Confidence-calibrated federated graph attention for internet of things agents under latency SLOs.

Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice Sci Rep . 2026 Mar 28;16:10792. doi: 10.1038/s41598-026-45662-3 Search in PMC Search in PubMed View in NLM Catalog Add to search Confidence-calibrated federated graph attention for internet of things agents under latency SLOs Dong Yang Dong Yang 1 Department of Academic Affairs Office, Jilin Engineering Normal University, No. 3050, Kaixuan Road, Kuancheng District, Changchun, 130052 China Find articles by Dong Yang 1, ✉ , Baixiang Liu Baixiang Liu 2 Department of Institution of Education Science, Jilin Engineering Normal University, Changchun, 130052 China Find articles by Baixiang Liu 2 , Liyong Wan Liyong Wan 1 Department of Academic Affairs Office, Jilin Engineering Normal University, No. 3050, Kaixuan Road, Kuancheng District, Changchun, 130052 China Find articles by Liyong Wan 1 , Qiming Dong Qiming Dong 3 Department of School of Data Science Artificial Intelligence, Jilin Engineering Normal University, Changchun, 130052 China Find articles by Qiming Dong 3 Author information Article notes Copyright and License information 1 Department of Academic Affairs Office, Jilin Engineering Normal University, No. 3050, Kaixuan Road, Kuancheng District, Changchun, 130052 China 2 Department of Institution of Education Science, Jilin Engineering Normal University, Changchun, 130052 China 3 Department of School of Data Science Artificial Intelligence, Jilin Engineering Normal University, Changchun, 130052 China ✉ Corresponding author. Received 2025 Nov 5; Accepted 2026 Mar 20; Collection date 2026. © The Author(s) 2026 Open Access This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by-nc-nd/4.0/ . PMC Copyright notice PMCID: PMC13039364  PMID: 41904251 Abstract Internet of Things (IoT) agents that trigger network enforcement actions must be both well-calibrated (for safe triage) and tail-latency predictable (for service level objectives, SLOs). We present Confidence-Calibrated HP-FedGAT-Trust-IBN, a federated, graph-attention architecture that closes the loop from IoMT sensing to SDN enforcement via parameter-efficient (LoRA/PEFT) updates ( MB/round), trust-weighted secure aggregation, and intent verification (IBN) triage. Evaluation follows a two-plane protocol: a learning plane with simulated clients under a matched comparator harness (Graph-FL and uncertainty-aware FL baselines), and a serving plane that replays exported checkpoints on real edge devices (Raspberry Pi 5, Jetson Orin Nano, Intel NUC 11) and validates SLOs using hardware ECDFs and empirical . The model achieves high discrimination (ROC-AUC/PR-AUC – ) with improved calibration (low ECE) under the matched harness, while the serving loop satisfies the ms requirement by device-measured (e.g., enforcement ms, vs. ms for an efficient-UQ baseline) and explicit compliance . The latency decomposition includes all calibration costs and Monte-Carlo expectations ( , with measured MC share reported), and security modes are quantified end-to-end: CKKS + SMPC adds device-measured and crypto-attributable Joules (e.g., ms and J/round on Raspberry Pi 5). Energy/round is measured on identical hardware and mapped to CO 2 e for carbon-aware selection of operating points. Keywords: Internet of Things, Federated learning, Graph attention networks, Confidence calibration, Latency SLO compliance, Intent-based networking (IBN) Subject terms: Engineering, Mathematics and computing Introduction The rise of the Internet of Medical Things (IoMT) is revolutionizing healthcare with continuous monitoring and proactive interventions 1 , 2 . However, managing real-time, trust-sensitive analytics across decentralized, heterogeneous device ecosystems poses unique challenges in bandwidth, non-IID data, privacy, and latency. Traditional Federated Learning (FL) models, though promising for privacy preservation, struggle to mitigate communication bottlenecks and offer limited trust modeling in safety–critical IoMT environments 3 , 4 . Similarly, Graph Neural Networks (GNNs), especially Graph Attention Networks (GATs), excel at relational modeling in IoT settings, but most prior work focuses separately on federated aggregation or anomaly detection, without integrating trust inference or policy enforcement 5 . Moreover, although Intent-Based Networking (IBN) has advanced agile, AI-driven policy management in complex networks 6 , 7 , it has yet to be combined with distributed ML frameworks for trust-aware decision-making in IoT contexts 8 . This fragmentation leaves a gap: there is currently no unified, high-performance framework that merges federated GAT learning, explainable trust inference, communication-efficient compression, and IBN-driven real-time policy enforcement tailored to IoMT’s stringent requirements. To address this, we propose HP-FedGAT-Trust-IBN, a novel framework integrating: Federated GAT for scalable, edge-based relational modeling 9 ; Attention-derived trust inference with diagnostic metrics (entropy, Gini) for operational transparency; communication-aware compression (quantization, sparsification) to minimize per-round overhead; privacy-preserving aggregation via DP-SGD 10 and secure masking; intent-based automated policy enforcement (e.g., slice reallocation, rate-limiting, quarantine) and low-latency-aware operations optimized for real-world IoMT communications 11 . This architecture is the first to integrate graph-based trust inference with intent-driven orchestration for AI-powered IoT communications. We propose a confidence-calibrated federated graph-attention (FedGAT) framework for intent-verified IoT agents that treats calibration—not just accuracy—as the first-class signal that drives both learning and SLO-aware operation. Concretely, we pair a GAT backbone with a temperature- and entropy-regularized calibration head and trust-aware normalization; we propagate calibrated confidence into (i) trust-weighted aggregation on the server to temper non-IID client drift and (ii) an SLO orchestrator that performs confidence-gated admission and queue shaping to bound tail latency under 50/100-ms deadlines. The study spans heterogeneous IoT intrusion and clinical/telemetry workloads, evaluates communication-efficient FL regimes (8-bit, Top-k, hybrid) under privacy (DP-SGD with Rényi accounting, secure aggregation, CKKS/SMPC), and reports primary endpoints that explicitly include calibration (ECE) alongside discrimination, p99-bounded compliance/throughput, and accuracy–communication–privacy frontiers; secondary endpoints cover cross-domain transfer, robustness to label-flip/poison/backdoor, fairness across clients, and transparency via attention-entropy, head-diversity, and Shapley agreement. This design is motivated by evidence that modern networks are often miscalibrated and that temperature/post-hoc calibration improves reliability, especially under distribution shift; recent work shows calibration matters for GNNs and is emerging as a key concern in federated settings, while SLO/tail-latency theory explains why confidence-aware gating can reduce high-percentile delays—together justifying calibration as the organizing principle for trustworthy, bounded-latency IoT FL. Background Federated