Aion: Robust and Efficient Multi-Round Single-Mask Secure Aggregation Against Malicious Participants

Federated learning enables multiple clients to collaboratively train a model without sharing their data. Secure aggregation (SA) allows for the computation of aggregated models while protecting the private models of clients from disclosure, making it highly promising in large-scale real-world applications. Masking-based SA stands out due to its higher efficiency and accuracy. However, existing masking-based SA methods face issues such as high overhead, loss of correctness under poisoning attacks, and inability to tolerate malicious participants. In this paper, we propose Aion, a robust and efficient multiround single-mask SA tolerating malicious participants. We introduce an aggregatable SA pattern in which each client only adds a single mask and performs only one secret sharing operation, while each aggregator only reconstructs a total secret or mask. Compared to Flamingo (S&P'23), this reduces the secret sharing times from 𝑟𝑞 to 𝑞 (𝑟 for training round number and 𝑞 for client number per round) and lowers 𝑛 aggregators' mask reconstruction overhead from 𝑂 (𝑛 2 𝑞) to 𝑂 (𝑛). Furthermore, we design a lightweight evolving input validation mechanism that efficiently filters out malicious client models by dynamically updating the mask range and overall bound, thereby improving model accuracy. Besides, we present robustness enhancements that tolerate malicious clients and aggregators. These constructions support aggregator share verification and asynchronous client model utilization. Finally, experiments demonstrate that Aion outperforms Flamingo by a factor of 563.64 in speed while achieving a 97.98% reduction in message overhead with 4096 clients and 8 aggregators, effectively defending against poisoning attacks with low overhead.