TAPAS: Efficient Two-Server Asymmetric Private Aggregation Beyond Prio(+)

Harish Karthikeyan; Antigoni Polychroniadou

cs.CRMar 20, 2026

TAPAS: Efficient Two-Server Asymmetric Private Aggregation Beyond Prio(+)

Authors: Harish Karthikeyan, Antigoni Polychroniadou

Organizations: JPMorgan AI Research, JPMorgan AlgoCRYPT CoE

Abstract

Privacy-preserving aggregation is a cornerstone for AI systems that learn from distributed data without exposing individual records, especially in federated learning and telemetry. Existing two-server protocols (e.g., Prio and successors) set a practical baseline by validating inputs while preventing any single party from learning users' values, but they impose symmetric costs on both servers and communication that scales with the per-client input dimension $L$ . Modern learning tasks routinely involve dimensionalities $L$ in the tens to hundreds of millions of model parameters. We present TAPAS, a two-server asymmetric private aggregation scheme that addresses these limitations along four dimensions: (i) no trusted setup or preprocessing, (ii) server-side communication that is independent of $L$ (iii) post-quantum security based solely on standard lattice assumptions (LWE, SIS), and (iv) stronger robustness with identifiable abort and full malicious security for the servers. A key design choice is intentional asymmetry: one server bears the $O(L)$ aggregation and verification work, while the other operates as a lightweight facilitator with computation independent of $L$ . This reduces total cost, enables the secondary server to run on commodity hardware, and strengthens the non-collusion assumption of the servers. One of our main contributions is a suite of new and efficient lattice-based zero-knowledge proofs; to our knowledge, we are the first to establish privacy and correctness with identifiable abort in the two-server setting.

Figures & tables

	Communication Cost			Computation Cost			Server	Mal.
	Server 1	Server 2	Client	Server 1	Server 2	Client	Security	Clients
Elsa	$n+nLt^{2}$	$n+nLt^{2}$	$tL+\lambda+\kappa+L\log L$	$n(tL+\lambda+\kappa)$	$n(tL+\lambda+\kappa)$	$tL+\lambda+\kappa$	MP	Yes
Prio	$ntL\lambda+tL\log tL$	$ntL+tL\log tL$	$tL$	$ntL\log tL$	$ntL\log tL$	$tL\log tL$	SH	Yes
Prio+	$nLt$	$nLt$	$Lt$	$nLt\lambda$	$nLt\lambda$	$L$	SH	Yes
Heli	$n(L+\log t)$	$(L+\gamma n\log n)$	$(L+\log tL)$	$ntL+L\sqrt{n\cdot 2^{t}}$	$L+\gamma n$	$tL$	MP	Yes
$\mathsf{TAPAS}$	$nL$	$n\lambda$	$L+\lambda$	$nL$	$n$	$L$	SH	No

Table 1: Costs are reported for

n

clients and vector length

L

, where inputs

\in[0,2^{t}-1)

Computation and communication (vector count) are given in

\mathcal{(}\cdot)

notation, omitting constant factors. Communication cost omits the computational security parameter (

\lambda

) factor that accounts for bit-length in field and group elements.

\kappa

is the statistical security parameter. For Heli,

\gamma

denotes the fraction of dropped clients from computation. Server Security has three flavors: semi-honest (SH) server(s), malicious privacy (MP) where honest server can detect deviation, and its strengthened version identifiable abort (IA) where the honest server can identify the misbehaving party.

Figure 1: Sequence Diagram of $\mathsf{TAPAS}$ showing client communication with the two servers and additional rounds of communication between the two servers. By updates, we are indicating the model updates that is to be sent to the server and are the inputs to our secure aggregation protocol. The unmasked result is communicated with all the users, in the semi-honest version. The version that is secure against malicious servers also allow the participants to verify the aggregate using commitments.

Component	Base ( $L_{\infty}$ )	Shift Norm $(T)$	Sigma $(\sigma=\xi T)$	Verification ( $\beta$ )
Secret s	$B_{s}$	$C\sqrt{n}B_{s}$	$\xi C\sqrt{\lambda}B_{s}$	$\tau\sqrt{\lambda}\sigma_{s}$
Error e	$B_{e}$	$C\sqrt{d}B_{e}$	$\xi C\sqrt{d}B_{e}$	$\tau\sqrt{d}\sigma_{e}$
Message x	$B_{x}$	$C\sqrt{d}B_{x}$	$\xi C\sqrt{d}B_{x}$	$\tau\sqrt{d}\sigma_{x}$

Table 2: Parameters for the Zero-knowledge Argument of Knowledge

Panel of Figure 2 — Figure 2: Lattice-based Zero-Knowledge Argument of Knowledge for Relation $\mathcal{R}_{\mathsf{Block}}$ . Here $C$ is the maximum value of the challenge set. We sample challenges between $\{-C,\ldots,C\}$ .

Panel of Figure 3 — Figure 3: The ideal functionality for Secure Aggregation handling dropouts and validity constraints.