learning in IoT ecosystems Federated Learning enables collaborative model training across decentralized devices, preserving privacy and reducing communication costs, making it well-suited for large-scale IoT networks 12 . Despite these advantages, IoT deployments present FL with significant challenges such as statistical heterogeneity, intermittent connectivity, and compute-constrained devices 13 . Graph attention networks for relational IoT data IoT deployment often involves interconnected devices and spatiotemporal interactions that naturally form graphs. GATs enhance GNNs by learning adaptive attention weights for neighbor contributions, enabling precise aggregation based on relational importance 14 . While FL-enabled GATs have been applied in domains like intrusion detection, their use in generating trust scores for policy enforcement remains unexplored. Privacy, robustness, and interpretability in FL-based IoT Privacy concerns and adversarial vulnerabilities remain critical for IoT applications. Techniques like Differential Privacy 15 , Secure Aggregation 16 , and Homomorphic Encryption 17 safeguard client data during model aggregation. Interpretability—especially in trust-sensitive environments—is enhanced via diagnostic metrics that quantify attention distribution (e.g., entropy, Gini), supporting traceability and explainability. Communication constraints in IoT big data IoT applications are characterized by bandwidth limitations and low-latency requirements. Techniques such as quantization and sparsification are critical for reducing communication overhead without compromising model convergence or accuracy 17 . Intent-based networking for AI-driven networks Intent-Based Networking (IBN) enables administrators to define high-level network goals (e.g., low latency for critical sensors), which are automatically translated into enforceable policies through AI-driven orchestration layers 18 . Although IBN offers agility and scaling advantages, its integration with distributed learning models for IoT has not been thoroughly investigated. Synthesis of research gaps A clear gap spans three layers: models, federation, and systems. At the model layer, deep nets—and GNNs in particular—remain miscalibrated, with most work treating calibration as a post-hoc fix (e.g., temperature scaling) rather than a first-class training signal; emerging GNN-specific methods show promise but still struggle to balance accuracy and calibration or to generalize across graphs and shifts 19 . At the federation layer, non-IID heterogeneity, partial participation, and privacy layers (DP/HE/SecAgg) interact in poorly understood ways with calibration: comprehensive surveys emphasize non-IID as a core failure mode, recent studies find DP-SGD can worsen miscalibration (and fairness for minority groups), yet there is little on calibration-aware aggregation or privacy budgets that explicitly preserve ECE. At the systems layer, SLO/tail-latency control (queue shaping, deadline-aware scheduling, token/leaky buckets, bandwidth headroom) is advancing, but confidence is not routinely embedded into admission and shaping policies; coupling calibrated confidence with SLO controllers to bound p95–p99 latency remains underexplored for edge FL. Finally, while communication-efficient FL via quantization/sparsification is well studied, its effect on calibration—especially under federated, private, and cross-domain settings—has mixed or inconclusive evidence and lacks principled, calibration-preserving designs. These gaps motivate a confidence-calibrated FedGAT that (i) optimizes calibration during training, (ii) propagates calibrated confidence into aggregation and privacy accounting, and (iii) drives SLO-aware admission/queueing to deliver trustworthy, bounded-latency IoT decisions at the edge. Related work Federated graph attention in healthcare IoT Recent efforts have explored federated graph learning to model relational structures in decentralized healthcare data. For instance, FD-GATDR uses a decentralized federated GAT for doctor recommendation, achieving AUC improvement over flat-feature baselines 20 . Similarly, AGAT (Augmented Temporal Graph Attention Networks) addresses feature-view heterogeneity in EHR datasets by aligning embeddings across decentralized clients, demonstrating improved model performance under domain shifts 21 . A new FedGAT approximation enables federated GAT-style learning with provable error bounds and significantly reduced communication overhead by approximating attention behaviors with one pre-communication step 22 . These models, however, do not explicitly integrate trust inference, intent-oriented policy enforcement, or interpretability diagnostics—key innovations of HP-FedGAT-Trust-IBN. Federated learning in IoT healthcare Federated learning (FL) has become a pivotal approach in privacy-preserving IoT healthcare systems. Reviews highlight FL’s potential for real-time analytics with compliance to data autonomy and regulatory mandates 23 . Architectures combining FL with blockchain (e.g., FedBlockHealth, and similar fog-IoT platforms) provide enhanced trust, immutable aggregation, and identity management, although they often incur considerable infrastructure overhead and lack graph-aware attention mechanisms 24 .Other studies focus on resource-constrained IoT setups by optimizing model complexity and local training strategies on devices, particularly for intrusion detection systems (IDS) under federated configurations 5 . Privacy and robustness in federated graph models Ensuring privacy and adversarial resilience has motivated complementary developments in DP and secure learning. Local Differential Privacy (LDP) has been proposed for federated graph neural networks to mitigate inference attacks while preserving accuracy 25 . Standard FL variations, such as FedAvg, while convenient, are sensitive to non-IID data and adversarial manipulation. Our framework uniquely integrates DP-SGD, secure aggregation, and attention-based trust weighting in GAT pipelines, offering stronger privacy guarantees and robustness by design—without imposing heavy blockchain or computational overhead. Intent-based networking in IoT IBN seeks to automatically translate high-level policies into network configurations. While IBN is increasingly adopted in enterprise SDN environments for dynamic policy enforcement, its application within federated learning pipelines for healthcare IoT trust control is novel. HP-FedGAT-Trust-IBN introduces trust-scored attention outputs as inputs for dynamic policy generation, enabling network-level enforcement of trust decisions in real time—a unique capability not present in prior works. Proposed system The proposed system implements a closed-loop, edge-to-cloud control pipeline in which IoMT sensors and actuators stream to an edge HP-FedGAT + Trust node, whose outputs traverse the network/QoS plane to a cloud aggregator, followed by intent verification with an IBN layer and finally SDN enforcement, with action feedback closing the loop for continual adaptation and governance. Serving performance is reported using strict, systems-style conventions: serving-plane latency SLOs are validated on real hardware and summarized using empirical p99 and SLO compliance (e.g., ms), while any worst-case