TAPAS: Efficient Two-Server Asymmetric Private Aggregation Beyond Prio(+)

Harish Karthikeyan; Antigoni Polychroniadou

cs.CRMar 20, 2026

TAPAS: Efficient Two-Server Asymmetric Private Aggregation Beyond Prio(+)

Authors: Harish Karthikeyan, Antigoni Polychroniadou

Organizations: JPMorgan AI Research, JPMorgan AlgoCRYPT CoE

Abstract

Privacy-preserving aggregation is a cornerstone for AI systems that learn from distributed data without exposing individual records, especially in federated learning and telemetry. Existing two-server protocols (e.g., Prio and successors) set a practical baseline by validating inputs while preventing any single party from learning users' values, but they impose symmetric costs on both servers and communication that scales with the per-client input dimension $L$ . Modern learning tasks routinely involve dimensionalities $L$ in the tens to hundreds of millions of model parameters. We present TAPAS, a two-server asymmetric private aggregation scheme that addresses these limitations along four dimensions: (i) no trusted setup or preprocessing, (ii) server-side communication that is independent of $L$ (iii) post-quantum security based solely on standard lattice assumptions (LWE, SIS), and (iv) stronger robustness with identifiable abort and full malicious security for the servers. A key design choice is intentional asymmetry: one server bears the $O(L)$ aggregation and verification work, while the other operates as a lightweight facilitator with computation independent of $L$ . This reduces total cost, enables the secondary server to run on commodity hardware, and strengthens the non-collusion assumption of the servers. One of our main contributions is a suite of new and efficient lattice-based zero-knowledge proofs; to our knowledge, we are the first to establish privacy and correctness with identifiable abort in the two-server setting.

Figures & tables

	Communication Cost			Computation Cost			Server	Mal.
	Server 1	Server 2	Client	Server 1	Server 2	Client	Security	Clients
Elsa	$n+nLt^{2}$	$n+nLt^{2}$	$tL+\lambda+\kappa+L\log L$	$n(tL+\lambda+\kappa)$	$n(tL+\lambda+\kappa)$	$tL+\lambda+\kappa$	MP	Yes
Prio	$ntL\lambda+tL\log tL$	$ntL+tL\log tL$	$tL$	$ntL\log tL$	$ntL\log tL$	$tL\log tL$	SH	Yes
Prio+	$nLt$	$nLt$	$Lt$	$nLt\lambda$	$nLt\lambda$	$L$	SH	Yes
Heli	$n(L+\log t)$	$(L+\gamma n\log n)$	$(L+\log tL)$	$ntL+L\sqrt{n\cdot 2^{t}}$	$L+\gamma n$	$tL$	MP	Yes
$\mathsf{TAPAS}$	$nL$	$n\lambda$	$L+\lambda$	$nL$	$n$	$L$	SH	No

Table 1: Costs are reported for

n

clients and vector length

L

, where inputs

\in[0,2^{t}-1)

Computation and communication (vector count) are given in

\mathcal{(}\cdot)

notation, omitting constant factors. Communication cost omits the computational security parameter (

\lambda

) factor that accounts for bit-length in field and group elements.

\kappa

is the statistical security parameter. For Heli,

\gamma

denotes the fraction of dropped clients from computation. Server Security has three flavors: semi-honest (SH) server(s), malicious privacy (MP) where honest server can detect deviation, and its strengthened version identifiable abort (IA) where the honest server can identify the misbehaving party.

Figure 1: Sequence Diagram of $\mathsf{TAPAS}$ showing client communication with the two servers and additional rounds of communication between the two servers. By updates, we are indicating the model updates that is to be sent to the server and are the inputs to our secure aggregation protocol. The unmasked result is communicated with all the users, in the semi-honest version. The version that is secure against malicious servers also allow the participants to verify the aggregate using commitments.

Component	Base ( $L_{\infty}$ )	Shift Norm $(T)$	Sigma $(\sigma=\xi T)$	Verification ( $\beta$ )
Secret s	$B_{s}$	$C\sqrt{n}B_{s}$	$\xi C\sqrt{\lambda}B_{s}$	$\tau\sqrt{\lambda}\sigma_{s}$
Error e	$B_{e}$	$C\sqrt{d}B_{e}$	$\xi C\sqrt{d}B_{e}$	$\tau\sqrt{d}\sigma_{e}$
Message x	$B_{x}$	$C\sqrt{d}B_{x}$	$\xi C\sqrt{d}B_{x}$	$\tau\sqrt{d}\sigma_{x}$

Table 2: Parameters for the Zero-knowledge Argument of Knowledge

Panel of Figure 2 — Figure 2: Lattice-based Zero-Knowledge Argument of Knowledge for Relation $\mathcal{R}_{\mathsf{Block}}$ . Here $C$ is the maximum value of the challenge set. We sample challenges between $\{-C,\ldots,C\}$ .

Panel of Figure 3 — Figure 3: The ideal functionality for Secure Aggregation handling dropouts and validity constraints.

Panel of Figure 4 — Figure 4: Protocol $\textrm{Two-server Asymmetric Private Aggregation Scheme}_{\text{SH}}^{\text{BP}}$ for Semi-Honest Servers. Let $L,\lambda,q$ be integers such that they are secure parameter choices of Hint LWE Assumption.

Panel of Figure 5 — Figure 5: Protocol $\mathsf{TAPAS}_{\text{MAL}}^{\text{BP}}$ . Adds mask $\mathbf{w}$ and homomorphic verification for malicious security.

Panel of Figure 6 — Figure 6: The Semi-Honest Protocol $\mathsf{TAPAS}_{\text{SH}}^{\text{LWE}}$ . Here $t,L,d,k$ are integers such that $L=dk$ . Further, $L,\lambda,q$ satisfies the Hint LWE Assumption.

