Eluding Secure Aggregation in Federated Learning via Model Inconsistency
  Secure aggregation is a cryptographic protocol that securely computes the
aggregation of its inputs. It is pivotal in keeping model updates private in
federated learning. Indeed, the use of secure aggregation prevents the server
from learning the value and the source of the individual model updates provided
by the users, hampering inference and data attribution attacks.
  In this work, we show that a malicious server can easily elude secure
aggregation as if the latter were not in place. We devise two different attacks
capable of inferring information on individual private training datasets,
independently of the number of users participating in the secure aggregation.
This makes them concrete threats in large-scale, real-world federated learning
applications.
  The attacks are generic and do not target any specific secure aggregation
protocol. They are equally effective even if the secure aggregation protocol is
replaced by its ideal functionality that provides the perfect level of
security. Our work demonstrates that secure aggregation has been incorrectly
combined with federated learning and that current implementations offer only a
"false sense of security", including the most influential and practical secure
aggregation protocols proposed by Bonawitz et al. (CCS '17) and Bell et al.
(CCS '20).