latency bounds—if computed—are reported separately and explicitly labeled as bounds, and are never conflated with measured percentiles. Figure 1 depicts a closed-loop, edge-to-cloud control architecture in which IoMT sensors/actuators stream into an edge HP-FedGAT + Trust node that simultaneously performs local inference and uncertainty-aware, dynamic-graph attention, then exports only parameter-efficient deltas (LoRA/PEFT) plus trust statistics to limit bandwidth while preserving privacy 26 – 30 . The cloud aggregator’s secure aggregation and optional DP/split-learning toggles (together with trust-weighted aggregation) operationalize “confidence as a first-class signal,” meaning that model updates and downstream actions are conditioned not only on utility but also on calibrated uncertainty and trust estimates 29 , 31 – 33 . In this flow, the intent-verification/IBN stage explicitly turns the learned policy into a checked, triaged decision artifact before SDN enforcement executes actions (e.g., quarantine, micro-segmentation, QoS/slicing) and returns feedback, aligning with modern secure-by-construction IoT/edge governance patterns where verification and enforcement are separated yet tightly coupled 33 – 37 . Fig. 1. Open in a new tab Confidence-calibrated federated graph-attention architecture for intent-verified IoT agents with serving-plane latency SLO evaluation and a matched comparator harness. IoMT sensors/actuators feed an edge HP-FedGAT + Trust node that performs sensing/preprocessing ( ), local inference ( ), and confidence-calibrated dynamic-graph multi-head attention (layer-norm/residuals) with uncertainty/trust readouts (e.g., attention entropy , trust , robust-fidelity). Parameter-efficient updates are exported as LoRA/PEFT deltas plus trust statistics ( ) through the network/QoS plane to a cloud aggregator that supports secure aggregation (optional DP/split learning) and trust-weighted global updates ( compression), producing a candidate policy with confidence. An intent-verification/IBN layer performs policy synthesis and mathematical checks with triage (accept/review/reject; ), and the SDN enforcement plane executes verified actions (quarantine/micro-seg/QoS/slicing; ) and closes the loop via action feedback. Serving-plane latency is evaluated on hardware as empirical (any worst-case bound is shown only if computed) and reported as latency SLOs and , alongside end-to-end latency ( ). The metrics panel summarizes utility (AUC ; accuracy ), calibration/UQ (ECE/NLL/Brier plus selective risk), trust ( ), robust fidelity ( ), and communication footprint ( ; compression). To ensure fair, up-to-date comparisons, a Comparator & Benchmark Harness plugs in alternative model families and aggregation strategies and evaluates modern Graph-FL baselines (FedGraphNN, FedSage + , GCFL/GCFL +) and uncertainty-aware FL baselines (e.g., pFedBayes; MC-dropout/SWAG; Dirichlet/evidential UQ) under a controlled protocol with matched parameter/PEFT budgets, matched bandwidth (MB/round) and compute, identical client partitions and non-IID severity, and identical DP/secure-aggregation toggles where applicable. The figure’s “results panel” emphasizes that model quality and operational reliability are evaluated jointly: it reports high utility alongside calibration/UQ metrics (ECE/NLL/Brier and selective-risk) and trust/robust-fidelity indicators, reflecting current best practice that calibrated confidence and abstention/triage behavior are essential for safety–critical deployments rather than optional add-ons 33 , 38 – 41 . The serving-plane is treated as a first-order constraint by measuring latency on hardware using empirical p99 and reporting explicit SLO attainments, which matches the broader systems literature arguing that tail latency and SLO compliance must be assessed end-to-end (including network variability) for edge inference services 27 , 35 , 42 – 44 . Finally, the matched “Comparator & Benchmark Harness” (controlling PEFT budget, bandwidth/round, compute, partitions, non-IID severity, and DP/secure-aggregation toggles) is an important methodological claim: it reduces confounding so that gains attributed to confidence calibration, trust weighting, or graph-FL choices are more likely to be causal rather than artifacts of unequal system budgets 26 , 28 , 29 , 34 , 45 . Edge perception: confidence-calibrated dynamic-graph multi-head attention. Notation (consistent across equations) Dynamic graph at time : . Node features and hidden state . Neighborhood (may be dynamic). Attention heads . Attention weights , logits , and attention temperature (temperature symbol is separated from trust to avoid notation collisions). Attention entropy and normalized entropy . Trust score (node/client level) and robust-fidelity proxy . Client PEFT delta , transmitted message . Message budget MB/round and compression factor (when configured). Serving latencies: sensing , inference , verification , enforcement action , queue , transmit , processing , and isolation latency . Equation ( 1 ) Node update (confidence-calibrated GAT) 1 where is the active-head set (Eq. 7 ), , and is a nonlinearity (e.g., or ). Equation ( 2 ) Attention logits and confidence-reweighted softmax 2 where is a neighbor reliability/confidence scalar (Eq. 3 ). Equation ( 3 ) Neighbor confidence from uncertainty and robust-fidelity 3 where is a normalized uncertainty proxy (e.g., entropy of a node-level predictive distribution or local attention entropy), is a robust-fidelity proxy (higher is better), and controls robustness contribution. Equation ( 4 ) Local attention entropy (uncertainty readout) 4 Equation ( 5 ) Entropy-aware temperature scheduling 5 Higher uncertainty (larger entropy) increases to avoid brittle, over-peaked attention. Equation ( 6 ) Residual + (pre)norm stabilization 6 Equation ( 7 ) Active-head sparsification (compute/latency lever) 7 where is a head-importance score; reducing reduces edge compute in while preserving performance via confidence-calibrated attention. Federated optimization: PEFT/LoRA + optional DP + trust-weighted aggregation. Equation ( 8 ) PEFT/LoRA parameterization (client ). For layer : 8 Client sends only PEFT deltas (and trust statistics), not full . Equation ( 9 ) DP-SGD local update (optional) 9 where privacy parameters are reported as via an accountant and sets noise scale. Equation ( 10 ) Budgeted compression and message size (uplink) 10 sparsifies and quantizes to bits. Equation ( 11 ) Client trust score (aggregator input) 11 where is client trust, an uncertainty proxy, and a data-quality proxy. Equation ( 12 ) Trust-temperature weighting 12 Equation ( 13 ) Trust-weighted secure aggregation (server) 13 Secure aggregation and optional DP are applied in transport/aggregation; split learning may be enabled. Equation ( 14 ) Communication efficiency (reporting) 14 Trust uplift, explainability, robustness diagnostics. Equation ( 15 ) Explanation-aware trust penalty (local sensitivity) 15 down-weighting trust when local representations are unstable. Equation ( 16 ) Context boost (sensor/health priors) 16 Equation ( 17 ) Attention sharpness/dispersion (Gini) 17 Equation ( 18 ) Counterfactual stability proxy 18 where removes the top- trusted neighbors; lower is more stable. Intent verification (IBN) and