  Secure aggregation is a cryptographic protocol that securely computes the
aggregation of its inputs. It is pivotal in keeping model updates private in
federated learning. Indeed, the use of secure aggregation prevents the server
from learning the value and the source of the individual model updates provided
by the users, hampering inference and data attribution attacks. In this work,
we show that a malicious server can easily elude secure aggregation as if the
latter were not in place. We devise two different attacks capable of inferring
information on individual private training datasets, independently of the
number of users participating in the secure aggregation. This makes them
concrete threats in large-scale, real-world federated learning applications.
The attacks are generic and equally effective regardless of the secure
aggregation protocol used. They exploit a vulnerability of the federated
learning protocol caused by incorrect usage of secure aggregation and lack of
parameter validation. Our work demonstrates that current implementations of
federated learning with secure aggregation offer only a "false sense of
security".
