Federated learning scales securely with private data and model weights
NOMAI: Scalable Federated Learning with Private Weights
Cryptography and Security
Summary
Federated learning lets many users train a shared AI model without sharing their private data, but ensuring privacy and trust at large scale is hard. The authors present NOMAI, a system that keeps user data and the shared model secret while ensuring the process is honest, even with millions of users. NOMAI uses special cryptography that lets groups of users work together securely and efficiently, making the training faster and safer. This is the first system to handle this many users with strong privacy and trust guarantees.
What this means in practice
- •For mobile app developers: Enable training large-scale AI models on user devices while keeping user data and model parameters confidential.
- •For healthcare data teams: Coordinate secure training across many hospitals without exposing sensitive patient data or the shared model weights.
Authors
Yiyi Sun, Mushtari Sadia, Amrita Roy Chowdhury
Abstract
The twin goals of privacy-preserving federated learning (FL) -- harnessing distributed data while protecting the parties who contribute it -- demands three properties: model privacy, data privacy, and integrity. Achieving all three in a realistic deployment -- with a single coordinator and millions of users -- remains an open challenge that prior work has yet to fully resolve. We present NOMAI, the first scalable MPC-based FL system to provide all three guarantees simultaneously. NOMAI operates under an honest-majority assumption in the semi-honest model, with an extension to the malicious-with-abort setting. At its core, NOMAI combines a multi-committee MPC architecture with packed Shamir secret sharing, enabling SIMD-style secure computation that scales far beyond what monolithic n-party protocols can support. We further introduce ML-aware optimizations and new cryptographic primitives that substantially reduce per-user overhead. Our evaluation shows NOMAI is practically deployable at unprecedented scale: it reduces per-user computation to just <350 ms (semi-honest) and <700 ms (malicious) for per iteration of training MNIST, achieving three orders-of-magnitude improvements over prior work while seamlessly supporting populations of over 106 users. This demonstrates, for the first time, that MPC-based FL can meet the scale demands of real-world systems without compromising on privacy or integrity.