# Flamingo: Multi-Round Single-Server Secure Aggregation with Applications to Private Federated Learning

arXiv: https://arxiv.org/abs/2308.09883 · HTML: https://mlsanity.com/paper/2308.09883/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 101 references that are in the map.
- First posted on arXiv 19 Aug 2023.

## Builds on (most cited first, 20 of 20)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [LEAF: A Benchmark for Federated Settings](https://mlsanity.com/paper/1812.01097/) (2018)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Exploiting Unintended Feature Leakage in Collaborative Learning](https://mlsanity.com/paper/1805.04049/) (2018)
- [A Hybrid Approach to Privacy-Preserving Federated Learning](https://mlsanity.com/paper/1812.03224/) (2018)
- [Federated Accelerated Stochastic Gradient Descent](https://mlsanity.com/paper/2006.08950/) (2020)
- [Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learning](https://mlsanity.com/paper/2002.04156/) (2020)
- [Eluding Secure Aggregation in Federated Learning via Model Inconsistency](https://mlsanity.com/paper/2111.07380/) (2021)
- [LightSecAgg: a Lightweight and Versatile Design for Secure Aggregation in Federated Learning](https://mlsanity.com/paper/2109.14236/) (2021)
- [FastSecAgg: Scalable Secure Aggregation for Privacy-Preserving Federated Learning](https://mlsanity.com/paper/2009.11248/) (2020)
- [Prio: Private, Robust, and Scalable Computation of Aggregate Statistics](https://mlsanity.com/paper/1703.06255/) (2017)
- [EIFFeL: Ensuring Integrity for Federated Learning](https://mlsanity.com/paper/2112.12727/) (2021)
- [Eavesdrop the Composition Proportion of Training Labels in Federated Learning](https://mlsanity.com/paper/1910.06044/) (2019)
- [RoFL: Robustness of Secure Federated Learning](https://mlsanity.com/paper/2107.03311/) (2021)
- [Efficient Differentially Private Secure Aggregation for Federated Learning via Hardness of Learning with Errors](https://mlsanity.com/paper/2112.06872/) (2021)
- [How Much Privacy Does Federated Learning with Secure Aggregation Guarantee?](https://mlsanity.com/paper/2208.02304/) (2022)
- [Lightweight Techniques for Private Heavy Hitters](https://mlsanity.com/paper/2012.14884/) (2020)
- [Efficient Private Statistics with Succinct Sketches](https://mlsanity.com/paper/1508.06110/) (2015)

## Built on by (most cited first, 17 of 17)

- [Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstruction](https://mlsanity.com/paper/2311.05808/) (2023)
- [TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning](https://mlsanity.com/paper/2501.05053/) (2025)
- [DMM: Distributed Matrix Mechanism for Differentially-Private Federated Learning Based on Constant-Overhead Linear Secret Resharing](https://mlsanity.com/paper/2410.16161/) (2024)
- [Communication-Efficient Secure Aggregation in Decentralized Learning](https://mlsanity.com/paper/2405.07708/) (2024)
- [Uncovering Attacks and Defenses in Secure Aggregation for Federated Deep Learning](https://mlsanity.com/paper/2410.09676/) (2024)
- [On the Conflict of Robustness and Learning in Collaborative Machine Learning](https://mlsanity.com/paper/2402.13700/) (2024)
- [FedPoP: Federated Learning Meets Proof of Participation](https://mlsanity.com/paper/2511.08207/) (2025)
- [From Efficiency to Leakage -- Privacy Backdoor in Federated Language Model Fine-Tuning](https://mlsanity.com/paper/2606.20553/) (2026)
- [Secure Aggregation for Privacy-Preserving Federated Learning on Clinical EEG Data](https://mlsanity.com/paper/2607.28191/) (2026)
- [EASTER: Embedding Aggregation-based Heterogeneous Models Training in Vertical Federated Learning](https://mlsanity.com/paper/2310.13367/) (2023)
- [Fluent: Round-efficient Secure Aggregation for Private Federated Learning](https://mlsanity.com/paper/2403.06143/) (2024)
- [Setup Once, Secure Always: A Single-Setup Secure Federated Learning Aggregation Protocol with Forward and Backward Secrecy for Dynamic Users](https://mlsanity.com/paper/2502.08989/) (2025)
- [Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models](https://mlsanity.com/paper/2506.17292/) (2025)
- [On Balancing Sparsity with Reliable Connectivity in Distributed Network Design with Random K-out Graphs](https://mlsanity.com/paper/2508.11863/) (2025)
- [TAPAS: Efficient Two-Server Asymmetric Private Aggregation Beyond Prio(+)](https://mlsanity.com/paper/2603.19949/) (2026)
- [Secure and Privacy-Preserving Vertical Federated Learning](https://mlsanity.com/paper/2604.13474/) (2026)
- [DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning](https://mlsanity.com/paper/2605.13708/) (2026)

## Abstract (arXiv)

This paper introduces Flamingo, a system for secure aggregation of data across a large set of clients. In secure aggregation, a server sums up the private inputs of clients and obtains the result without learning anything about the individual inputs beyond what is implied by the final sum. Flamingo focuses on the multi-round setting found in federated learning in which many consecutive summations (averages) of model weights are performed to derive a good model. Previous protocols, such as Bell et al. (CCS '20), have been designed for a single round and are adapted to the federated learning setting by repeating the protocol multiple times. Flamingo eliminates the need for the per-round setup of previous protocols, and has a new lightweight dropout resilience protocol to ensure that if clients leave in the middle of a sum the server can still obtain a meaningful result. Furthermore, Flamingo introduces a new way to locally choose the so-called client neighborhood introduced by Bell et al. These techniques help Flamingo reduce the number of interactions between clients and the server, resulting in a significant reduction in the end-to-end runtime for a full training session over prior work. We implement and evaluate Flamingo and show that it can securely train a neural network on the (Extended) MNIST and CIFAR-100 datasets, and the model converges without a loss in accuracy, compared to a non-private federated learning system.