SDN enforcement. Equation ( 19 ) Candidate policy confidence for verification 19 Equation ( 20 ) IBN triage rule (accept / review / reject) 20 Equation ( 21 ) Trust-aware QoS / slice allocation (example) 21 allocating bandwidth/slicing weight to flows with higher priority , trust , and context . Serving-plane latency, communication, and SLO reporting (hardware). Equation ( 22 ) Serving-loop latency decomposition 22 Equation ( 23 ) Empirical ECDF and (serving plane). Given samples : 23 Equation ( 24 ) SLO compliance probability (explicit) 24 Equation ( 25 ) Communication time model (reported separately from empirical ) 25 where is effective throughput efficiency (protocol overhead, loss, etc.). Worst-case bound policy: if a network-model bound is computed, it must be plotted/reported separately from empirical percentiles and explicitly labelled as a bound. Equation ( 26 ) Multi-objective training/selection objective (learning plane) 26 Equation ( 27 ) Energy and carbon mapping (learning plane reporting) 27 where is an externally stated emissions factor. Equation ( 28 ) Reported system metrics. Report jointly: utility (AUC/Acc), calibration (ECE/NLL/Brier and selective risk), trust and robust-fidelity, end-to-end latency, and communication footprint. Privacy accounting and adversarial robustness (summary equations). Equation ( 28 ) Sensitivity proxy for DP noise scaling 28 Equation ( 29 ) DP-regularized objective (optional) 29 Equation ( 30 ) Adversarial score (budget ) 30 Equation ( 31 ) Trust-bounded risk ceiling (deployment guardrail) 31 Empirical tail-latency SLO criterion (hardware)” (serving plane). Equation ( 32 ) Empirical tail-latency SLO condition (hardware) 32 This condition is satisfied only by hardware-measured distributions; any worst-case bound is additional and separately labelled. Experimental methods We evaluate Confidence-Calibrated HP-FedGAT-Trust-IBN as an end-to-end, closed-loop IoT agent pipeline that flow: IoMT sensing edge confidence-calibrated graph attention + trust readouts PEFT/LoRA delta export ( ) cloud secure/trust-weighted aggregation ( compression when enabled) intent verification (IBN) triage SDN enforcement + feedback, with serving-plane latency SLOs validated on hardware using empirical (and any worst-case bound shown only if computed). The experimental design follows a two-plane protocol consistent with: (i) a learning plane for federated training and algorithmic comparisons under a matched comparator harness, and (ii) a serving plane that replays exported checkpoints in a controlled runtime harness on named edge devices and reports tail-latency ECDFs, , and SLO compliance. Data, splits, and federation setup (matched harness) Experiments use three IoT domains consistent with the reported evaluations: CICIoMT-2024, ICU-IoT, and Wearable-IoT. For learning-plane studies, we run federated simulations with clients using fixed partitions/splits (client assignment held constant across methods) and multi-seed repeats (10 seeds; mean 95% CI). To stress federation dynamics, we sweep: (i) per-round participation fraction ( ), (ii) non-IID severity via Dirichlet label skew ( ; lower = more skew), and (iii) dropout under both random dropout (up to 0.4) and bursty dropout (correlated availability shocks), consistent with the heterogeneity tests in Fig. 6 . All comparisons are executed under a matched comparator harness: identical client partitions, identical numbers of rounds, and matched model budgets (parameter/backbone or PEFT budget), bandwidth constraints, and privacy/security toggles where applicable. Fig. 6. Open in a new tab Federated heterogeneity stress tests (learning plane): participation, non-IID severity, dropout, client fairness, and energy under heterogeneity (with Graph-FL and UQ-FL baselines). a AUC vs. participation rate. Utility versus per-round participation fraction. b Calibration vs. participation rate. ECE/NLL versus participation fraction to assess uncertainty stability. c Non-IID severity sensitivity. AUC and ECE versus Dirichlet (heterogeneity), with slope/area summaries. d Random dropout robustness. Utility/calibration versus random dropout rate. e Bursty dropout robustness. Utility/calibration recovery under correlated availability shocks. f Client fairness. Jain’s index and per-client variance of utility/calibration. g Cost–accuracy under heterogeneity. MB/round versus AUC (and calibration overlays) under heterogeneity regimes. h Energy under heterogeneity. J/round (and optional mapping consistent with Fig. 3 d) under heterogeneity sweeps, computed on identical hardware for all methods and baselines. Model family and update budget At the edge, HP-FedGAT-Trust-IBN performs confidence-calibrated dynamic-graph multi-head attention with stabilization (layer-norm/residual structure) and produces uncertainty/trust readouts (e.g., attention entropy , trust , robust-fidelity proxy). Clients export parameter-efficient updates as LoRA/PEFT deltas plus trust statistics, enforcing a strict uplink budget . The cloud aggregator performs secure aggregation with optional DP and split-learning toggles and applies trust-weighted aggregation. The intent-verification layer (IBN) performs policy synthesis + mathematical checks and triages outcomes (accept / review / reject) before SDN enforcement executes quarantine / micro-segmentation / QoS / slicing and closes the loop with action feedback. Baselines (Graph-FL, UQ-FL, and quantization-only bit-matched) All primary comparisons use the baseline pool defined by the matched harness: Modern Graph-FL, FedGraphNN, FedSage + , GCFL/GCFL + and Uncertainty-aware FL: Bayesian pFedBayes, FedEE, Dirichlet/evidential UQ baselines. For efficiency frontiers, we additionally include quantization-only FL baselines (QSGD, FedPAQ) evaluated at identical bit-budget, explicitly isolating quantization effects from PEFT/sparsification. Learning-plane measurements (utility, calibration, transfer, heterogeneity) Learning-plane evaluation reports discrimination (ROC-AUC, PR-AUC and/or AUC, depending on panel) and calibration/UQ (ECE and, where applicable, NLL/Brier and selective-risk style summaries). Efficiency–utility trade-offs are evaluated as Pareto frontiers over AUC vs MB/round and ECE vs MB/round, with multi-seed repeats and 95% ribbons (Fig. 3 a–b). Domain-transfer robustness follows the paired protocol in Fig. 4 , reporting paired in-domain vs transfer AUC and paired calibration shift ( ECE), plus leave-one-domain-out generalization where applicable. Federated heterogeneity stress tests follow: AUC/ECE vs participation, AUC/ ECE vs Dirichlet , robustness under random and bursty dropout, and client fairness using Jain’s index and per-client dispersion. Communication–accuracy behavior under heterogeneity is reported as MB/round vs AUC with calibration overlays. Fig. 3. Open in a new tab Joint Pareto frontiers over communication, compute, wall-clock energy, and carbon footprint (learning plane), including quantization-only FL baselines at identical bit budget. a Utility–communication Pareto frontier. Predictive utility (AUC) versus uplink MB/round across compression regimes, with multi-seed repeats and 95% CI ribbons. b Calibration-aware frontier. Calibration ( ECE and/or NLL/Brier) versus MB/round, identifying