i=1ngi)≈sView𝒮Π(g→).(24)

Definition 2 (Privacy against <t Colluding Participants): Let Gcoll⊂{1,2,…,n} be the set of colluding participants, satisfying |Gcoll|<t. Assume that this set does not collude with the server, and that all participants receive the final aggregation result. We say that the protocol Π can securely resist internal collusion attacks by fewer than t participants if there exists a probabilistic polynomial-time (PPT) simulator 𝒮ℐℳcoll such that, given only the globally public parameters Paramspub, the set of true private data of the colluding parties 𝒟collself, and the final legitimate aggregation result ∑i=1ngi, the simulated view generated by 𝒮ℐℳcoll is computationally indistinguishable from the view of the colluding set in the real world, denoted by ViewGcollΠ(g→). That is, for any security parameter λ, it holds that

𝒮ℐℳcoll(1λ,Paramspub,𝒟collself,∑i=1ngi)≈cViewGcollΠ(g→).(25)

Theorem 1: Under the assumption that the proposed privacy-preserving aggregation mechanism satisfies IND-CPA security, the protocol Π is computationally secure against the honest-but-curious server 𝒮.

Proof: To prove Definition 1, we construct a probabilistic polynomial-time (PPT) simulator 𝒮ℐℳ𝒮. This simulator takes only the public parameters Paramspub and the final aggregation result Gsum=∑i=1ngi as input, and forges a simulated server view View𝒮sim as follows.

Construction of the forged view by 𝒮ℐℳ𝒮.

Internal state and public parameters: 𝒮ℐℳ𝒮 generates completely uniform random coins as the forged ℛ𝒮′, and directly copies Paramspub.

Forgery of the received messages (ℳ𝒮recv) and the computation state (𝒮comp):

Forged aggregated key shares: 𝒮ℐℳ𝒮 randomly generates a sum of IVs′ for the constant term satisfying the threshold requirement, and based on this, uses the corresponding polynomial to generate n random aggregated key shares sharesagg,i′.

Forged initialization vectors: According to the generated sharesagg,i′, it computes the corresponding forged sum of initialization vectors ∑IVi′.

Forged encrypted gradients: This is the key step. 𝒮ℐℳ𝒮 cannot know the true gi. Therefore, over the modulus-N ring FN, it independently and randomly generates the first n−1 participants’ ciphertexts C1′,C2′,…,Cn−1′ using a uniform random number generator.

To ensure consistency of the final decryption result, 𝒮ℐℳ𝒮 uses the known final result Gsum and the forged mask (determined by ∑IVi′), and then forcibly computes the last ciphertext by reverse algebraic computation:

Cn′=∑Ci−∑i=1n−1Ci′.(26)

The ciphertexts Ci′ are then used as the forged [[wigi]]′, and are assembled into ℳ𝒮recv and 𝒮comp.

Security analysis.

In the real execution, according to the security of the privacy-preserving aggregation mechanism proved in Appendix A.3, each true ciphertext uploaded by a participant, [[wigi]], is computationally indistinguishable from a random value over FN. In the simulated execution, 𝒮ℐℳ𝒮 also generates Ci′ by random sampling from the uniform distribution. Since the sum of N uniformly distributed variables under a fixed-sum constraint still has a uniform marginal distribution, the statistical distance (SD) between the forged ciphertext set and the real ciphertext set is at most a negligible function ε.

Meanwhile, the forged key shares satisfy the same algebraic structure as in the real world. Since IV itself is sampled from a uniform random distribution, it is indistinguishable from the randomly generated IV′. Therefore, the simulated view output by 𝒮ℐℳ𝒮 is statistically indistinguishable from the real view View𝒮Π(g→), that is,

View𝒮sim≈View𝒮Π(g→).(27)

Thus, Theorem 1 is proved. ◻

Theorem 2: Under the assumption that the underlying secret sharing scheme (e.g., Shamir Secret Sharing) satisfies threshold security and the proposed privacy-preserving aggregation mechanism satisfies IND-CPA security, the protocol Π can still securely resist any internal collusion attack among participants with ∣Gcoll∣<t, even when the final aggregated model is broadcast to all clients.

Proof: Analogously to the above, we construct a probabilistic polynomial-time (PPT) simulator 𝒮ℐℳcoll. In the ideal world, this simulator acts as a “forger” and takes only the public parameters Paramspub, the colluders’ private data 𝒟collself, and the final correct output obtained from the ideal functionality, namely Gsum=∑i=1ngi, as input. 𝒮ℐℳcoll then forges the colluding parties’ view ViewGcollsim step by step as follows.

Construction of the forged view by 𝒮ℐℳcoll.

Internal state and preservation of local data: 𝒮ℐℳcoll honestly generates the colluders’ internal randomness ℛcoll′, the global parameters Paramspub, and their own true private data 𝒟collself.

