System for secure federated learning

1. A method for performing federated learning, comprising:

initializing, by a server, a global model G 0 ;

sharing, by the server, G 0 with a plurality of participants (N) using a secure communications channel;

selecting, by the server, n out of N participants, according to filtering criteria, to contribute training for a round r;

partitioning, by the server, the selected participants n into s groups;

informing, by the server, each participant about the other participants belonging to the same group;

obtaining, by the server, aggregated group updates AU 1 , . . . , AU g from each group for the round r, wherein, each participant locally uses local training data to generate a local update U i needed to obtain a local model L i from the previous global model G r-1 and wherein each participant belonging to the same group k=1, . . . , g, executes a secure aggregation protocol to combine all of their updates U 1 k , . . . , U s k , to obtain the aggregated group update AU g , wherein the local update U i includes the size d i of the local training data;

comparing, by the server, the aggregated group updates and identifying suspicious aggregated group updates probabilistically using machine learning for the round r;

combining, by the server, the aggregated group updates by assigning a weight to each group update AU 1 , . . . , AU g , averaging the weighted group updates to obtain an aggregated update U final and adding the aggregated update to a previous parameter vector, wherein the weight assigned to suspicious aggregated group updates is lower than the weight assigned to group updates that are not suspicious;

deriving, by the server, a new global model G r from the previous model G r-1 and the aggregated update U final ; and

sharing, by the server, G r with the plurality of participants.

2. The method of claim 1 , further comprising:

locally training, by each participant, a model L i using local training data;

generating, by each participant, updates U i needed to obtain a local model L i from the previous global model G r-1 ; and

running, by all participants belonging to the same group k∈{1, . . . , g}, a secure aggregation protocol to combine all of their updates U 1 k , . . . , U s k , to obtain an aggregated group update AU k .

3. The method according to claim 1 , wherein the plurality of participants is greater than 10,000.

4. The method according to claim 1 , wherein the secure communications channel is a pairwise secure channel.

5. The method according to claim 1 , wherein all communication between the server and a participant is authenticated and confidential.

6. The method according to claim 1 , wherein the s groups contain differing numbers of participants.

7. The method according to claim 1 , wherein identifying suspicious aggregated group updates is performed deterministically.

8. The method according to claim 1 , further comprising aggregating the received updates by averaging all contributions.

9. A server comprising one or more processors which, alone or in combination, are configured to provide for performance of the following steps:

initializing a global model G 0 ;

sharing G 0 with a plurality of participants (N) using a secure communications channel;

selecting n out of N participants, according to filtering criteria, to contribute training for a round r;

partitioning the selected participants n into s groups;

informing each participant about the other participants belonging to the same group;

obtaining aggregated group updates AU 1 , . . . , AU g from each group for the round r, wherein, each participant locally uses local training data to generate a local update U i needed to obtain a local model L i from the previous global model G r-1 and wherein each participant belonging to the same group k=1, . . . , g, executes a secure aggregation protocol to combine all of their updates U 1 k , . . . , U s k , to obtain the aggregated group update AU g , wherein the local update U i includes the size d i of the local training data;

comparing the aggregated group updates and identifying suspicious aggregated group updates probabilistically using machine learning for the round r;

combining the aggregated group updates by assigning a weight to each group update AU 1 , . . . , AU g , averaging the weighted group updates to obtain an aggregated update U final and adding the aggregated update to a previous parameter vector, wherein the weight assigned to suspicious aggregated group updates is lower than the weight assigned to group updates that are not suspicious;

deriving a new global model G r from the previous model G r-1 and the aggregated update U final ; and

sharing G r with the plurality of participants.

10. A non-transitory computer readable medium storing instructions that when executed by a processor cause the following steps to be performed:

initializing a global model G 0 ;

sharing G 0 with a plurality of participants (N) using a secure communications channel;

selecting n out of N participants, according to filtering criteria, to contribute training for a round r;

partitioning the selected participants n into s groups;

informing each participant about the other participants belonging to the same group;

obtaining aggregated group updates AU 1 , . . . , AU g from each group for the round r, wherein, each participant locally uses local training data to generate a local update U i needed to obtain a local model L i from the previous global model G r-1 and wherein each participant belonging to the same group k=1, . . . , g, executes a secure aggregation protocol to combine all of their updates U 1 k , . . . , U s k , to obtain the aggregated group update AU g , wherein the local update U i includes the size d i of the local training data;

comparing the aggregated group updates and identifying suspicious aggregated group updates probabilistically using machine learning for the round r;

combining the aggregated group updates by assigning a weight to each group update AU 1 , . . . , AU g , averaging the weighted group updates to obtain an aggregated update U final and adding the aggregated update to a previous parameter vector, wherein the weight assigned to suspicious aggregated group updates is lower than the weight assigned to group updates that are not suspicious;

deriving a new global model G r from the previous model G r-1 and the aggregated update U final ; and

sharing G r with the plurality of participants.

11. The computer readable medium according to claim 10 , wherein the secure communications channel is a pairwise secure channel.