operating points that improve calibration at matched bandwidth. c Wall-clock energy on identical hardware. Energy/round (J/round) measured for all methods and baselines on the same hardware (edge device(s) ), with Joules computed by integrating an instrumented power trace during training/aggregation steps for each regime at matched budgets. d Carbon footprint mapping. Energy from (c) is converted to using a stated electricity emissions factor (reported in or ) from an authoritative source; the legend reports the factor and location convention used, enabling carbon-aware comparison of frontier points. Fig. 4. Open in a new tab Domain-transfer robustness (learning plane): AUC/ ECE under transfer and sensitivity to shift magnitude, with matched Graph-FL and UQ-FL baselines. a In-domain vs. transfer AUC (paired). Paired in-domain and cross-domain AUC across seeds for each method. b Transfer calibration shift. Paired ECE (and/or NLL) under transfer, directly testing uncertainty quality under domain shift. c Transfer loss vs. shift magnitude. AUC and ECE regressed against a quantified shift metric (e.g., MMD/Wasserstein), with 95% CIs and sensitivity slopes. d Leave-one-domain-out generalization. Train on (All ), test on , with multiple-comparison correction per the evaluation protocol. Serving-plane hardware harness and latency SLO validation ( on devices) All latency claims are validated only in the serving plane (Figs. 2 and 8), using checkpoints exported from learning-plane training and replayed in a controlled runtime harness on named edge devices: D1, Raspberry Pi 5 (4 Cortex-A76 @2.4 GHz, 8 GB, Raspberry Pi OS 64-bit/Debian 12); D2, NVIDIA Jetson Orin Nano (6 Cortex-A78AE, 8 GB, Ubuntu 22.04/JetPack 6.x) and D3, Intel NUC 11 (i5-1135G7, 16 GB, Ubuntu 22.04). Serving-plane metrics include ECDFs for enforcement latency and isolation latency , and report explicitly. SLO compliance is defined and reported as computed directly from measured ECDFs for targets . Concurrency sweeps scale concurrent intents and are used to assess tail behavior and throughput under bounded tail latency. decomposition separates queue/transport/processing components; critically, includes all calibration computations and the Monte-Carlo expectations required by Eq. ( 18 ) with samples, and the MC share is attributed within . Any worst-case bound derived from a network model is plotted/reported only if computed and is always separately labeled, never substituted for empirical percentiles. Fig. 2. Open in a new tab Confidence-calibrated HP-FedGAT-Trust-IBN improves predictive utility (learning plane) and validates serving-loop SLO compliance (serving plane) under a matched Graph-FL + UQ-FL comparator harness. a Learning-plane predictive utility and calibration (simulation). Federated simulation with simulated clients (fixed cross-site/device partitions) under controlled sweeps over non-IID severity, participation, and dropout, reporting discrimination (ROC-AUC, PR-AUC) and calibration (ECE; and where shown NLL/Brier) with multi-seed repeats and bootstrap confidence intervals; these results do not support the latency claim. b Serving-plane latency ECDFs (hardware). Empirical ECDFs for enforcement latency and isolation latency measured in a controlled edge-runtime harness using checkpoints exported from (a), evaluated on edge device(s) under concurrency sweeps. c Loop decomposition + formal interpretation of the inequality. is decomposed into queue/transmit/process components; includes all calibration computations and any Monte Carlo expectations required by Eq. 18 , using samples, with the measured wall-clock share attributed to the MC term. The inequality is reported as (i) empirical validation from measured distributions, and (ii) an optional worst-case bound derived from the declared network model only if plotted; worst-case bounds (if present) are shown as a separately labeled envelope/marker and are never conflated with empirical percentiles. d Tail percentiles for SLO verification (hardware). for and across concurrency, identifying the percentile used for SLO evaluation. e SLO compliance under explicit definition. Compliance is reported as (e.g., , ) computed from the measured ECDFs; if a worst-case bound is reported, bound-based compliance is plotted separately and labeled. f Throughput under bounded tail latency (hardware). Sustained throughput at fixed SLO targets, highlighting the impact of calibration/verification/security choices under realistic load. Communication, energy, and carbon accounting (identical hardware) Communication cost is reported as MB/round under the same matched budgets across methods, including sparse payload indices/headers where applicable. Wall-clock energy/round ( ) is measured for all methods and baselines on identical hardware (D1–D3) by integrating instrumented power traces over the relevant training/aggregation steps and is also reported under heterogeneity sweeps. Carbon footprint is derived by mapping energy to CO 2 e using a stated electricity emissions factor and location convention. Privacy/security modes and cryptographic overhead (learning vs serving separation) Privacy/security trade-offs follow the strict separation: DP-SGD sensitivity reports utility/calibration versus at fixed under matched training schedules; Secure aggregation overhead is reported as a wall-clock runtime multiplier under matched message size, client count, and participation; CKKS + SMPC overhead is validated on hardware and reported as crypto-attributable additional wall-clock time, contribution inside the serving harness, and incremental Joules attributable to cryptography. The cryptographic stacks follow the filled legend: CKKS via Microsoft SEAL v4.1.1 with stated CKKS parameters (e.g., , scale , batching enabled), and SMPC via MP-SPDZ v0.3 (3-party semi-honest). Serving-plane throughput and calibration reliability are then re-measured under each security mode using exported checkpoints, and policy-level outcomes (accept/review/reject) plus safety/fidelity metrics are reported under matched latency constraints. Adversarial robustness, IBN control, and consolidated ablations (complexity control) Adversarial protocols follow: label-flip poisoning (attacker fraction – ) and gradient poisoning (strength up to ) report both AUC and accepted-update ratios when screening is active. Backdoor evaluation reports ASR vs clean utility and trigger transferability across client groups. Feature corruption robustness is measured under structured noise ( up to ) with joint AUC/ECE reporting. To address complexity confounds, we include: (i) an explicit IBN-removed fixed-threshold control that compares IBN verification against fixed confidence gating under matched inference constraints, and (ii) a single consolidated ablation table that reports AUC, ECE, latency, MB/round, and J/round for removing each calibration hyper-parameter and key module under parameter/PEFT-budget matching and depth/regularization-matched controls. Serving-plane interpretability and trust diagnostics under matched inference budgets Interpretability and trust diagnostics are computed in the serving harness under matched inference budgets and include: attention topology maps, attention entropy distributions, head diversity via cross-head