Prio: Private, Robust, and Scalable Computation of Aggregate Statistics
Student seminar: security protocols and applications - COM-506 @ EPFL, Spring 2025
Topic
Prio, a privacy-preserving system for computing aggregate statistics over sensitive client data without revealing individual data points and without sacrificing scalability. The system was presented by Corrigan-Gibbs and Boneh at NSDI 2017.
Prio combines two key cryptographic primitives:
- Secret-shared Non-Interactive Proofs (SNIPs): zero knowledge proofs that enable clients to prove the correctness of their private data without revealing it.
- Affine-Aggregatable Encodings (AFEs): encode client inputs into vectors to allow the servers to aggregate the encodings and compute complex statistics.
The system is designed to achieve:
- Privacy, as no single server ever sees raw client data;
- Robustness, as maliciously malformed data is rejected;
- Scalability, as the system introduces minimal overhead, even at large scale.
The protocol is used in various real-world scenarios:
- Collecting anonymized browser statistics (Mozilla Firefox - Next steps in privacy-preserving Telemetry with Prio).
- Federated learning and privacy-preserving machine learning (FastSecAgg: Scalable Secure Aggregation for Privacy-Preserving Federated Learning - Samplable Anonymous Aggregation for Private Federated Data Analysis).
- Secure and private telemetry in mobile devices (Exposure notification privacy-preserving analytics by Apple and Google).
Materials
Contributors
Federico Villa, Gabriele Stentella, Octave Charrin
Cyber Security Master - ETH Zurich
Acknowledgements
This work is based on the research by Henry Corrigan-Gibbs and Dan Boneh presented at NSDI 2017 (Original Paper).