# Privacy-Preserving Federated Singular Value Decomposition
## Appendix A Practical Secure Aggregation  
The practical secure aggregation by [PERSON] et al. [29] is summarized below. First and foremost, the following parameters are generated during the setup phase and sent to relevant node devices. * Pseudorandom Generator (PRG) [40; 41]: PRG takes a fixed length seed as the input and outputs in space \([0,R)\), where \(R\) is a prefixed value. * Secret Sharing [42]: SS.share\((s,t,\mathcal{U})\rightarrow\{(u,s_{u})\}_{u\in\mathcal{U}}\) takes a secret \(s\), a set of user IDs (e.g. integers), and a threshold \(s\leq|\mathcal{U}|\) as the input and outputs a set of shares \(s_{u}\) associated with the user \(u\in\mathcal{U}\); a reconstruction algorithm SS.recon\((\{(u,s_{u})\}_{v\in\mathcal{V}},t)\to 0\)  
Figure 4: The effect of various privacy parameters on the accuracy for Algorithms 1–3. \(s\) takes threshold \(t\) as an input and shares the corresponding inputs to a user subset \(\mathcal{V}\subseteq\mathcal{U}\) such that \(|\mathcal{V}|\geq t\), and outputs a field element \(s\). * Key Agreement [43]: \(\mathsf{KA\_param}(k)\to pp\) takes a security parameter \(k\) and returns some public parameters; \(\mathsf{KA\_gen}(pp)\to(s^{SK},s^{PK})\) generates a secret/public key pair; \(\mathsf{KA\_agree}(s^{SK}_{u},s^{PK}_{v})\to s_{u,v}\) allows a user \(u\) to combine its private key with the public key of another user \(v\) into a private shared key between them. * Authenticated Encryption [44]: \(\mathsf{AE\_enc}\) and \(\mathsf{AE\_dec}\) are algorithms for encrypting a plaintext with a public key and for decrypting a ciphertext with a secret key. * Signature Scheme [45]: \(\mathsf{SIG\_gen}\) takes a security parameter \(k\) and outputs a secret/public key pair; \(\mathsf{SIG\_sign}\) signs a message with a secret key and returns the relevant signature; and \(\mathsf{SIG\_ver}\) verifies the signature of the relevant message and returns a boolean bit indicating whether the signature is valid. * Number of node devices \(m\). * Security parameter \(k\). * Public parameter of key agreement \(pp\leftarrow\mathsf{KA\_param}(k)\). * Threshold value \(t\), where \(t<n\) and \(n\) is the number of node devices. * Input space \(\mathbb{Z}_{R}\). * Secrets sharing field \(\mathbb{F}\). * Signature key pairs \((d^{SK}_{u},d^{PK}_{u})\) of each node device, where \(u\in[1,m]\). The complete execution of the protocol between node devices and the server is provided in the following. * Round 0 (AdvertiseKeys):
* Each node device \(u\) generates secret/public key pairs of encryption and sharing algorithms \((c^{SK}_{u},c^{PK}_{u})\) and \((s^{SK}_{u},s^{PK}_{u})\). * Each node device \(u\) signs \(c^{PK}_{u}\) and \(s^{PK}_{u}\) into \(\sigma_{u}\leftarrow\mathsf{SIG\_sign}(d^{SK}_{u},c^{PK}_{u}||s^{PK}_{u})\). * The two public keys and all \(n\) signatures \((c^{PK}_{u}||s^{PK}_{u}||\sigma_{u})\) are sent to the server. * If the server receives at least \(t\) messages from individual node devices (denote by \(\mathcal{U}_{1}\) this set of node devices), then broadcast \(\{(v,c^{PK}_{v},s^{PK}_{v},\sigma_{v})\}_{v\in\mathcal{U}_{1}}\) to all node devices in \(\mathcal{U}_{1}\). * Round 1 (ShareKeys):
* Once a node device \(u\) in \(\mathcal{U}_{1}\) receives the messages from the server, it verifies if all signatures are valid with \(\mathsf{SIG\_ver}(d^{PK}_{u},c^{PK}_{u}||s^{PK}_{u},\sigma_{u})\), where \(u\in\mathcal{U}_{1}\). * The node device \(u\) samples a random element \(b_{u}\leftarrow\mathbb{F}\) as a seed for a PRG. * The node device \(u\) generates two \(t\)-out-\(\mathcal{U}_{1}\) shares of \(s^{SK}_{u}:\{(v,s^{SK}_{u,v})\}_{v\in\mathcal{U}_{1}}\leftarrow\mathsf{SS\_ share}(s^{SK}_{u},t,\mathcal{U}_{1})\) and \(b_{u}:\{(v,b_{u,v})\}_{v\in\mathcal{U}_{1}}\leftarrow\mathsf{SS\_share}(b_{u},t,\mathcal{U}_{1})\). * For each node device \(v\in\mathcal{U}_{1}\setminus\{u\}\), \(u\) computes \(e_{u,v}\leftarrow\mathsf{AE\_enc}(\mathsf{KA\_agree}(c^{SK}_{u},c^{PK}_{v}),u ||v||s^{SK}_{u,v}||b_{u,v})\) and sends them to the server.