similarity, trust–uncertainty overlays (including sharpness summaries), decision rollouts (dominant trust paths), counterfactual stability under top- trusted neighbor removal ( logit/ AUC with CIs), attribution agreement via rank correlation, and a failure-case compendium aligned with uncertainty diagnostics. Graph-FL/UQ-FL comparators are included only when their methods provide the required signals under matched inference budgets. Statistical reporting and reproducibility Across learning-plane plots, results are aggregated over 10 seeds with mean 95% confidence intervals as indicated in the corresponding figures. Serving-plane latency distributions are reported as ECDFs with explicit tail percentiles and SLO compliance computed from measured samples. Reproducibility follows fixed partitions/splits, archived configuration files, exported payload/latency logs, and containerized execution. Results and discussion Confidence-calibrated federated graph attention for IoT agents under hardware-evaluated latency SLOs Figure 1 depicts a closed-loop, edge-to-cloud control architecture in which IoMT sensors/actuators stream into an edge HP-FedGAT + Trust node that simultaneously performs local inference and uncertainty-aware, dynamic-graph attention, then exports only parameter-efficient deltas (LoRA/PEFT) plus trust statistics to limit bandwidth while preserving privacy 26 – 30 . The cloud aggregator’s secure aggregation and optional DP/split-learning toggles (together with trust-weighted aggregation) operationalize “confidence as a first-class signal,” meaning that model updates and downstream actions are conditioned not only on utility but also on calibrated uncertainty and trust estimates 29 , 31 – 33 . In this flow, the intent-verification/IBN stage explicitly turns the learned policy into a checked, triaged decision artifact before SDN enforcement executes actions (e.g., quarantine, micro-segmentation, QoS/slicing) and returns feedback, aligning with modern secure-by-construction IoT/edge governance patterns where verification and enforcement are separated yet tightly coupled 33 – 37 . The figure’s “results panel” emphasizes that model quality and operational reliability are evaluated jointly: it reports high utility alongside calibration/UQ metrics (ECE/NLL/Brier and selective-risk) and trust/robust-fidelity indicators, reflecting current best practice that calibrated confidence and abstention/triage behavior are essential for safety–critical deployments rather than optional add-ons 33 , 38 – 41 . The serving-plane is treated as a first-order constraint by measuring latency on hardware using empirical p99 and reporting explicit SLO attainments, which matches the broader systems literature arguing that tail latency and SLO compliance must be assessed end-to-end (including network variability) for edge inference services 27 , 35 , 42 – 44 . Finally, the matched “Comparator & Benchmark Harness” (controlling PEFT budget, bandwidth/round, compute, partitions, non-IID severity, and DP/secure-aggregation toggles) is an important methodological claim: it reduces confounding so that gains attributed to confidence calibration, trust weighting, or graph-FL choices are more likely to be causal rather than artifacts of unequal system budgets 26 , 28 , 29 , 34 , 45 . Confidence-calibrated federated graph attention for IoT agents under hardware-validated latency SLOs In the learning plane, HP-FedGAT-Trust-IBN achieves top-tier discrimination while also improving probability reliability under a matched comparator harness (fixed partitions/splits, rounds, backbone/PEFT budget, and privacy/communication toggles): in the N = 100 client simulation (10 seeds; mean ± 95% CI), ROC-AUC/PR-AUC sit in the high-0.97 to ~ 0.98 range with ECE among the lowest across matched Graph-FL (FedGraphNN, FedSage + , GCFL/GCFL +) and UQ-FL baselines (pFedBayes, FedEE, Dirichlet/evidential UQ) (Fig. 2 a) 29 , 46 – 48 . The figure is explicit that these simulation results do not support the < 100 ms claim; instead, < 100 ms is validated only in the serving plane using device-measured ECDFs and empirical tail percentiles ( ) from a controlled runtime harness that replays checkpoints exported from (a) on named hardware—D1: Raspberry Pi 5, D2: Jetson Orin Nano, D3: Intel NUC 11—under concurrency sweeps (Fig. 2 b). Within those measured ECDFs, enforcement latency is left-shifted for HP-FedGAT-Trust-IBN relative to efficient-UQ baselines, meeting the 100 ms target with empirical l (vs 39.2 ms for FedEE) (Fig. 2 b), and the loop decomposition makes the Monte-Carlo requirement unambiguous: includes all calibration computations and the expectations required by Eq. 18 , evaluated with K = 64 Monte-Carlo samples, with the measured wall-clock share attributed to the MC term reported (mean MC ≈ 1.28 ms)—i.e., the MC computation is counted inside the serving-loop processing budget and is not excluded from latency accounting (Fig. 2 c) 46 – 50 . The legend-consistent interpretation of the 100 ms inequality is enforced throughout: any worst-case bound derived from the declared network model is shown only if plotted and remains separately labeled, never conflated with empirical percentiles (Fig. 2 c). The same tail-first logic extends to isolation latency , where are explicitly reported across concurrency to show which percentile is used for SLO evaluation (Fig. 2 d) 29 , 46 , 48 , 49 , 51 . Under load, SLO compliance is reported under an explicit probability definition, , computed directly from measured ECDFs rather than inferred from simulation: as concurrency increases (≈1 → 64), HP-FedGAT-Trust-IBN maintains near-zero empirical violations at the 100 ms target across most of the sweep, while violations rise under the tighter 50 ms target; if bound-based compliance is included, it is plotted separately and labeled (Fig. 2 e) 49 , 50 , 52 – 54 . Throughput under bounded tail latency scales strongly with concurrency—roughly ~ 250 req/s (≈1 intent) to ~ 1450 req/s (≈64 intents)—with HP-FedGAT-Trust-IBN tracking comparators closely on throughput while still improving the tail-latency distribution used for SLO verification (Fig. 2 f) 46 , 47 , 49 , 50 . K ∈ {16, 32, 64} reports how calibration/robustness metrics and change with K—while emphasizing that all reported /SLO results already include the MC term inside (Fig. 2 c–2f). Taken together, Fig. 2 remains both methodological and systems-grounded: matched learning-plane comparisons (Fig. 2 a) and serving-plane hardware-validated /SLO compliance via ECDFs, queue/tx/proc decomposition including MC, and concurrency/throughput sweeps (Fig. 2 b–f) align calibrated confidence with predictable tails for IoT control loops 49 , 52 – 54 . Confidence-calibrated federated graph attention Pareto frontiers for IoT agents Figure 3 ’s learning-plane frontiers summarize efficiency–utility trade-offs under the same matched comparator harness as Fig. 2 , and explicitly add quantization-only baselines (QSGD, FedPAQ) at identical bit-budget to isolate quantization effects from PEFT/sparsification (Fig. 3 a). Across compression regimes, uplink cost spans roughly ~ 0.9–7.4 MB/round, and HP-FedGAT-Trust-IBN forms the upper utility envelope: AUC increases from about ~ 0.95 at ~ 1 MB/round to ~ 0.98 by ~ 3 MB/round under 