MPC for Machine Learning: Federated Learning, Secure Aggregation, and the Confidential-Computing Trio

The natural home of secure multi-party computation in AI is collaboration: settings where several parties want to build or use a model over their combined data but none can or will hand its raw data to the others. This article shows how MPC delivers that — through federated learning with secure aggregation and through split inference across parties — and then gives the honest, threat-model-aware comparison of MPC against homomorphic encryption and trusted execution environments that has been building across two series. It closes by assembling the full confidential-computing trio, of which MPC is the third and final leg.

Federated learning and secure aggregation

Federated learning trains a shared model without centralizing the training data: each participant — a phone, a hospital, a bank — trains locally on its own data and sends only a model update to a coordinating server, which combines the updates into an improved global model and sends it back for another round. The raw data never leaves its owner. But the updates alone are not safe to expose, because an individual gradient or weight update can leak information about the specific examples it was computed from, so sending updates in the clear undermines the privacy federated learning is meant to provide.

Secure aggregation closes that gap using the secret-sharing techniques of the earlier article. Each participant secret-shares its update so that the server can reconstruct only the sum of all participants' updates — the aggregate it needs to improve the model — while learning nothing about any single participant's contribution. An individual update is masked by the shares and is never visible; only the total, over many participants, is revealed. This turns federated learning from a system that merely keeps data local into one that provably hides each participant's contribution behind the aggregate.

This is MPC in one of its most widely deployed forms. The function being securely computed is simply the sum of the updates, an additive-sharing computation that scales to very many parties, and the guarantee is exactly the MPC guarantee specialized to aggregation: reveal the sum, and nothing about the individual inputs. Combined with techniques that bound what even the aggregate can leak, secure aggregation is the backbone of privacy-preserving collaborative training across organizations and devices.

MPC for inference and training

Beyond aggregation, MPC can evaluate a whole model securely, which enables collaborative inference and training. In split inference, the model and the input are divided across two or more parties who jointly compute the prediction so that no party sees the other's contribution — a model owner and a data owner, for instance, can obtain a prediction where the model owner never sees the input and the data owner never sees the weights. This uses exactly the constructions of the earlier article: the linear layers evaluated on secret shares for low bandwidth, and the non-linear activations evaluated with garbled circuits for constant rounds, converting between representations at the layer boundaries.

The same machinery supports training a model jointly over several parties' datasets without pooling them. Split learning and secret-shared training keep the data — and often the model — distributed across the parties throughout, revealing only the final model or the agreed outputs. Because a neural network is a circuit with wide linear layers and deep non-linearities, the hybrid strategy is essential: use the low-round, low-bandwidth share evaluation where the computation is linear, and the constant-round garbling where it is not, tuning the rounds-versus-bandwidth balance to the network and the parties' connectivity.

The cost, as always with MPC, is communication. Secure inference and training exchange many messages among the parties, so their performance is dominated by network latency and bandwidth rather than raw computation, and they are most practical when the parties are well-connected. This communication cost is the signature expense that distinguishes MPC from the other confidential-computing approaches, and it is the axis on which the honest comparison turns.

MPC versus FHE versus TEEs, honestly

The three confidential-computing approaches differ most in where trust lives and what they cost, and the table makes the comparison explicit. MPC roots trust in a non-collusion assumption across several parties and pays primarily in communication; it is the natural fit when there are many mutually distrustful data owners who each hold part of the data. Homomorphic encryption roots trust in cryptography alone and pays in computation; it fits the single-client, single-server case where one party outsources a computation on its encrypted data to one untrusted server. Trusted execution environments root trust in hardware and run at near-native speed, at the price of trusting a chip vendor and accepting side-channel risk.

The decisive question is therefore the shape of the setting. When the defining feature is collaboration among several data owners — federated training across hospitals, a joint computation between companies, a model owner and a data owner — MPC's multi-party, non-collusion model is the one that fits, because the others are built for the one-party-outsourcing case. When the defining feature is a single party outsourcing to one untrusted server, homomorphic encryption or a trusted execution environment is the better match, trading MPC's communication for computation or hardware trust. The approaches are complementary, each built for a different topology of trust.