Embedding the final output (Outagg): 𝒮ℐℳcoll directly uses the final aggregation result Gsum returned by the ideal functionality as the forged Outagg′ in the simulated view, namely

Outagg′=∑i=1ngi.(28)

Forging the received key shares (ℳcollrecv):

In the real protocol, the colluding parties receive key shares sharei,j(j∈Gcoll) sent by the honest participants i∉Gcoll. Since 𝒮ℐℳcoll does not know the honest participants’ true keys or local blinding factors, it cannot generate these shares according to the real algorithm. Therefore, 𝒮ℐℳcoll directly performs uniform random sampling over the corresponding finite field Fq, generates purely random values ri,j←U(Fq), and inserts them into ℳcollrecv′ as forged key shares sharei,j′ (For the shares exchanged internally among the colluding parties, 𝒮ℐℳcoll computes them honestly according to the protocol using the known 𝒟collself and ℛcoll′).

Security analysis:

In the real execution of the protocol, each honest participant i∉Gcoll constructs a polynomial fi(x) using a Shamir secret sharing scheme with reconstruction threshold t. According to the perfect information-theoretic secrecy of this scheme, for any polynomial of degree t−1, when the number of given evaluation points is strictly less than t (i.e., ∣Gcoll∣<t), the resulting sequence of fewer than t function values is completely equivalent to a mutually independent uniformly random vector over the field Fq. In scenarios with a large number of participants that require grouping, as long as the threshold is set consistently with the upper bound on the number of members in a single group, colluding participants cannot reconstruct the key from the secret sharing scheme. The key can only be reconstructed if the entire group consists of colluding participants, in which case such reconstruction is meaningless.

This implies that:

The real ℳcollrecv in the view is perfectly uniformly distributed over the finite field, and the forged ℳcollrecv′ in the simulated view is also generated by uniform sampling. Hence, the two are not only computationally indistinguishable, but in fact identically distributed. Moreover, Outagg in the real view and in the simulated view are exactly the same final aggregation result Gsum. The real key shares (which determine the blinding masks) are algebraically independent of the final plaintext output Gsum, since the blinding masks are canceled out during aggregation through summation. Therefore, even if Gsum is included in the view, the independent randomness of the key shares is not affected.

Finally, even if the colluding participants eavesdrop on the ciphertexts uploaded by other participants, the security in this case can still be established through a simulation argument similar to that for the server, due to the computational indistinguishability of the privacy-preserving aggregation mechanism.

In summary, the joint distribution generated by the simulator,

𝒮ℐℳcoll(ℛcoll′,Paramspub,𝒟collself,ℳcollrecv′,Outagg′),(29)

is perfectly indistinguishable from the colluding set’s view ViewGcollΠ(g→) in the real world. This proves that when ∣Gcoll∣<t, or when participants perform group aggregation with and t=nagg even if the colluding parties obtain the final model update (i.e., the aggregated gradient) as well as partial key fragments from honest nodes, they still cannot reconstruct any additional information about the gradient of any individual honest participant gi(i∉Gcoll). Thus, Theorem 2 is proved. ◻

Theorem 3: Assume that the underlying encryption algorithm satisfies IND-CPA computational indistinguishability, and that the secret sharing scheme (e.g., Shamir Secret Sharing) achieves perfect secrecy with fewer than t shares. Then, under the honest-but-curious model, the protocol Π not only guarantees the privacy of each individual gradient gi against the centralized server, but also resists any internal collusion attack by participants satisfying ∣Gcoll∣<t or participants performing group aggregation with and t=nagg. That is, no unauthorized entity can extract any useful information about the local gradient gi of any honest node i∉Gcoll from its view with non-negligible probability.

Proof: The conclusion of Theorem 3 follows directly from Theorems 1 and 2.

Specifically, Theorem 1 shows that, under the assumption that the underlying encryption algorithm satisfies IND-CPA security, the view of the honest-but-curious server 𝒮 can be simulated from the public parameters and the final aggregation result alone, and is therefore statistically indistinguishable from the real view. Hence, the server cannot obtain any additional information about any individual participant’s local gradient gi beyond the legitimate output.

Meanwhile, Theorem 2 shows that, under the threshold security of the underlying secret sharing scheme, for any colluding set satisfying ∣Gcoll∣<t, or in the case where the number of participants exceeds nagg and t=nagg, the joint view of the colluding participants can also be perfectly simulated given only the public parameters, the colluders’ own private data, and the final aggregation result. Therefore, such colluding participants cannot recover any additional information about the local gradient gi of any honest participant i∉Gcoll.

Combining the above two results, it follows that, under the honest-but-curious model, the protocol Π simultaneously guarantees privacy against the centralized server and security against internal collusion by fewer than t participants. Therefore, no unauthorized entity can extract any useful information about the local gradient of any honest participant from its view with non-negligible probability. Thus, Theorem 3 is proved. ◻

In the above proof, we presented the security analysis of the federated learning method against an honest-but-curious server and colluding participants, based on the security of the privacy-preserving aggregation mechanism and the security of secret sharing. When the number of participants is large, the proposed federated learning method groups the participants. After grouping, the view observed by the server remains essentially unchanged; therefore, the above conclusion still holds. For colluding participants, since each group conducts key negotiation and aggregation independently, colluding participants from different groups cannot form effective cooperation. Within a single group, as long as the secret-sharing threshold t is set to the number of participants in the group/the maximum number of participants in the group, it can be guaranteed that the key cannot be stolen unless all participants in that group are colluding participants (if all participants in a group are colluding participants, stealing the key is meaningless anyway). Since the colluding participants do not collude with the server, they can only receive the decrypted aggregated gradients. In this case, the tolerance upper bound of the entire system to the number of colluding participants can reach n−2.

