Multi-Message Secure Aggregation with Demand Privacy

This paper considers a multi-message secure aggregation with demand privacy problem, in which a server aims to compute $K_{c} \geq 1$ linear combinations of local inputs from $K$ distributed and non-colluding users. The problem addresses two tasks: (1) security, ensuring that the server can only obtain the desired linear combinations without any else information about the users' inputs, and (2) privacy, preventing users from learning about the server's computation task. In addition, the effect of user dropouts is considered, where at most $K-U$ users can drop out and the identity of these users cannot be predicted in advance. We propose two schemes for $\mathrm{K}_{\mathrm{c}}=1$ and $2 \leq \mathrm{K}_{\mathrm{c}}<\mathrm{U}$, respectively. For $\mathrm{K}_{\mathrm{c}}=1$, we introduce multiplicative encryption of the server's demand using a random variable, where users share coded keys offline and transmit masked models in the first round, followed by aggregated coded keys in the second round for task recovery. For $2 \leq \mathrm{K}_{\mathrm{c}}<\mathrm{U}$, we use robust symmetric private computation to recover linear combinations of keys in the second round. The objective is to minimize the number of symbols sent by each user during the two rounds. Our proposed schemes have achieved the optimal rate region when $\mathrm{K}_{\mathrm{c}}=1$ and the order optimal rate (within 2) when $2 \leq \mathrm{K}_{\mathrm{c}}<\mathrm{U}$.