# A Review of Research on Secure Aggregation for Federated Learning
## 4 Aggregation Techniques for Federated Learning
### Secure Aggregation Algorithms
#### 4.2.3 Secure Aggregation Based on Differential Privacy
Experimental results demonstrate that the scheme provides strong privacy guarantees while maintaining high model accuracy. Specifically, training a convolutional neural network on the MNIST dataset with 300 users, 50 communication rounds, and a high perturbation strength still achieves over 85% accuracy. In [109], recognizing that existing protection methods cannot fully safeguard user privacy during iterative global model updates in federated learning, a scheme combining differential privacy with lightweight encryption is proposed. This scheme perturbs the privacy-sensitive parameters and transmits them in ciphertext form. Trained on the MNIST dataset with a convolutional neural network, experiments show that the scheme ensures strong security in client-server interactions and achieves a model accuracy of 97.8% when the privacy budget and number of users are set to 10 and 100, respectively. In [110], federated learning is applied in an IoT environment to implement an adaptive gradient Laplace noise addition mechanism. The noise level in each round is determined by a dynamically allocated privacy budget. Experiments are conducted on the Tiny ImageNet and DeepFashion datasets, comparing the proposed method with both an equal privacy budget allocation strategy and a baseline model without privacy protection. The proposed method consistently outperforms the baseline, with the accuracy gap reaching its maximum at 50 iterations. **Gaussian mechanism**. The commonly used mechanisms in differential privacy are the Laplace mechanism and the Gaussian mechanism. However, the mean squared error of the Laplace mechanism is significantly higher than that of other mechanisms, making the Gaussian mechanism the most commonly used in federated learning based on differential privacy, e.g., [111; 112; 113; 114]. In [111], the privacy budget and communication rounds under convergence constraints are analyzed using an adaptive algorithm. Theoretical analysis is conducted to determine the optimal number of local differential privacy stochastic gradient descent iterations between any two consecutive global updates. The scheme dynamically searches for the optimal performance of differential privacy federated learning. Experiments on the MNIST, FMNIST, and CIFAR-10 datasets show that, with a privacy budget of 5.25, accuracies of 98.82%, 84.58%, and 57.25% are achieved, respectively. In [112], the local dataset is pre-partitioned into multiple subsets for parameter updates. The issue of increased parameter sensitivity is addressed through data splitting and parameter averaging operations. Experiments on the FEMNIST dataset, with a training duration of 180,000 s, demonstrate that this approach improves accuracy by 8% compared to the baseline scheme. In [113], the heterogeneous privacy requirements of different clients are explicitly modeled and exploited. The work investigates optimizing the utility of the federated model while minimizing communication costs. The proposed scheme significantly improves model utility, achieving better noise reduction and performance compared to FedAvg. In [114], to address privacy leakage caused by model parameters encoding sensitive information during training, a training scheme using global differential privacy is proposed. A dynamic privacy budget allocator is implemented to enhance model accuracy. Experimental results demonstrate that the scheme effectively improves training efficiency and model quality for a given privacy budget. **Exponential mechanism**. To select the optimal term among multiple candidate output terms and handle high-dimensional feature parameters, the application of exponential mechanisms in federated learning has been proposed, as demonstrated in [115; 116; 117]. In [115], a federated learning framework based on joint differential privacy is introduced to incentivize client participation in model training and prevent malicious participants from poisoning the model. The framework employs two game-theoretic mechanisms, formulating client selection as an auction game.