Since the participants’ original gradients are not leaked, the framework can effectively prevent attacks that aim to steal participants’ privacy, such as gradient inversion attacks. However, since no screening mechanism is incorporated into the framework, it may be unable to defend against attacks intended to disrupt training.

3.6 Communication Efficiency Analysis

This subsection analyzes the overall communication cost after applying the proposed algorithm within the federated learning method. The communication efficiency of the proposed algorithm is influenced primarily by the quantisation precision bitquant (corresponding to α), the noise scale β, as well as the configured maximum number of participants per group. Under symmetric quantisation, model parameters are mapped to the integer range [1−2bitquant−1,2bitquant−1−1]([−α,α]). Here, the quantization precision bitquant refers to the number of bits used to store and transmit the mapped integer parameters in the computer and 2bitquant−1−1 refers to α mentioned earlier. Accordingly, the theoretical minimum ciphertext length required to encrypt a single quantised parameter is given by Eq. (30).

bitcipher=log2⁡(N)=log2⁡(2ngroup×(2bitquant−1−1)×2ngroupβ)=2+2log2⁡(nagg)+log2⁡(2bitquant−1−1)+log2⁡(β)(30)

where bitcipher represents the minimum ciphertext length required to encrypt a single parameter.

During the key negotiation process, within each group, the total number of times shares are sent is ngroup2, and the total number of keys that need to be packed is nr+4, namely (nr+4)×sizeblock2 elements over the ring ZN. After being packed into sharing polynomials, the total number of generated shares is ⌈(nr+4)×sizeblock2t⌉. Since the ciphertext domain used in secret sharing is the same as that used in the privacy-preserving aggregation mechanism, the communication cost generated by a single share is commshare=⌈(nr+4)×sizeblock2t⌉×bitcipher, which is a constant when the encryption parameters are fixed. For different numbers of participants, the total number of communications among participants, denoted as numneg, is shown in Eq. (31):

numneg={n2 if n≤ngroup⌊nngroup⌋×ngroup2+(nmodnagg)2 if n>ngroup(31)

The total communication cost during the negotiation process is: commneg=(numneg+n)×commshare. Therefore, when the number of participants satisfies n≤ngroup, the time complexity of the key negotiation part is O(n2); when the number of participants satisfies n≥ngroup, the communication cost generated by key negotiation is approximately O(n).

For the federated learning process, assuming that the number of parameters in the global model is numpara and the training process involves a total of roundfed communication rounds, the communication cost associated with transmitting the model throughout the training process is: commmodel=(bitfloat+bitcipher)×numpara×roundfed×nselect.

Therefore, the total communication cost in federated learning is commmodel+commneg. Here, nselect denotes the number of clients actually selected in each round of the federated learning process, which is a variable parameter that accounts for a proportion of n. bitfloat denotes the default number of bits for floating-point numbers in deep learning frameworks, which is typically 32.

Since, compared with the number of parameters in commonly used deep learning models, the number of parameters occupied by IVs accounts for only a very small proportion. When the model architecture and communication protocol are fixed, the communication cost incurred by ciphertext transmission scales linearly with the quantisation precision and exhibits an O(n) dependence on the number of clients n.

4  Experiment

In this section, we evaluate the performance of the federated learning framework in terms of accuracy, computational cost (time), and communication cost. The performance of the privacy-preserving aggregation mechanism is evaluated using metrics such as entropy and NPCR (Number of Pixels Change Rate). Specifically, we conduct horizontal performance comparisons and parameter sensitivity analyses for both the federated learning framework and the privacy-preserving aggregation mechanism, and further perform ablation experiments on the privacy-preserving aggregation mechanism. The code related to the experiment can be found at https://github.com/ignorance163/LHEFL_algorithm.

4.1 Baselines

In the first part, to illustrate the communication cost of the federated learning method and the computational cost of the privacy-preserving aggregation mechanism, we compare our approach (Our Work) with several baselines: FedAvg with direct plaintext transmission (Plaintext), FedAvg with quantized plaintext transmission (QuantPlaintext), variants of our method that use other homomorphic encryption schemes (BFV and CKKS), and MaskCrypt [15], a privacy-preserving federated learning framework based on homomorphic encryption with optimized communication efficiency. The comparison is conducted in terms of both transmitted data volume and execution time.

In the second part, to provide an intuitive comparison of the computational cost and ciphertext size of the proposed encryption algorithm, we evaluate it outside the federated learning framework against traditional homomorphic encryption schemes (Paillier and Elliptic Curve ElGamal) as well as lattice-based cryptosystems (BFV and CKKS). Under the same security level, we compare their performance in terms of encryption/decryption, homomorphic addition, and ciphertext length.

4.2 Settings

This subsection presents the devices and parameters used in our experiments. The proposed federated learning method is simulated on a host equipped with an Intel Core i7-14700KF 20-core processor, 32 GB of RAM, and an NVIDIA 4070Ti GPU with 16 GB of graphics memory, running the Windows operating system. The model was implemented using PyTorch.

General parameters of the federated learning framework were configured as, and n=10, the global training is conducted for 100 rounds, All remaining parameters followed the default configuration in PFLlib [38], whose key settings include a batch size of 10, a local learning rate of 0.05, and 3 local training epochs.

