# A Review of Research on Secure Aggregation for Federated Learning
## 3 Privacy-Preserving Mechanisms
### Secure Multi-Party Computation  
Secure multi-party computation (SMPC) enables multiple participants to collaboratively perform a computational task while preserving the confidentiality of their individual private data. That is, there are \(n\) participants \(\{P_{1},P_{2},\ldots,P_{n}\}\) in a mutually untrusting network. These participants aim to keep their data \(x_{i}\) private from others while collaboratively computing a function to obtain the result \(Y=(y_{1},y_{2},\ldots,y_{n})=f(x_{1},x_{2},\ldots,x_{n})\)  
SMPC encompasses cryptographic techniques with privacy-preserving properties for multiple parties, including but not limited to secret sharing, homomorphic encryption, bit commitment, zero-knowledge proofs [47], hybrid networks [48], and inadvertent transmission [49]. Current applications of SMPC in federated learning primarily involve integrating fundamental secret-sharing schemes into federated learning systems. Secret sharing is a cryptographic technique where a secret holder \(S\) divides a secret \(m\) into parts and distributes them to a group of participants \(P\{P_{1},P_{2},\ldots,P_{n}\}\); each participant \(P_{i}\) receives a corresponding share \(m_{i}\). To reconstruct the secret, only an authorized subset of participants \(A\subseteq P\) can collaboratively recover \(m\), while unauthorized participants cannot gain any information about the secret. The secret-sharing schemes applied to federated learning are described as follows:  
* **[PERSON]'s secret sharing**: In 1979, [PERSON] proposed a secret sharing scheme rooted in the Lagrange interpolation theorem. The scheme leverages polynomial operations over finite fields to securely distribute a secret among multiple parties. Specifically, the [PERSON] secret sharing scheme for \((t,n)\) works as follows: To share the secret, \(s\), a trusted dealer first selects a large prime number, \(p\), such that \(s<p\). Then, \(t-1\) random elements \(\{a_{1},a_{2},\ldots,a_{t-1}\}\) are chosen from the finite field \(\mathbb{F}_{p}\) to construct a polynomial \(f(x)=a_{0}+a_{1}x+a_{2}x^{2}+\cdots+a_{t-1}x^{t-1}\bmod p\), \(a_{0}=s\). Then, the trusted dealer selects \(n\) distinct non-zero elements \(x_{1},x_{2},\ldots,x_{n}\) from the finite field \(\mathbb{F}_{p}\), computes \(y_{i}=f(x_{i})\bmod p\), and assigns the share \((x_{i},y_{i})\) to \(P_{i}\). In the secret reconstruction phase, at least \(t\) shares from the participants are required to reconstruct the secret. The reconstruction formula is as follows: \[s=a_{0}=f(0)=\sum_{j=0}^{t-1}y_{i}\prod_{m=0,m\
eq j}^{t-1}\frac{x_{m}}{x_{m}- x_{j}}.\] (1)
* **Verifiable secret sharing**: A verifiable secret-sharing scheme is an enhancement of the traditional secret-sharing scheme, addressing the issue of malicious or deceptive behavior that may occur among participants in the traditional approach. This improvement makes the scheme more suitable for federated learning environments, where malicious clients and servers may exist. In scenarios where not all participants are necessarily honest, verifiable secret sharing allows honest participants to use cryptographic tools, such as commitment schemes or zero-knowledge proofs, to validate the consistency of secret shares provided by others. When dishonest participants are present, a verifiable secret-sharing scheme with fault-tolerance mechanisms enables the remaining participants to recover the secret value by adhering to the protocol rules. * **Additive secret sharing**: In additive secret sharing, all secret sharing processes are implemented using additive methods, where the secret \(s\) is represented as \(s=m+d\). The secret distributor assigns the secret shares \(m\) and \(d\) to the participants.