Panel of Figure 7 — Figure 7: Extended $\Sigma$ -protocol for the relation in Definition 3 using Ajtai Commitment.

Panel of Figure 8 — Figure 8: Protocol $\mathsf{TAPAS}_{\text{LWE}}^{\text{MAL}}$ . Secure against Malicious server. Let $L,k,m,d,t,\lambda$ be integers such that such that $L=k\cdot d,m=\omega(\lambda\log q)$ . and $q,L,\lambda$ satisfy the Hint-LWE Assumption.

Clients ( $n$ )	Client (s)		Server 1 (s)		Server 2 (s)
Clients ( $n$ )	Elsa	Ours	Elsa	Ours	Elsa	Ours
10	0.550	0.197	0.908	0.563	0.912	0.015
20	0.805	0.200	1.178	0.762	1.180	0.031
30	1.003	0.193	1.384	0.778	1.380	0.048
40	1.650	0.198	1.752	1.388	1.751	0.063
50	1.707	0.193	2.098	1.433	2.098	0.077

Table 3: Scalability Analysis (

L=2^{16}

). Direct comparison of computation time (in seconds) between Elsa and our proposed protocol as the number of clients (

n

) increases. Bold indicates the best performance in each category.

Vector Size	System	Client (s)	Server 1 (s)	Server 2 (s)
$2^{16}$	Elsa	3.139	3.743	3.734
	Prio	13.282	2.62	3.070
	Ours	0.202	2.572	0.162
$2^{17}$	Elsa	6.920	7.914	7.913
	Prio	35.345	7.651	8.427
	Ours	0.395	5.150	0.282

Table 4: Computation Time Comparison (

n=100

clients). Running times (in seconds) for Elsa and Pri vs. Ours across varying vector dimensions (

L

). Ours uses batched verification on Server 1 and lightweight auditing on Server 2. Bold indicates the best performance.

Secure Aggregation

Secure aggregation lets distributed participants reveal a combined update or statistic without exposing their individual contributions.

See all 19 papers

May 13, 2026

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning

Federated learning enables collaborative model training across distributed clients, yet vanilla FL exposes client updates to the central server. Secure-aggregation schemes protect privacy against an honest-but-curious server, but existing approaches often suffer from many communication rounds, heavy public-key operations, or difficulty handling client dropouts. Recent methods like One-Shot Private Aggregation (OPA) cut rounds to a single server interaction per FL iteration, yet they impose substantial cryptographic and computational overhead on both server and clients. We propose a new protocol called DisAgg that leverages a small committee of clients called Aggregators to perform the aggregation itself: each client secret-shares its update vector to Aggregators, which locally compute partial sums and return only aggregated shares for server-side reconstruction. This design eliminates local masking and expensive homomorphic encryption, reducing endpoint computation while preserving privacy against a curious server and a limited fraction of colluding clients. By leveraging optimal trade-offs between communication and computation costs, DisAgg processes 100k-dimensional update vectors from 100k 5G clients with a 4.6x speedup compared to OPA, the previous best protocol.

Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos +4

Samsung R&D Institute UK (SRUK) · Information Technologies Institute (CERTH-ITI)

Federated Learning Aggregation Communication-Efficient Distributed Training Privacy-Preserving ML Secure Aggregation Federated Learning

Ask PDF

Sep 30, 2026

Progressive-Resolution Secure Aggregation for Federated Learning

Secure aggregation lets a server recover an aggregate of client updates without observing any individual update, but conventional protocols fix the aggregate precision when clients upload. We introduce and formulate a new progressive-resolution secure-aggregation functionality in which clients upload once and successively finer resolutions of the same aggregate can later be authorized without renewed client participation. To realize this functionality, we propose progressive-resolution secure aggregation (PSA): each clipped, dithered update is represented by compatible nested-lattice digits; separately releasable layers are protected by secure aggregation and an additional aggregate pad that remains unavailable to the server until a non-colluding release controller authorizes that layer.

Seyed Mohammad Azimi-Abarghouyi

Department of Electrical Engineering, Chalmers University of Technology, Gothenburg, Sweden

Federated Learning Aggregation Secure Aggregation

Ask PDF

Apr 8, 2026

Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation

This article presents DDP-SA, a scalable privacy-preserving federated learning framework that jointly leverages client-side local differential privacy (LDP) and full-threshold additive secret sharing (ASS) for secure aggregation. Unlike existing methods that rely solely on differential privacy or on secure multi-party computation (MPC), DDP-SA integrates both techniques to deliver stronger end-to-end privacy guarantees while remaining computationally practical. The framework introduces a two-stage protection mechanism: clients first perturb their local gradients with calibrated Laplace noise, then decompose the noisy gradients into additive secret shares that are distributed across multiple intermediate servers. This design ensures that (i) no single compromised server or communication channel can reveal any information about individual client updates, and (ii) the parameter server reconstructs only the aggregated noisy gradient, never any client-specific contribution. Extensive experiments show that DDP-SA achieves substantially higher model accuracy than standalone LDP while providing stronger privacy protection than MPC-only approaches. The proposed framework scales linearly with the number of participants and offers a practical, privacy-preserving solution for federated learning applications with controllable computational and communication overhead.

Wenjing Wei, Farid Nait-Abdesselam, Alla Jammine

Université Paris Cité, Paris, France

Privacy-Preserving Federated Learning Differentially Private Federated Learning Federated Learning Aggregation Differential Privacy

Ask PDF

Abstract

Secure Aggregation

Explore similar work

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning

Progressive-Resolution Secure Aggregation for Federated Learning

Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation