Train together. Keep each participant's model update private. Verify the result before using it.
deki-smpc brings secure multi-party computation to cross-silo federated learning. It lets a fixed group of organizations, such as hospitals or research institutes, combine locally trained PyTorch models without sending their individual model updates to the aggregation service in the clear.
The integration point is intentionally small: each participant hands its
locally trained model to FedAvgClient, waits for the other participants, and
receives a new, verified aggregate state dictionary.
deki-smpc protects the aggregation step. Training data stays at its source, model updates are masked before upload, and every participant independently checks the combined result.
In ordinary federated learning, data remains local but individual model updates may still be visible to the central coordinator. deki-smpc closes that gap with a round-based secure aggregation protocol built for stable groups of known participants.
Protocol 1.1 builds fresh private model keys in parallel blinded groups,
combines group keys through a logarithmic binary tree, and distributes one
group-encrypted aggregate key. The server adds masked updates but cannot recover
the clear aggregate. Each client unmasks and verifies it locally.
- Private individual updates: the service stores and processes masked model artifacts, not clear participant updates.
- Familiar PyTorch workflow: aggregation returns a state dictionary that
can be loaded with
model.load_state_dict(...). - Client-side trust: participants authenticate one another and reject a modified or malformed aggregate.
- Round-local security: keys, masks, and integrity material are freshly generated for every aggregation round.
- Production-minded behavior: HTTPS by default, bounded retries, one caller-controlled deadline, cancellation, and typed errors.
- Python 3.12 or newer
- PyTorch 2.13 or newer
- A running deki-smpc v1 server
- At least three enrolled participants using the same model schema
Install the client from a checkout:
python -m pip install .For development and testing:
python -m pip install -e '.[test]'The federation operator creates a round and shares its round_id with every
participating site. Each site then calls the same client API with its locally
trained model:
from datetime import timedelta
from deki_smpc import FedAvgClient
model = ... # your locally trained torch.nn.Module
with FedAvgClient(
base_url="https://aggregation.example.org",
federation_id="hospital-network",
client_id="site-a",
auth_token=site_bearer_token,
identity_private_key=site_private_key_base64,
trusted_signing_keys={
"site-a": site_a_public_key_base64,
"site-b": site_b_public_key_base64,
"site-c": site_c_public_key_base64,
},
ca_bundle="/etc/ssl/certs/federation-ca.pem",
) as client:
aggregate = client.aggregate(
model=model,
round_id=round_id,
timeout=timedelta(minutes=30),
)
model.load_state_dict(aggregate)The input model is never mutated. deki-smpc returns a new state dictionary only after its schema, artifact, digest, and aggregate integrity have been checked.
Want to see the complete workflow first? Follow the three-site MNIST walkthrough to provision a local federation, train at three participants, and run a real secure aggregation round.
| Property | Protocol 1.1 |
|---|---|
| Designed for | Cross-silo federated learning with known participants |
| Participants | Complete, fixed set of at least three sites |
| Key setup | Parallel groups plus binary reduction |
| Server result | Remains masked |
| Aggregation | Equal-weight mean or sum |
| Model artifacts | Safetensors only |
| Transport | HTTPS by default |
deki-smpc chooses sensible defaults for a PyTorch state dictionary: floating-point tensors are averaged, while integer tensors stay local. Individual tensors can opt into a different policy when needed.
| Policy | Behavior |
|---|---|
MEAN |
Equal-weight mean across all participants |
SUM |
Sum across all participants |
KEEP_LOCAL |
Preserve that site's local value; never upload it |
aggregate = client.aggregate(
model=model,
round_id=round_id,
tensor_policies={"running_total": "SUM"},
)Every participant must use the same ordered model schema, precision, policies, and participant manifest. A mismatch ends the round with a typed protocol error.
deki-smpc is split into two focused repositories:
| Repository | For | Responsibility |
|---|---|---|
deki-smpc (this repository) |
Participating sites | Protect updates and verify results |
deki-smpc-server |
Service operators | Coordinate rounds and publish aggregates |
The server is deliberately not trusted with individual clear updates. Under
protocol 1.1, it also does not learn the final clear aggregate.
- End-to-end MNIST tutorial: run a full three-participant federation locally
- Client API: configuration, callbacks, policies, and errors
- Security model: guarantees, assumptions, and trust boundaries
- Protocol 1.1: hardened group and binary-key-tree design
- Wire format 1.1: additive tree resources and artifacts
- Development: tests, tooling, and local validation
- 1.0.1 benchmark: reproducible observed preparation work and traffic model
- Changelog: releases and notable changes
deki-smpc v1 favors a simple, auditable protocol for stable federations. All committed participants must complete the round; a dropout causes the round to expire or be aborted. Aggregation is equal-weight, and input quality or model poisoning remains a federation-governance concern. See the security model for the precise guarantees and non-goals.
If deki-smpc supports your research, please cite:
B. Hamm, Y. Kirchhoff, M. Rokuss, P. Schader, P. Neher, S. Parampottupadam, R. Floca, and K. Maier-Hein, "Efficient Privacy-Preserving Medical Cross-Silo Federated Learning," IEEE Journal of Biomedical and Health Informatics, pp. 1–14, 2026. https://doi.org/10.1109/JBHI.2026.3740976
@article{hamm2026efficient,
author = {Hamm, Benjamin and Kirchhoff, Yannick and Rokuss, Maximilian and Schader, Philipp and Neher, Peter and Parampottupadam, Santhosh and Floca, Ralf and Maier-Hein, Klaus},
title = {Efficient Privacy-Preserving Medical Cross-Silo Federated Learning},
journal = {IEEE Journal of Biomedical and Health Informatics},
year = {2026},
pages = {1--14},
doi = {10.1109/JBHI.2026.3740976}
}deki-smpc is distributed under the terms of the MIT License.