In the second part, in addition to empirically analyzing the security of the algorithm, we also compare its efficiency and ciphertext length with those of existing classical homomorphic encryption algorithms. The specific algorithms and parameter settings used for comparison are as follows: For proposed algorithm, encryption parameters were bitquant=5, sizeblock=16,nr=2 and β=4; The CKKS and BFV encryption algorithms were evaluated using their respective implementations from TenSEAL [39], and the encryption parameters were set according to the default configurations recommended on TenSEAL’s official documentation and tutorial pages. For the CKKS scheme, the polynomial modulus degree is set to 8192, the coefficient modulus bit sizes are [60,40,40,60], the global scale is 240. For the BFV scheme, the polynomial modulus degree is 4096, and the plaintext modulus is 1,032,193. The Paillier and Elliptic Curve ElGamal Cryptosystem (EC ElGamal) algorithms are implemented using LightPHE [40]. To maintain the same 128-bit security level as in the preceding algorithms, the key sizes are set to 3072 bits and 256 bits, respectively. In the third part, we conducted a comparative analysis of the framework’s performance under varying numbers of participating clients.

4.3 Neural Network Models and Datasets

The models and datasets tested in this paper are shown below.

•   Image Classification: ResNet18 on Cifar-10 [41]. CIFAR-10 is a standard benchmark dataset for image classification, consisting of 60,000 32×32 images across 10 distinct object categories. The dataset was evenly partitioned into ten subsets and distributed among different participants.

•   Text Classification: Transformer on AGNews [42]. The AGNews dataset contains 31,900 news samples, including headlines and content from four distinct topical categories. The dataset was partitioned into ten equally sized subsets with identical label distributions, following the same approach as in the Cifar-10 setting.

•   Pose Recognition: HARCNN on PAMAP2 [43]. PAMAP2 provides motion data from nine participants performing 18 different physical activities, which are categorized into 12 fundamental actions such as standing and lying down. As the data originates from nine individual participants, the dataset is naturally divided into nine subsets and allocated to nine clients, differing from the partitioning strategies used for the other datasets.

4.4 Performance Evaluation of the Method

This subsection evaluates the method in terms of accuracy, computational cost, and communication cost during training. The computational cost is assessed by the time consumed in each phase of the method. To evaluate communication cost, the data exchanged in a single round of federated learning is converted into byte streams using the serialization functions provided by NumPy and TenSEAL [39]. The communication cost is then represented as the total volume of data transmitted.

Fig. 4 and Table 2 illustrate the trends in accuracy variation and the final achieved accuracy of the global model under different encryption schemes. It can be observed that, even with the application of quantization, the accuracy and convergence curves of the proposed method remain largely consistent with those obtained from plaintext training and partial encryption, which indicates that the proposed approach does not introduce any adverse impact on model performance in terms of accuracy.

Figure 4: Average accuracy of the global model on each local dataset across different tasks.

Table 3 summarizes the computational and communication costs of the proposed method by reporting the time consumed at each step as well as the total time per iteration. When he proposed privacy-preserving aggregation mechanism is employed within the proposed framework, both the encryption and aggregation times are significantly reduced compared with those of the CKKS scheme. Although the encryption and decryption times of our algorithm are slightly higher than those of BFV, they remain within an acceptable range. Moreover, our method achieves a shorter aggregation time for homomorphic addition. In addition, unlike conventional encryption schemes that distribute only a single public-private key pair, the multi-key property of our approach allows decryption to be performed solely on the server side, without requiring each client to decrypt locally. This design further reduces the overall computational burden of the system in practical deployments. Although MaskCrypt exhibits the shortest encryption and decryption times among the homomorphic-encryption-based approaches, it requires additional training during the negotiation phase to estimate the gradient sensitivity of the updated model, which results in a longer overall training time per round. Finally, under a network bandwidth setting of 5 Mb/s, we evaluate the total communication time required for each participant to upload and download data to and from the server and other participants.

The experimental results show that, in a serial simulation environment, our method achieves the shortest per-round execution time among all privacy-preserving federated learning frameworks, thereby realizing a balanced optimization of computational and communication costs.

Under the parameter settings adopted in this subsection, the average communication cost of our encryption algorithm is reduced by 25% compared with plaintext communication, is 50% higher than that of quantized plaintext communication, and is reduced by 93%,77%, and 81% compared with the CKKS and BFV variants, and MaskCrypt, respectively.

Overall, our method achieves a substantial reduction in communication cost while maintaining the same model accuracy as plaintext training, at the expense of an acceptable computational overhead.

4.5 Security and Performance Evaluation of the Proposed Privacy-Preserving Aggregation Mechanism

This subsection quantitatively evaluates the security of the proposed algorithm based on a set of well-defined metrics. Given that the encryption of parameter tensors functions more similarly to image encryption algorithms than to bit-level or stream encryption schemes, the evaluation methodology proposed by Radwan et al. [44] is referenced in our work. Specifically, the Pixel Change Rate (NPCR) and Unified Average Changing Intensity (UACI) metrics are employed to quantify the differences between plaintext and ciphertext, as well as between different ciphertexts. On the other hand, entropy is used to assess the randomness of the ciphertext. Subsequently, we conducted ablation experiments on each module in the privacy-preserving aggregation mechanism.