8-bit quantization + Top-k sparsification, while the no-compression operating point peaks near ~ 0.985 at ~ 6–7 MB/round, indicating diminishing AUC returns beyond ~ 4 MB/round (Fig. 3 a) 55 – 59 . At matched bandwidth around ~ 3–4 MB/round, the bit-matched quantization-only baselines (FedPAQ, QSGD) cluster near ~ 0.966–0.970 AUC, whereas HP-FedGAT-Trust-IBN sits around ~ 0.979–0.983, implying an absolute ~  + 0.01 to + 0.015 AUC gain without increasing uplink budget (Fig. 3 a). The multi-seed repeats with 95% CI ribbons make this a robust frontier separation rather than a single-seed artifact (Fig. 3 a) 57 – 59 . The data and codes are archived with 10.5281/zenodo.18885861 and released under the Creative Commons Attribution 4.0 International (CC BY 4.0) license. The calibration-aware frontier shows that bandwidth savings do not come “for free” in reliability: ECE decreases as MB/round increases, yet HP-FedGAT-Trust-IBN remains consistently better calibrated—roughly ~ 0.03–0.04 ECE at ~ 1 MB/round and ~ 0.02–0.03 across ~ 2–7 MB/round—so its high-AUC points also preserve (and often improve) probability reliability (Fig. 3 b) 48 , 58 – 61 . In contrast, the bit-matched quantization-only baselines remain comparatively miscalibrated (about ~ 0.05–0.07 ECE) at similar MB/round, yielding a practical ~ 2 × –3 × ECE improvement for HP-FedGAT-Trust-IBN at comparable communication budgets (Fig. 3 b). Importantly, Fig. 3 extends “efficiency” beyond bandwidth: energy/round (J/round) is measured for all methods and baselines on identical hardware—D1 (Raspberry Pi 5), D2 (Jetson Orin Nano), D3 (Intel NUC 11)—by integrating an instrumented power trace over training/aggregation steps (Fig. 3 c), and those Joules are mapped to CO₂e using a stated EIA emissions factor and location convention to enable carbon-aware comparison of frontier points (Fig. 3 d). Read jointly, (a–d) support a deployable selection rule: pick a frontier operating point that meets the desired AUC while minimizing MB/round and J/round (and thus CO₂e), with the ~ 3 MB/round region emerging as a bandwidth-efficient point where HP-FedGAT-Trust-IBN reaches ~ 0.98 AUC while holding ~ 0.02–0.03 ECE (Fig. 3 a–d) 57 , 59 , 61 . Confidence-Calibrated Federated Graph Attention improves domain-transfer robustness under matched FL budgets Across the paired in-domain vs transfer evaluation, HP-FedGAT-Trust-IBN (confidence-calibrated) shows the smallest visible generalization gap: its in-domain AUC is ≈0.985 and its transfer AUC is ≈0.977 (ΔAUC≈0.007), whereas several GAT/graph baselines drop from ≈0.97–0.98 in-domain to ≈0.94–0.96 under transfer (ΔAUC≈0.02–0.03) with mean ± 95% CI errorbars indicating the paired comparison is seed-controlled (Fig. 4 a) 29 , 62 – 65 . Among the non-calibrated variants, Trust-IBN (no norm) exhibits a noticeably larger degradation (roughly ≈0.978 → ≈0.952, ΔAUC≈0.026), consistent with the idea that normalization/regularization choices can materially affect out-of-domain behavior when client domains differ (Fig. 4 a) 29 , 62 – 65 . UQ-FL comparators (e.g., pFedBayes/FedEE/Dirichlet-UQ) also keep transfer AUC closer to in-domain (visually ΔAUC≈0.009–0.011), but HP-FedGAT-Trust-IBN remains at the top of the paired transfer points while maintaining the best in-domain peak, implying a better joint operating point under the stated matched backbone/PEFT and communication constraints (Fig. 4 a) 57 , 61 , 66 – 68 . Calibration shift under domain transfer further separates methods: HP-FedGAT-Trust-IBN has the lowest bar at ΔECE ≈0.006–0.007, while standard GAT/centralized baselines show substantially larger shifts (≈0.017–0.021), indicating that the confidence-calibrated variant better preserves probability reliability when the deployment domain changes (Fig. 4 b) 61 , 67 – 70 . The UQ-centric baselines also reduce transfer miscalibration (e.g., Dirichlet-UQ ≈0.006–0.007, FedEE ≈0.007–0.009, pFedBayes ≈0.009), aligning with broader evidence that explicit uncertainty modeling and calibration procedures can mitigate overconfidence under distribution shift (Fig. 4 b) 61 , 66 , 67 , 69 , 70 . Taken together, the combination of small ΔAUC (performance retention) and small ΔECE (reliability retention) indicates that the confidence-calibrated graph-attention checkpoint is better positioned for cross-domain IoT deployment where downstream decision thresholds and triage logic depend on calibrated probabilities rather than raw scores (Fig. 4 a–b) 61 , 63 , 67 , 68 , 70 . Confidence-calibrated federated graph attention for iot agents under latency SLOs: privacy/security trade-offs and hardware-validated impacts Figure 5 makes privacy/security first-class operating knobs—DP-SGD (privacy budget ε at fixed δ), SecAgg, and CKKS + SMPC—and evaluates them under matched partitions, rounds, backbone/PEFT capacity, and message budgets so that shifts in AUC and calibration (ECE/NLL) are attributable to the protection mechanism rather than training-schedule drift (Fig. 5 a–d). In the DP sensitivity sweep, ε functions as the explicit control variable: tighter privacy (smaller ε) trades off against discrimination and may alter probability reliability, which is why the panel jointly reports AUC and ECE/NLL rather than accuracy alone (Fig. 5 a). Fig. 5. Open in a new tab Privacy and security trade-offs: DP/SecAgg/CKKS + SMPC cost–utility (learning plane) and serving-plane latency/SLO impacts, validated on real edge hardware. a Differential privacy sensitivity. Utility (AUC) and calibration (ECE/NLL) versus (fixed ) under DP-SGD with matched training schedules. b Secure aggregation overhead (wall-clock). Runtime multiplier attributable to SecAgg under matched message size, client count, and participation. c CKKS + SMPC overhead on edge hardware (device measured). Measured cryptographic overhead on edge devices (model/CPU/RAM/OS stated) using HE library and SMPC stack , reporting (i) additional wall-clock time, (ii) latency contribution in the serving harness, and (iii) incremental energy (Joules) attributable to cryptography (power-trace integration). d Privacy/security frontier. Utility versus (MB/round, J/round) under matched privacy/security settings, exposing cost–utility trade-offs. e Serving-plane throughput under security modes. Throughput at fixed SLO thresholds using exported checkpoints, measured in the same runtime harness as Fig. 2 . f Serving-plane calibration reliability under security modes. Reliability diagrams and ECE/NLL under DP/SecAgg/CKKS + SMPC, testing whether security disrupts confidence quality. g Policy-level safety/fidelity under verification. Verified-policy outcomes (accept/review/reject) and safety/fidelity metrics with 95% CIs, enabling direct comparison of security modes at matched latency constraints. Secure aggregation is isolated as a system overhead via a wall-clock multiplier at matched message size (≤ 1.1 MB/round), client count, and participation, reflecting that confidentiality in aggregation typically incurs extra protocol and compute costs (Fig. 5 b). Most importantly for deployment, CKKS + SMPC costs are validated on named edge devices using the same serving harness: the panel reports added wall-clock, Δp99 contribution, and crypto-attributable Joules from power-trace integration (Fig. 5 c), enabling a