Panel of Figure 4 — Figure 4: Protocol $\textrm{Two-server Asymmetric Private Aggregation Scheme}_{\text{SH}}^{\text{BP}}$ for Semi-Honest Servers. Let $L,\lambda,q$ be integers such that they are secure parameter choices of Hint LWE Assumption.

Panel of Figure 5 — Figure 5: Protocol $\mathsf{TAPAS}_{\text{MAL}}^{\text{BP}}$ . Adds mask $\mathbf{w}$ and homomorphic verification for malicious security.

Panel of Figure 6 — Figure 6: The Semi-Honest Protocol $\mathsf{TAPAS}_{\text{SH}}^{\text{LWE}}$ . Here $t,L,d,k$ are integers such that $L=dk$ . Further, $L,\lambda,q$ satisfies the Hint LWE Assumption.

Panel of Figure 7 — Figure 7: Extended $\Sigma$ -protocol for the relation in Definition 3 using Ajtai Commitment.

Panel of Figure 8 — Figure 8: Protocol $\mathsf{TAPAS}_{\text{LWE}}^{\text{MAL}}$ . Secure against Malicious server. Let $L,k,m,d,t,\lambda$ be integers such that such that $L=k\cdot d,m=\omega(\lambda\log q)$ . and $q,L,\lambda$ satisfy the Hint-LWE Assumption.

Clients ( $n$ )	Client (s)		Server 1 (s)		Server 2 (s)
Clients ( $n$ )	Elsa	Ours	Elsa	Ours	Elsa	Ours
10	0.550	0.197	0.908	0.563	0.912	0.015
20	0.805	0.200	1.178	0.762	1.180	0.031
30	1.003	0.193	1.384	0.778	1.380	0.048
40	1.650	0.198	1.752	1.388	1.751	0.063
50	1.707	0.193	2.098	1.433	2.098	0.077

Table 3: Scalability Analysis (

L=2^{16}

). Direct comparison of computation time (in seconds) between Elsa and our proposed protocol as the number of clients (

n

) increases. Bold indicates the best performance in each category.

Vector Size	System	Client (s)	Server 1 (s)	Server 2 (s)
$2^{16}$	Elsa	3.139	3.743	3.734
	Prio	13.282	2.62	3.070
	Ours	0.202	2.572	0.162
$2^{17}$	Elsa	6.920	7.914	7.913
	Prio	35.345	7.651	8.427
	Ours	0.395	5.150	0.282

Table 4: Computation Time Comparison (

n=100

clients). Running times (in seconds) for Elsa and Pri vs. Ours across varying vector dimensions (

L

). Ours uses batched verification on Server 1 and lightweight auditing on Server 2. Bold indicates the best performance.

Secure Aggregation

Secure aggregation lets distributed participants reveal a combined update or statistic without exposing their individual contributions.

See all 19 papers

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning
May 13, 2026Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos +4Federated Learning Aggregation Communication-Efficient Distributed Training
Samsung R&D Institute UK (SRUK) · Information Technologies Institute (CERTH-ITI)
Progressive-Resolution Secure Aggregation for Federated Learning
Sep 30, 2026Seyed Mohammad Azimi-AbarghouyiFederated Learning Aggregation Secure Aggregation
Department of Electrical Engineering, Chalmers University of Technology, Gothenburg, Sweden
Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation
Apr 8, 2026Wenjing Wei, Farid Nait-Abdesselam, Alla JamminePrivacy-Preserving Federated Learning Differentially Private Federated Learning
Université Paris Cité, Paris, France

May 13, 2026J/K move · Enter open · S save

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning

Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos, Karthikeyan Saravanan+3

Samsung R&D Institute UK (SRUK) · Information Technologies Institute (CERTH-ITI)

Federated Learning Aggregation Communication-Efficient Distributed Training Privacy-Preserving ML Secure Aggregation Federated Learning

Open paper AskPDF arXiv

Federated learning enables collaborative model training across distributed clients, yet vanilla FL exposes client updates to the central server. Secure-aggregation schemes protect privacy against an honest-but-curious server, but existing approaches often suffer from many communication rounds, heavy public-key operations, or difficulty handling client dropouts. Recent methods like One-Shot Private Aggregation (OPA) cut rounds to a single server interaction per FL iteration, yet they impose substantial cryptographic and computational overhead on both server and clients. We propose a new protocol called DisAgg that leverages a small committee of clients called Aggregators to perform the aggregation itself: each client secret-shares its update vector to Aggregators, which locally compute partial sums and return only aggregated shares for server-side reconstruction. This design eliminates local masking and expensive homomorphic encryption, reducing endpoint computation while preserving privacy against a curious server and a limited fraction of colluding clients. By leveraging optimal trade-offs between communication and computation costs, DisAgg processes 100k-dimensional update vectors from 100k 5G clients with a 4.6x speedup compared to OPA, the previous best protocol.

Abstract

Secure Aggregation

Explore similar work

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning

Progressive-Resolution Secure Aggregation for Federated Learning

Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation