RAIN: Secure and Robust Aggregation under Shuffle Model of Differential Privacy

2026-03-03

AI Summary

This work addresses the challenge in the shuffle differential privacy (SDP) model where existing secure aggregation mechanisms struggle to simultaneously guarantee privacy, robustness against poisoning attacks, and resilience to malicious shufflers. To this end, the paper proposes RAIN, a novel framework that, for the first time, unifies privacy preservation, robustness to data poisoning, and verifiability under the SDP setting. RAIN introduces sign-space aggregation to assess update consistency and designs an additive secret-sharing protocol that enables efficient shuffling, aggregation, and integrity verification under a malicious security model. Experimental results demonstrate that RAIN achieves strong privacy and maintains convergence accuracy while reducing communication overhead by 90× and accelerating aggregation by 10×, all while enabling full tampering detection.

Technology Category

• Machine Learning: Privacy
• Multiagent Systems: Mechanism Design
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems

Abstract

Secure aggregation is a foundational building block of privacy-preserving learning, yet achieving robustness under adversarial behavior remains challenging. Modern systems increasingly adopt the shuffle model of differential privacy (Shuffle-DP) to locally perturb client updates and globally anonymize them via shuffling for enhanced privacy protection. However, these perturbations and anonymization distort gradient geometry and remove identity linkage, leaving systems vulnerable to adversarial poisoning attacks. Moreover, the shuffler, typically a third party, can be compromised, undermining security against malicious adversaries. To address these challenges, we present Robust Aggregation in Noise (RAIN), a unified framework that reconciles privacy, robustness, and verifiability under Shuffle-DP. At its core, RAIN adopts sign-space aggregation to robustly measure update consistency and limit malicious influence under noise and anonymization. Specifically, we design two novel secret-shared protocols for shuffling and aggregation that operate directly on additive shares and preserve Shuffle-DP's tight privacy guarantee. In each round, the aggregated result is verified to ensure correct aggregation and detect any selective dropping, achieving malicious security with minimal overhead. Extensive experiments across comprehensive benchmarks show that RAIN maintains strong privacy guarantees under Shuffle-DP and remains robust to poisoning attacks with negligible degradation in accuracy and convergence. It further provides real-time integrity verification with complete tampering detection, while achieving up to 90x lower communication cost and 10x faster aggregation compared with prior work.

Problem

• secure aggregation
• shuffle model
• differential privacy
• poisoning attacks
• malicious security

Innovation

• shuffle model
• differential privacy
• secure aggregation
• robustness
• secret sharing