Additionally, we conduct a separate comparison, outside the federated learning framework, of the computational time and ciphertext length of the proposed algorithm with several classical homomorphic encryption schemes.

The metrics used in this subsection are described as follows.

•   Entropy: Entropy measures the randomness of elements within the encrypted ciphertext. A value closer to the ideal entropy indicates higher unpredictability of the ciphertext. The theoretical maximum entropy is given by log2⁡(catesample), which corresponds to the base-2 logarithm of the total number of possible states in the system.

Entropy=−∑i=1catesampleP(samplei)log2⁡P(samplei)(32)

where samplei denotes the event that a ciphertext takes a specific value i in the ring, catesample denotes the modulus N of the ring.

•   UACI (Unified Average Changing Intensity): This metric quantifies the average intensity of differences between two sets of data. The ideal UACI value is approximately UACI=33.4635%.

UACI=1lvec∑i=1lvec|v1,i−v2,i|N×100%(33)

where v1,i,v2,idenotes the i-th element of the vector, and lvec represents the length of the vector.

•   NPCR (Number of Pixels Change Rate): This metric represents the proportion of differing elements between two datasets relative to the total number of elements. Values approaching 1 indicate greater variability between vectors.

NPCR=1lvec∑i=1lvecI(v1,i≠v2,i)×100%(34)

where I denotes the indicator function.

4.5.1 Performance Evaluation of the Proposed Privacy-Preserving Aggregation Mechanism

Fig. 5 illustrates the entropy values of ciphertexts corresponding to various plaintext lengths. The horizontal axis of the figure in this subsection represents the number of encrypted parameters. Although a noticeable gap exists between the observed entropy values and the ideal value when the plaintext length is short, this discrepancy can be attributed to the relatively larger space and number of states available in the ciphertext. In such cases, the number of ciphertext states utilized by short plaintexts is insufficient to fully exploit the available entropy. As the number of parameters encrypted in plaintext approaches or exceeds the modulus size (with N=25,601 in our experiments), the entropy gradually approaches its theoretical optimum. It can therefore be hypothesized that the ciphertexts produced by the proposed encryption algorithm exhibit uniform randomness.

Figure 5: Comparison of ciphertext entropy and the theoretical optimum of the entropy value as the plaintext length increases.

In Fig. 6, a single bit in the plaintext is modified, and the UACI and NPCR values between the corresponding ciphertexts are evaluated. The results demonstrate that, regardless of plaintext length, both NPCR and UACI values approach their theoretical upper bounds. This indicates that the proposed algorithm exhibits high sensitivity to changes in plaintext, thereby offering strong resistance against conventional differential attacks.

Figure 6: NPCR and UACI values under different plaintext lengths in differential testing experiments.

In Fig. 7, a slight modification is made to either the key or a subkey, and the ciphertexts generated by two separate encryption operations are compared. It is observed that the resulting UACI and NPCR values are both close to their respective theoretical upper bounds, indicating that the algorithm demonstrates strong key sensitivity. This implies that an attacker cannot effectively reduce the key search space through differential key analysis. Overall, the algorithm has demonstrated numerical robustness against statistical, differential, and linear cryptanalytic attacks.

Figure 7: NPCR and UACI values under different plaintext lengths in key differential testing experiments.

Table 4 shows the encryption and decryption times, homomorphic addition times, and ciphertext sizes for various encryption algorithms when 10,000 parameters are to be encrypted, with results averaged over 10 experiments. It can be observed that, compared to traditional encryption methods based on elliptic curve and integer factorization problems, lattice-based encryption and the proposed algorithm exhibit multiple orders of magnitude differences in encryption and decryption times. Although the proposed algorithm has slightly longer encryption, decryption, and aggregation times than the BFV algorithm, it benefits from a relatively shorter ciphertext length.

4.5.2 Ablation Experiments of the Proposed Privacy-Preserving Aggregation Mechanism

To verify the interactions among the modules in the privacy-preserving method, this paper conducts ablation experiments. Specifically, in this experiment, starting from the round key, each operator is sequentially incorporated into the proposed algorithm, and the above metrics are retested to verify the role of each module in the algorithm.

In Fig. 8, stage 1–6 respectively represent the progressive incorporation of the add round key, confusion matrix, permutation, CBC, disturb, and PCBC modules into the privacy-preserving aggregation mechanism.

Figure 8: Entropy comparison of ablation experiments.

It can be seen that, through the ablation experiment in which modules are progressively introduced, the involved round-key addition, confusion, and permutation can significantly improve the randomness of the encryption output and rapidly raise its entropy to a relatively high level. However, without introducing perturbation and the encryption mode, the upper bound of the ciphertext entropy is limited by the amount of information contained in the key. After further introducing perturbation and the encryption mode, the entropy of the algorithm can continue to increase steadily and ultimately approach the theoretical ideal value. These results fully demonstrate the effectiveness of the proposed modules, especially the contributions of perturbation and the encryption mode.

Figs. 9 and 10 illustrate the results of the ablation experiments on differential sensitivity and key sensitivity sharing.

Figure 9: KS-test UACI and NPCR comparison results under different stages. The upper panel shows the UACI comparison results, and the lower panel shows the NPCR comparison results.

