Secure aggregation with Flower: the SecAgg+ and SecAgg++ protocols

This repository contains the code needed for experimenting with two different secure aggregation protocols in the context of federated learning with Flower: the SecAgg+ protocol and a post-quantum implementation called SecAgg++.

It comprises:

• A modified version of Flower secure aggregation example adapted to our experiments.
• The post-quantum implementation of the SecAgg++ protocol.
• A number of scripts to run experiments.
• Aggregated results of the experiments executed.

Changes with respect to the original Flower implementation

Flower secure aggregation example

The changes to the client, server and model have been made in order to adapt the original example to the MNIST dataset and to the objectives of these experiments.

Secagg++

In the folder ./secaggplusplus you can find the implementation of the SecAgg++ protocol with post-quantum cryptography.

Setup

1. Create a python environment (e.g. using miniforge/conda) and install Flower. The version of Flower used in this project is 1.29.x.

   conda create -n flower_sec python=3.12.2 -y
   conda activate flower_sec
   pip install flwr==1.29.0 

2. Install the dependencies

   cd flower-secure-aggregation
   pip install -e .

3. Force-upgrade cryptography to a version with ML-KEM support. flwr==1.29.x pins cryptography<47.0.0, which predates the mlkem module needed by the SecAgg++ post-quantum code below. Installing flwr (or pip install -e .) will always pull in a cryptography<47.0.0 release, so this step must run after the previous two, and must be repeated any time the environment is recreated:

   pip install "cryptography>=48.0.0,<49.0.0"

   This intentionally overrides flwr's declared dependency bound.
4. Install the SecAgg++ protocol inside the Flower environment. The SecAgg++ protocol is implemented in the folder ./secaggplusplus. To install it, run the following commands:

   # Set the destination directory where Flower is installed.
   DEST_ROOT=flwr
   cd secaggplusplus
   find . -type f -exec cp --parents {} "$DEST_ROOT" \;

   Note: the idea is to contribute the SecAgg++ protocol to the Flower project. Therefore, this step is only needed for the experiments in this repository. In the future, when it is integrated into Flower, it should be enough to install Flower with pip install flwr to have access to the SecAgg++ protocol.

Run with Flower in deployment mode

1. Customize the ./flower-secure-aggregation/pyproject.toml file to set the parameters of your experiment.
2. The script ./scripts/launch_supernodes.sh has a DATA_FOLDER variable. You need to set it to the MNIST dataset directory partitioned according to the number of clients you plan to start.
3. Activate your python environment (e.g. the conda environment) on all the terminals you plan to use:

   conda activate flower_sec

4. On a terminal start the SuperLink (server side):

   cd flower-secure-aggregation
   FLWR_LOG_LEVEL=DEBUG flower-superlink --insecure    

5. On another terminal start the SuperNodes (client side). In this example we start 10 SuperNodes, each one with a different client name.

   cd flower-secure-aggregation
   ../scripts/launch_supernodes.sh 00 01 02 03 04 05 06 07 08 09 

6. Then run the app in another terminal:

   cd flower-secure-aggregation
   flwr run . local-deployment --stream

Automatize the execution of multiple experiments

The script ./scripts/run_experiments.sh automatizes the execution of multiple experiments in a tmux environment. It runs the script ./scripts/start_experiment.sh for each seed in the array SEEDS. The script start_experiment.sh starts the experiment with the given seed. The script run_experiments.sh waits for the experiment to finish before starting the next one.

To run the experiments, decide the run mode (variable MODE) among no_seccagg, secaggplus and secaggplusplus. Recall also to customize the ./flower-secure-aggregation/pyproject.toml file to set the parameters of your experiments. In particular use-secagg must be set accordingly to the run mode.

Then execute the following command:

cd ./flower-secure-aggregation
tmux new-session -d -s fl_experiments
tmux send-keys -t fl_experiments "../scripts/run_experiments.sh 2>&1 | tee experiments.log" Enter
tmux attach -t fl_experiments

NOTE: this automatic execution is customized for a conda environment called flower_sec. If you are using a different environment, please change the start_experiment.sh script accordingly.

Results of the experiments

The aggregated results of the experiments executed (averaged over 20 experiments according to the seeds present in ./scripts/run_experiments.sh) are stored in the ./results folder.

License

Copyright 2026 Fondazione Bruno Kessler.

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License here.

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.