Progressive-Resolution Secure Aggregation for Federated Learning

Seyed Mohammad Azimi-Abarghouyi

cs.CRSep 30, 2026

Progressive-Resolution Secure Aggregation for Federated Learning

Authors: Seyed Mohammad Azimi-Abarghouyi

Organizations: Department of Electrical Engineering, Chalmers University of Technology, Gothenburg, Sweden

Abstract

Secure aggregation lets a server recover an aggregate of client updates without observing any individual update, but conventional protocols fix the aggregate precision when clients upload. We introduce and formulate a new progressive-resolution secure-aggregation functionality in which clients upload once and successively finer resolutions of the same aggregate can later be authorized without renewed client participation. To realize this functionality, we propose progressive-resolution secure aggregation (PSA): each clipped, dithered update is represented by compatible nested-lattice digits; separately releasable layers are protected by secure aggregation and an additional aggregate pad that remains unavailable to the server until a non-colluding release controller authorizes that layer.

Figures & tables

Fig. 1: Exact finite-alphabet validation,

\rho=3

L=4

. (a) Smallest feasible per-layer margin at carry probability at most

10^{-3}

against

\log_{\rho}K

; the staircase reflects integrality of

m_{\ell}

, and a linear fit to it has slope

0.548

against the predicted

1/2

. (b) Rate at which

Q_{\Lambda_{\ell}}-Q_{\Lambda_{\ell+1}}

leaves the centered alphabet

\mathcal{C}_{\ell}

, over

2\times 10^{5}

random representable points for the integer chain and

2\times 10^{4}

for the

A_{2}

chain: identically zero for the odd-radix integer chain (annotated zeros), nonzero from layer

2

for a merely self-similar

A_{2}

chain.

Fig. 2: Leading composition ratio

\varepsilon^{\rm lead}_{\rm lay}/\varepsilon^{\rm lead}_{\rm flat}

at equal noise budget. (a) Product domain as the fill

\Gamma

of the digit alphabet is reduced; markers give the number of layers still active, and arrows mark the transitions at which a layer empties. (b) Globally

\ell_{2}

-clipped domain against chain depth, where no layer ever becomes inactive.

Fig. 3: (a) Per-client truncation error against the two-sided bounds of Theorem 4 (b), drawn as shaded bands for

\ell_{0}\geq 2

where they have width; at

\ell_{0}=1

the bounds coincide and Theorem 4 (a) is exact. (b) Mean-square error of the mean estimate with every depth recalibrated to

\varepsilon=4

, separated into its total and its quantization component. Bars are

95\%

confidence intervals; where not visible they are smaller than the markers.

		MNIST		CIFAR-10
$\varepsilon$	$R$	PSA	flat $\times R$	PSA	flat $\times R$
$6$	1	0.771	0.771	0.274	0.274
	2	0.650	0.718	0.195	0.227
	4	0.492	0.626	0.154	0.206
$30$	1	0.910	0.910	0.429	0.429
	2	0.854	0.883	0.354	0.389

TABLE I: Matched functionality at

\delta=10^{-6}

: one PSA upload serving

R

authorized resolutions versus

R

repeated flat executions. Accuracy is the mean over three seeds; payload is bit per dimension at

K=1000

Fig. 4: MNIST federated training at matched

\varepsilon=30

\delta=10^{-6}

, three seeds (shaded: one standard deviation, below line width except at

R=4

). Solid curves are PSA, dashed the distributed discrete Gaussian re-executed once per resolution (DDG

\times R

), dash-dotted the Skellam mechanism, which serves a single release; the extremes

R=1

and

R=4

are shown, with

R=2

in Table I . Two coincidences are results rather than plotting artifacts: the lattice-quantized arm tracks the non-private reference, and at

R=1

the dashed curve lies on the solid one at every logged round.

Fig. 5: The operating regime as a design choice,

\gamma=2

. (a) Exact leading composition ratio of the

\ell_{2}

-clipped domain against the rotated coordinatewise-clipped domain, with the surviving

\ell_{2}

bound retained in the sensitivity accounting. (b) Federated accuracy at

R=4

authorized resolutions and matched

(\varepsilon,\delta)

, three seeds (bars: one standard deviation), with the same rotation granted to the repeated flat baseline; the unrotated PSA arm uses this experiment’s conservative stage bounds and is a within-experiment reference (see text).

Explore similar work

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning
May 13, 2026Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos +4Secure Aggregation Federated Learning
Samsung R&D Institute UK (SRUK) · Information Technologies Institute (CERTH-ITI)
The Capacity of Information-Theoretic Secure Aggregation in Federated Learning
Jun 5, 2026Lanxin Yi, Jinbao Zhu, Kai Wan +1Secure Aggregation Federated Learning
Information Coding and Transmission (ICT) Key Laboratory of Sichuan Province, Southwest Jiaotong University, Chengdu 611756, China · School of Electronic Information and Communications, Huazhong University of Science and Technology, Wuhan 430074, China
When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning
Sep 8, 2026Wenrui Yu, Changlong Ji, Johannes Bjerva +1Secure Aggregation Federated Learning
Aalborg University Copenhagen, Denmark · Institut Polytechnique de Paris Paris, France

May 13, 2026, cs.CRJ/K move · Enter open · S save

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning

Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos, Karthikeyan Saravanan+3

Samsung R&D Institute UK (SRUK) · Information Technologies Institute (CERTH-ITI)

Secure Aggregation Federated Learning Homomorphic Encryption Disagreement

Open paper AskPDF arXiv

Federated learning enables collaborative model training across distributed clients, yet vanilla FL exposes client updates to the central server. Secure-aggregation schemes protect privacy against an honest-but-curious server, but existing approaches often suffer from many communication rounds, heavy public-key operations, or difficulty handling client dropouts. Recent methods like One-Shot Private Aggregation (OPA) cut rounds to a single server interaction per FL iteration, yet they impose substantial cryptographic and computational overhead on both server and clients. We propose a new protocol called DisAgg that leverages a small committee of clients called Aggregators to perform the aggregation itself: each client secret-shares its update vector to Aggregators, which locally compute partial sums and return only aggregated shares for server-side reconstruction. This design eliminates local masking and expensive homomorphic encryption, reducing endpoint computation while preserving privacy against a curious server and a limited fraction of colluding clients. By leveraging optimal trade-offs between communication and computation costs, DisAgg processes 100k-dimensional update vectors from 100k 5G clients with a 4.6x speedup compared to OPA, the previous best protocol.

Abstract

Explore similar work

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning

The Capacity of Information-Theoretic Secure Aggregation in Federated Learning

When Topology Betrays Privacy: Lattice-Based Reconstruction Attacks on Secure Aggregation in Decentralized Federated Learning