Figure 10: Diff-test UACI and NPCR comparison results under different Stages. The upper panel shows the UACI comparison results, and the lower panel shows the NPCR comparison results.

Since this is an ablation experiment, it is normal that the sensitivity of the modules that have not yet been incorporated remains constantly zero in the key-sensitivity results shown in Fig. 9. For the remaining modules, it can be observed that, without the collaborative effect of other modules, RK and IV can only affect a single ciphertext component within one ciphertext block. Therefore, when used independently, their key sensitivity is extremely low and close to zero. After the confusion and permutation modules are introduced, the ciphertext sensitivity increases. Specifically, DM and π can not only diffuse differential fluctuations across the entire ciphertext block by themselves, but also interact with RK and IV. With the introduction of CBC, the key sensitivity of the algorithm is further enhanced through the cross-block propagation of differences. The addition of perturbation further reduces the dependence of sensitivity on the ciphertext length. Finally, the introduced PCBC mechanism significantly strengthens the avalanche effect, enabling small fluctuations to propagate rapidly across different ciphertext blocks.

For plaintext differences, when round-key addition, matrix confusion, and permutation are introduced, the fluctuations caused by plaintext differences still cannot propagate across ciphertext blocks and can only affect a single ciphertext block. As a result, the overall sensitivity of the ciphertext decreases rapidly as the ciphertext length increases. After the introduction of CBC and the perturbation mechanism, ciphertext blocks within each CBC group can influence each other, thereby improving the sensitivity. However, the sensitivity still does not reach the ideal level. The PCBC mechanism further connects the entire ciphertext, allowing the influence of a single ciphertext block to diffuse across the whole ciphertext and thereby forming a stronger avalanche effect.

4.5.3 Sensitivity Analysis of Noise Parameters

From the theoretical derivation, it can be seen that the security of the algorithm largely comes from the applied random perturbation. To test the sensitivity of the proposed algorithm to the noise perturbation parameter, we adjust the noise scale introduced into the algorithm while keeping the modulus used by the algorithm unchanged, and verify the metric values under different noise scales.

As shown in Figs. 11 and 12, when the noise parameter is varied, the statistical properties and sensitivity of the algorithm’s ciphertext change only slightly. The experimental results indicate that our algorithm exhibits good statistical properties under different noise levels, suggesting that the algorithm has a low dependence on different noise levels.

Figure 11: Experimental results under different noise scales.

Figure 12: Entropy comparison under different noise scales.

4.6 Parameter Sensitivity Analysis of the Federated Learning Method

In this subsection, to further explore the performance of the proposed federated learning method, we conduct additional parameter-tuning tests on the proposed method. Specifically, to verify the robustness of the proposed algorithm to non-IID (non-independent and identically distributed) and non-balanced data when applied to the federated learning framework, this subsection first partitions the data into non-balanced datasets according to different Dirichlet distribution parameters, and tests the robustness of the algorithm to non-uniformly distributed data under different settings. Subsequently, to verify the analysis of the computational and communication costs of the proposed algorithm in Section 3.6, this paper adjusts the number of participants within a certain range, repartitions the complete dataset after each adjustment, and evaluates the accuracy, computational cost, and communication cost during the training process. Finally, to test the sensitivity of the model accuracy of the proposed method to quantization precision, the quantization precision is adjusted under the setting of 10 participants, IID, and balanced data.

As shown in Fig. 13, federated learning can proceed normally when the degree of data distribution shift among participants is relatively low, whereas training collapses under extremely severe data shift. This is because the proposed method performs aggregation by weighting the gradients according to the number of samples held by each participant, thereby exhibiting robustness to non-IID distributions under non-extreme settings, similar to FedAvg. These results demonstrate that the proposed quantization and encryption operations do not compromise the robustness of weighted aggregation.

Figure 13: Test accuracy under different non-IID degrees.

As shown in Fig. 14a, the model accuracy decreases as the number of participants increases. However, this is a common phenomenon in federated learning training. As the number of participants increases, data fragmentation may lead to local overfitting. Meanwhile, since the test model used in this study contains normalization layers, specifically batch normalization (BN) layers, the reduced amount of data available to each participant may decrease the stability of the BN statistics estimation.

Figure 14: Performance comparison under different numbers of clients.

The experimental results in Fig. 14b and Fig. 14c indicate that the computational and communication costs of the proposed algorithm increase approximately linearly with the number of participants, which is consistent with the theoretical analysis. When the number of participants varies, the local training time remains almost unchanged. This is because, each time the number of participants is adjusted, the entire dataset is repartitioned, and each experiment still performs forward and backward propagation over the full dataset, resulting in only minor differences in training time. In most cases, the negotiation time can be neglected because mainstream deep learning models generally contain a large number of parameters, and thus the computational cost introduced by key negotiation is negligible in comparison.

The experimental results in Fig. 15 show that the training accuracy remains consistent across different quantization precisions, indicating that the proposed algorithm can still maintain high accuracy even at relatively low quantization precision. The communication cost increases linearly with the quantization precision, which is consistent with the derivation in the theoretical analysis. Meanwhile, the computation time fluctuates only within a small range, which can be regarded as an acceptable measurement error.

