# A Review of Research on Secure Aggregation for Federated Learning
## 4 Aggregation Techniques for Federated Learning
### Secure Aggregation Algorithms
#### 4.2.1 Secure Aggregation Based on Homomorphic Encryption  
In federated learning, honest-but-curious servers may attempt to infer private data from the model information uploaded by users. Homomorphic encryption allows servers to perform aggregation without decryption, preventing access to the original data. Secure aggregation based on homomorphic encryption typically involves a four-step process:  
1. Each user locally encrypts the trained model using homomorphic encryption to obtain \(Enc(x_{i})\), where \(x_{i}\) represents the trained model data. The encrypted data is then uploaded to the server. 2. The server performs the aggregation operation directly on the encrypted data to obtain the global model. 3. The user downloads the global model. 4. The user decrypts the global model locally using their private key. The schematic diagram of the aggregation process is shown in Figure 9.  
Secure aggregation based on homomorphic encryption in federated learning is realized through underlying cryptosystems. Currently, there are three main types of encryption schemes based on cryptosystems, as follows:  
**Partially homomorphic encryption**. Partially homomorphic encryption is now widely used in secure aggregation for federated learning [65; 66; 67; 68; 69; 70; 71; 72]. Among these, Paillier cryptosystems are employed in studies [65; 66; 67; 68; 69; 70; 71; 72], where various schemes process data differently to improve model performance and reduce communication overhead. For instance, in [71],  
Figure 9: Schematic diagram of the homomorphic encryption-based secure aggregation process. gradients are selected and quantized using batch cropping to reduce communication overhead. Experiments on the MNIST and CIFAR-10 datasets with 50 edge nodes demonstrate that the proposed scheme achieves higher accuracy than plaintext models, with the single aggregation time on the MNIST dataset ranging from 0.01 s to 0.10 s, indicating a significant improvement in communication efficiency. In [72], a federated learning scheme that integrates gradient compression and homomorphic encryption techniques is proposed to reduce the communication overhead on the client side through gradient compression, while preventing gradient privacy leakage. Security is enhanced by introducing noise, encrypting, and signing the aggregated model before uploading it to the aggregation server. Experimental results on the CIFAR-10 dataset show that gradient compression reduces data transmission and helps preserve privacy, albeit at the cost of slightly reduced accuracy. When the compression rate reaches 50%, the model achieves an accuracy of 89.12%, which is comparable to the uncompressed model's accuracy of 89.15%. A lightweight secure aggregation scheme based on ElGamal homomorphic encryption is proposed in [73]. This scheme integrates federated learning into the deep learning of medical models for IoT-based healthcare systems. Employing cryptographic primitives such as masking and homomorphic encryption enhances local model protection, preventing attackers from inferring private medical data through model reconstruction or inversion attacks. Experimental results show that this approach improves communication efficiency by over twofold compared to baseline algorithms and achieves 99.1% accuracy on MNIST after 506 training rounds. The scheme presented in [76] employs the Joye-Libert partially homomorphic encryption system to implement an additive homomorphic encryption scheme. Its core involves secure multi-party global gradient computation based on active user data, demonstrating low communication overhead and robustness against user dropouts. To mitigate risks posed by malicious participants colluding with the server to compromise other participants, a federated learning framework combining the Rivest-Shamir-Adleman (RSA) algorithm with Paillier encryption is proposed in [77]. In terms of accuracy, this scheme achieves performance equivalent to unencrypted models after 30 training rounds on the MNIST dataset.