They also combine. Secure aggregation is MPC that can be strengthened with the differential-privacy noise that bounds aggregate leakage; MPC protocols can use homomorphic encryption to reduce their communication; and any of the three can run inside a trusted execution environment for defense in depth. The mature stance, echoing the FHE series, is to read the threat model and the topology honestly, place the trust where it can defensibly go, and compose the approaches when a single one leaves a gap. There is no universally best choice, only the right match of trust root and cost to the setting.

The trio complete, and the AI stakes

With MPC in place, the confidential-computing trio is complete, and the three legs divide the space of what can be done with data one is not allowed to see. Zero-knowledge proves that a computation was performed correctly without revealing its inputs — the verifiability leg. Homomorphic encryption computes on a single party's encrypted data without decrypting it — the outsourced-computation leg. Secure multi-party computation computes over several parties' private data jointly, revealing only the result — the collaboration leg. Each answers a different question, and together they cover verifiable, private, and collaborative computation.

For AI these legs are not alternatives so much as a toolbox, often used together. A confidential AI system might use MPC to train a model across organizations that cannot pool their data, homomorphic encryption or a trusted execution environment to serve that model on encrypted prompts, and a zero-knowledge proof to convince users and auditors that the promised model actually produced a given output. The legs compose because they protect different things — MPC the collaboration, FHE the outsourcing, zero-knowledge the verifiability — and a serious confidential-AI deployment reaches for whichever the threat model demands.

MPC's specific contribution is to make collaboration safe, and that is increasingly where AI's value and risk concentrate. The most valuable models will be trained on data that no single party owns and no party will surrender — clinical records across hospitals, transactions across banks, telemetry across a supply chain — and MPC is what lets those parties compute jointly without pooling, turning data that would otherwise stay siloed into a shared asset that trains better models. As the collaboration leg of confidential AI, it is the technology that lets mutually distrustful organizations build and use AI over their combined data with a cryptographic guarantee rather than a contract, which is exactly what a world of sensitive, siloed, valuable data requires. That is the note this series ends on: secure computation is not a niche curiosity but the foundation of collaborative AI, and matching MPC, FHE, and zero-knowledge to the setting is the craft of building AI systems that are private, verifiable, and collaborative at once.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

confidential_ml:
  collaboration:
    approach: mpc
    trust: non_collusion
    cost: communication
  outsourced:
    approach: [fhe, tee]
  federated_learning:
    secure_aggregation: required
  trio:
    verify: zero_knowledge
    outsource: fhe
    collaborate: mpc

Glossary

Federated learning

Training a shared model by having participants train locally and send only model updates, keeping raw data decentralized.

Secure aggregation

An MPC protocol that reveals only the sum of participants' model updates, hiding each individual contribution.

Split inference

Jointly evaluating a model across parties so no party sees another's input or weights.

Split learning

Training a model kept distributed across parties, revealing only the final model or agreed outputs.

Confidential-computing trio

Zero-knowledge (verifiability), homomorphic encryption (outsourced computation), and MPC (collaboration) — the three legs of confidential AI.

Trust root

What an approach relies on: non-collusion (MPC), cryptography (FHE), or hardware (TEE).

References

1. Bonawitz et al., Practical Secure Aggregation for Privacy-Preserving Machine Learning (ACM CCS 2017)
2. McMahan et al., Communication-Efficient Learning of Deep Networks from Decentralized Data / Federated Learning (AISTATS 2017)
3. Mohassel, Zhang, SecureML: A System for Scalable Privacy-Preserving Machine Learning (IEEE S&P 2017)
4. Knott et al., CrypTen: Secure Multi-Party Computation Meets Machine Learning (NeurIPS 2021)
5. Evans, Kolesnikov, Rosulek, A Pragmatic Introduction to Secure Multi-Party Computation (2018)