Figure 15: Performance comparison under different quantization bit settings.

Finally, we present in detail the percentage of time occupied by each step during the training process when the number of participants is set to 10.

Table 5 presents the average time consumption and the proportion of total training duration for each step in each training round when the number of clients is 10. In each training round, the processes of local training and encryption account for the largest proportion of time consumption. The time taken by decryption and negotiation is relatively small. Ciphertext aggregation consumes the least time, which is almost negligible.

5  Conclusion

In this work, a short-ciphertext multi-key privacy-preserving mechanism, referred to as MKPHE-FL, is first constructed. Built upon a symmetric block encryption framework, the scheme features low communication overhead and acceptable computational cost. Furthermore, it supports multi-key encryption, making it suitable for federated learning scenarios with strong privacy and security requirements. Leveraging the homomorphic properties of secret sharing, a secret-sharing-based key negotiation protocol (SS-KNP) is designed to aggregate the distinct keys generated by individual clients during encryption.

Based on the above algorithms, we design a federated learning method capable of effectively defending against collusion-based privacy attacks. Within this method, participants can adaptively select encryption precision and noise levels according to the scale of the federated learning task. Each client is allowed to use a distinct sub-key to prevent privacy leakage from other participants.

Theoretical analysis shows that, through the use of encryption modes and randomization mechanisms, our algorithm is resistant to linear and differential attacks. Furthermore, with appropriately chosen parameters, the encryption process does not significantly increase message length. Numerical experiments demonstrate that our algorithm resists statistical and differential analysis attacks and, when applied within the federated learning method, achieves moderate computational cost and low communication cost.

Although the proposed algorithm offers certain advantages in communication cost, its adoption of the classical FedAvg framework for model aggregation leads to relatively weak resilience against malicious attacks. Future research will investigate how the homomorphic properties of the encryption scheme can be leveraged to quantify the similarity among participant-uploaded gradients, thereby improving the robustness of federated learning against adversarial attacks.

At the same time, although the scheme proposed in this paper achieves significant advantages in computational efficiency and communication overhead, we note that the current protocol design still has room for improvement in robustness against client dropouts. Since our method relies on secret sharing to realize key agreement, if some participating nodes unexpectedly drop out during a training round due to network fluctuations, it is highly likely that the received shares among participants will become inconsistent, thereby preventing the successful aggregation of all keys. Although the training of those participants with stable network connections can still proceed through partial key aggregation, the frequent occurrence of such events will cause the updates from participants affected by network fluctuations to be ignored during aggregation. In future work, it should be considered how to quickly compensate for this missing contribution to the global model when dropped participants are occasionally able to reconnect.

Acknowledgement: The authors thank Dr. Dai Yu from the School of Mathematics and Statistics, Wuhan University of Technology, for helpful guidance and suggestions during manuscript revision.

Funding Statement: This paper received funding support from the PCL-CMCC Foundation for Science and Innovation (Grant No. 2024ZY2B0050).

Author Contributions: Conceptualization: Hongzhen Liu, Xi Fang; Methodology: Hongzhen Liu; Software: Hongzhen Liu; Formal Analysis: Hongzhen Liu; Investigation: Hongzhen Liu; Writing—Original Draft: Hongzhen Liu; Writing—Review and Editing: Zhe Zhang, Liang Xie, Yuan Wan, Xi Fang; Supervision: Zhiqiang Ru; Project Administration: Zhiqiang Ru; Validation: All authors. All authors reviewed and approved the final version of the manuscript.

Availability of Data and Materials: The datasets used in this paper include Cifar-10 [41], AGNews [42], and PAMAP2 [43]. Among them, Cifar10 can be obtained from https://www.cs.toronto.edu/~kriz/cifar.html, AGNews can be obtained from https://www.kaggle.com/datasets/amananandrai/ag-news-classification-dataset, and PAMAP2 can be obtained from https://doi.org/10.24432/C5NW2H.

Ethics Approval: Not applicable. This study did not involve any human or animal participants.

Conflicts of Interest: The authors declare no conflicts of interest.

Appendix A Security Analysis of the Proposed Privacy-Preserving Aggregation Mechanism

Appendix A.1 Algebraic Analysis

This appendix analyzes the algorithm’s resistance to chosen-plaintext attacks based on linear algebraic techniques. The algorithm is simplified firstly using linear algebra, and then its resistance to linear and differential attacks under the assumption that the adversary possesses the key sk and a certain number of plaintext-ciphertext pairs is analysed.

Appendix A.1.1 Assumptions about the Adversary

Assume that the adversary holds lmatrix pairs of sequentially corresponding plaintext matrix lists and ciphertext matrix lists, i.e., M=[M0,M1,…,Mlmatrix−1] and C=[C0,C1,…,Clmatrix−1]. Meanwhile, due to the requirements of the federated learning setup, the adversary also holds the key sk used to generate the subkeys RK, DM, and π. The main goal of the adversary is to establish a linear equation model for recovering the IVs parameters used in generating these plaintext-ciphertext pairs, or to infer information about other original plaintexts therefrom.

