# A Review of Research on Secure Aggregation for Federated Learning
## 4 Aggregation Techniques for Federated Learning
### Secure Aggregation Algorithms
#### 4.2.3 Secure Aggregation Based on Differential Privacy
Clients report their costs as bids, and servers adopt payment strategies to maximize returns. Experimental results indicate that, under dirty label attacks, the traditional scheme suffers a 4-5% accuracy degradation, whereas this framework limits the degradation to 1-2%. In [116], the authors focus on model parameter updates and observe that these updates in federated learning involve high-dimensional, continuous values with high precision, rendering existing local differential privacy protocols unsuitable. To address this, the LDP-Fed algorithm is proposed, leveraging the exponential mechanism to handle high-dimensional, continuous, and large-scale parameter updates. Experiments on the FashionMNIST dataset demonstrate that this scheme achieves a final accuracy of 86.85%, outperforming the baseline algorithm. In [117], the impact of parameter dimensions on privacy budgets was analyzed. It was found that increasing parameter dimensions significantly inflates the privacy budget, and the larger variance induced by the perturbation mechanism degrades model performance. To mitigate this, a filtering and screening mechanism based on the exponential mechanism is proposed. This mechanism selects better parameters by evaluating their contribution to the neural network. Experiments on the MNIST dataset, with five edge nodes under non-independent and homogeneous distribution, show that each participant reduces communication costs by at least 60%, while achieving an accuracy of up to 94.63%. To balance privacy guarantees with model accuracy and practicality in differential privacy-based federated learning systems, distributed differential privacy mechanisms have been proposed in studies such as [118; 119; 120]. For instance, the work of [119] introduces a distributed differential privacy federated learning framework named Dordis, which implements a novel \"add-delete\" scheme to precisely enforce the desired noise level in each training round, even when some sampled clients drop out. Experimental results indicate that this framework achieves an optimal balance between privacy protection and model utility, while enhancing training speed by a factor of 2.4 compared to existing methods addressing client dropouts. The differential privacy schemes described above are commonly used in federated learning. In terms of accuracy, the exponential mechanism has minimal impact when its quality function is well-designed. The introduction of the Laplace mechanism may reduce accuracy by approximately 3-5%, while the Gaussian mechanism typically leads to a smaller accuracy drop of around 1-2%. Regarding communication cost, the exponential mechanism incurs extremely low overhead. The Gaussian mechanism introduces only mild noise, which allows for the use of pruning, quantization, and compression techniques, keeping communication cost controllable. In contrast, the Laplace mechanism introduces higher noise amplitude, making it unsuitable for compression; maintaining sufficient precision during transmission leads to increased communication cost. For example, Ref. [117], which employs the exponential mechanism, has the same communication cost as FedAvg. In contrast, Ref. [108], which adopts the Laplace mechanism, incurs a slight increase in communication cost, while [111], which applies the Gaussian mechanism, achieves a reduction of approximately 30%. As for computational overhead, both the Laplace and Gaussian mechanisms are relatively lightweight, while the exponential mechanism imposes a moderate computational burden. Secure aggregation schemes based on differential privacy are categorized in this paper according to their noise generation mechanisms, as shown in Table 3.