Appendix A.1.2 Simplification of the Algorithm

In this subsection, we take the encryption procedure under the parameter setting nr=2 and sizematrix=2 as an illustrative example (used solely for derivation purposes and not reflecting the parameters adopted in practical instantiation). The encryption process of a plaintext block Mi(i≥2) is reformulated into a matrix-based computational representation. Specifically, we first redefine a subset of the encryption operators, then present the matrix-vector formulations of the operators introduced above, and finally compose these operators to obtain an equivalent matrix representation of the overall encryption procedure.

Since the initialization vector (IV) is treated as an unknown key to be solved in this subsection, we isolate the IV from Eq. (4) and denote the resulting operation as RK(⋅). The operators DM(⋅) and π(⋅) remain consistent with Eqs. (5) and (6), respectively.

For ease of exposition, we define one complete encryption round composed of these key-dependent operations as Round(⋅). The specific definitions of RK(⋅) and Round(⋅) are given in Eqs. (A1) and (A2), respectively.

RK(M)=RK⊙M(A1)

Round(M)=RK(DM(π(M)))(A2)

The three keys used in the encryption process, together with a single encryption round, can be transformed into the forms given in Eqs. (A3)–(A5):

For RK(⋅), the element-wise multiplication between matrices (⊙) can be reformulated as the multiplication of a diagonal matrix with a vector.

RK(M)=[rk1,1rk1,2rk2,1rk2,2]⊙[m1,1m1,2m2,1m2,2]=[rk1,1m1,1rk1,2m1,2rk2,1m2,1rk1,2m2,2]RK′M→=diag{rk1,1,rk1,2,rk2,1,rk2,2}M→(A3)

For DM(⋅), since matrix multiplication is a linear transformation, the coefficients that map the original vector to each transformed element can be explicitly extracted.

DM−1×M×DM=[dm1,1invdm1,2invdm2,1invdm2,2inv]×[m1,1m1,2m2,1m2,2]×[dm1,1dm1,2dm2,1dm2,2]DM′M→=[dm1,1invdm1,1dm1,1invdm2,1dm1,2invdm1,1dm1,2invdm2,1dm1,1invdm1,2dm1,1invdm2,2dm1,2invdm1,2dm1,2invdm2,2dm2,1invdm1,1dm2,1invdm2,1dm2,2invdm1,1dm2,2invdm2,1dm2,1invdm1,2dm2,1invdm2,2dm2,2invdm1,2dm2,2invdm2,2]M→(A4)

The permutation operation is equivalent to applying an elementary transformation matrix to shift the original vector.

π(M)=Π′M→=[p1,1p1,2p1,3p1,4p2,1p2,2p2,3p2,4p3,1p3,2p3,3p3,4p4,1p4,2p4,3p4,4]M→(A5)

Here, diag(⋅) denotes a diagonal matrix. The terms rki,j,dmi,j represent the elements at the corresponding positions in the original key matrices. The matrices RK′, DM′, and Π′ denote the key matrices transformed into their equivalent forms. M→ denotes the plaintext obtained by vectorizing the plaintext matrix in a left-to-right, top-to-bottom order, as shown in Eq. (A6). The value of pi,j is defined as in Eq. (A7), where πr,c denotes the element at row r and column c of the original permutation matrix π, and I(⋅) is the indicator function.

M→=[m1,1m1,2m2,1m2,2](A6)

pi,j=Iπr,c=j(r,c=1,…,sizematrix,i,j=1,…,sizematrix2,i=(r−1)×sizematrix+c)(A7)

Consequently, the operation Round(⋅) can also be reformulated into a similar representation, as shown in Eq. (A8).

Round(M)=RK(DM(π(M)))Round′M→=RK′DM′Π′M→(A8)

For the PCBC mode, since the adversary has access to certain plaintext-ciphertext pairs, the unknown variables that introduce interference into the recovery process are the perturbations Ri and Ri−1 added to the current and previous plaintexts, respectively. The PCBC mechanism in the overall expression of Eq. (3) can therefore be decomposed into a known part and an unknown part.

Cpcbc,i=scale(Mi+Mi−1)+Ci−1+Ri+Ri−1=Mscale,i+(Ri+Ri−1)=scale×E4×(M→i+M→i−1)+C→i−1+(R→i+R→i−1)(A9)

C→pcbc,i=M→scale+R→i+R→i−1(A10)

Here, scale is a scalar, E denotes the identity matrix, and C→i−1,R→i are the ciphertext and noise matrices, respectively, vectorized in the same manner as the plaintext.

For the CBC mode, the core operation lies in introducing the two preceding ciphertexts Ci−1′ and Ci−2′ during the encryption process. This step can be reformulated as shown in Eq. (A11).

C→cbc,i=[E4E4E4][C′→iC′→i−1C′→i−2](A11)

After incorporating the initialization vector (IV), and under the setting nr=2, the entire encryption process can be expanded as follows:

C→i=Roundi,2′[Roundi,1′RKi,0′Roundi−1,1′RKi−1,0′Roundi−2,1′RKi−2,0′]×([M→scale,iM→scale,i−1M→scale,i−2]+[R→i+R→i−1R→i−1+R→i−2R→i−2+R→i−3])+Roundi,2′[Roundi,1′Roundi−1,1′Roundi−2,1′][IV→i,0IV→i−1,0IV→i−2,0]+Roundi,2′[E4E4E4][IV→i,1IV→i−1,1IV→i−2,1]+IV→i,2(A12)