privacy/security frontier that compares achieved utility against (MB/round, J/round) instead of treating cryptography as “free” (Fig. 5 d). Concretely, with CKKS (SEAL v4.1.1; (N = 8192), scale 2 40 , batching) plus SMPC (MP-SPDZ v0.3), the illustrative device-measured increments reported in the legend are D1 (Raspberry Pi 5): , + 5.8 J/round; D2 (Jetson Orin Nano): , + 3.2 J/round; and D3 (Intel NUC 11): , + 1.7 J/round, with SecAgg-only increments remaining sub-millisecond in and sub-Joule per round (Fig. 5 c). On the serving plane, exported checkpoints are replayed under each security mode to quantify throughput at fixed SLO thresholds and any compliance loss via device-measured tail behavior ( ), aligning the evaluation with SLO-centric inference serving practice where tail latency—not simulation means—determines compliance (Fig. 5 e). Because the architecture is confidence-calibrated, the figure also stress-tests whether DP/SecAgg/CKKS + SMPC perturb reliability diagrams and ECE/NLL, since triage/deferral and safe actuation depend on calibrated probabilities rather than raw scores (Fig. 5 f). The policy-level panel completes the loop by reporting accept/review/reject outcomes and safety/fidelity metrics (mean ± 95% CI) under matched latency constraints, making the trade-off explicit: stronger privacy/security is preferred only if it preserves (i) calibrated utility (Fig. 5 a, f), (ii) training/runtime/energy budgets (Fig. 5 b–d), and (iii) serving-loop p99/throughput targets once verification/enforcement are included (Fig. 5 e, g). Confidence-calibrated FedGAT robustness under federated heterogeneity stress tests Across federation dynamics, HP-FedGAT-Trust-IBN stays on top of the utility and calibration curves as participation varies: when per-round participation increases from 0.2 → 1.0, its AUC rises ≈0.972 → ≈0.985, consistently ahead of pFedBayes (≈0.965 → ≈0.979), GCFL + (≈0.962 → ≈0.976), and FedAvg + GAT (≈0.955 → ≈0.968) (Fig. 6 a). Its uncertainty stability improves in the same sweep, with ECE decreasing ≈0.035 → ≈0.020, while pFedBayes falls ≈0.042 → ≈0.028, GCFL + ≈0.056 → ≈0.041, and FedAvg + GAT ≈0.073 → ≈0.057 (Fig. 6 b). Under non-IID severity (Dirichlet α from 0.1 → 1.0, where lower α is more skew), HP-FedGAT-Trust-IBN’s AUC remains tightly bounded around ≈0.978–0.984 with ECE staying in the low-0.02 s, whereas the matched baselines sit lower in AUC and higher in ECE across the same α sweep (Fig. 6 c). Stress-testing client availability shows the same ordering under both random and correlated dropouts: with random dropout rising from 0.0 → 0.4, HP-FedGAT-Trust-IBN declines from ≈0.983 → ≈0.969 AUC, but still stays above pFedBayes (≈0.976 → ≈0.961), GCFL + (≈0.975 → ≈0.959), and FedAvg + GAT (≈0.961 → ≈0.946) (Fig. 6 d). Under bursty dropout (missing 0 → 5 consecutive rounds), HP-FedGAT-Trust-IBN degrades from ≈0.985 → ≈0.934, while pFedBayes ends near ≈0.928, GCFL + near ≈0.926, and FedAvg + GAT near ≈0.915, indicating better recovery under correlated availability shocks (Fig. 6 e). Client-level fairness also improves: HP-FedGAT-Trust-IBN shows a higher Jain’s index ≈0.93 versus ≈0.86 for FedAvg + GAT, with lower per-client AUC dispersion (variance roughly ~ 0.004 vs ~ 0.007) (Fig. 6 f). This robustness carries into the cost–accuracy view under heterogeneity: as communication increases from ~ 1.0 → 3.0 MB/round, HP-FedGAT-Trust-IBN climbs from ≈0.967 → ≈0.980 AUC, maintaining a clear margin over the other methods at the same MB/round operating points (Fig. 6 g). Finally, the energy accounting (identical hardware) reveals the cost of robustness: energy/round decreases as α increases (less skew), with HP-FedGAT-Trust-IBN at about ~ 20 J/round (α≈0.1) down to ~ 16 J/round (α≈1.0), versus baselines around ~ 19 → 15 J (FedAvg + GAT) and ~ 18 → 14 J (GCFL + /pFedBayes), i.e., a roughly + 1–2 J/round premium that buys the higher AUC/lower ECE across heterogeneity regimes (Fig. 6 h). Confidence-calibrated federated graph attention for IoT agents under latency SLOs: adversarial robustness with defense attribution and complexity control Figure 7 attributes adversarial robustness to specific, isolate-able components rather than to an undifferentiated “more complex model.” Under label-flip poisoning, HP-FedGAT-Trust-IBN preserves higher utility than the matched FedAvg + GAT baseline as attacker fraction increases (AUC ≈ 0.985 → 0.925 vs 0.970 → 0.878) and concurrently reduces exposure by screening suspicious updates (accepted-update ratio ≈ 98% → 80%), consistent with a defense stack that explicitly rejects malicious contributions rather than averaging them in (Fig. 7 a). The same pattern holds for gradient poisoning: HP-FedGAT-Trust-IBN declines more gracefully (AUC ≈ 0.985 → 0.936 vs 0.975 → 0.868) while the accepted-update ratio falls (≈ 98% → 75%) as poisoning strength rises, showing that robustness is linked to measured gating/screening behavior rather than only to model capacity (Fig. 7 b). Fig. 7. Open in a new tab Adversarial robustness (learning plane) with defense-stack attribution, plus the required single ablation table isolating calibration, IBN, and capacity/regularization effects. a Label-flip robustness. AUC/ ECE versus attacker fraction; accepted-update ratios reported when screening is active. b Gradient-poisoning robustness. Utility and calibration under poisoning strength, with acceptance/rejection statistics for screened updates. c Backdoor trade-off. Attack success rate (ASR) versus clean utility across defense configurations. d Trigger transferability. ASR across clients/domains under non-IID settings. e Feature-noise robustness. AUC/ ECE under structured feature corruption. f Threat matrix. Attack type/budget defense configuration ( AUC, ECE, ASR, accepted-update%). g IBN-removed control (fixed confidence threshold). Direct comparison of IBN verification versus fixed-threshold gating (IBN removed) reporting the drop in utility, calibration, and policy-level safety/fidelity under matched inference constraints, quantifying the marginal value of IBN. h Single consolidated ablation table (required). One table reporting AUC, ECE, latency, MB/round, and J/round when each calibration hyperparameter is removed (e.g., temperature scaling off; entropy regularizer off; reliability penalty off) and when key modules are removed (e.g., trust normalization off; IBN off; privacy/crypto off), including depth/regularization-matched controls (same parameter count, dropout, and training schedule) to isolate the effect of confidence calibration from model capacity or regularization. For backdoors, the defense configurations trace out a clean trade-off between clean utility and attack success: at similar clean AUC (≈ 0.97–0.98), HP-FedGAT-Trust-IBN holds substantially lower ASR (≈ 0.07 → 0.03) than the baseline (≈ 0.20 → 0.04), and trigger transferability remains lower across client groups (HP ≈ 0.05–0.08 vs baseline ≈ 0.125–0.18), indicating that the improvement is not confined to a single domain/client slice (Fig. 7 c–d). Under structured feature noise (σ: 0.0 → 0.8), HP-FedGAT-Trust-IBN shows smaller degradation in both discrimination and reliability (AUC ≈ 0.985 → 0.952; ECE ≈ 0.02 → 0.03) than FedAvg + GAT (AUC ≈ 0.91; ECE ≈ 0.075–0.08), reinforcing that the method maintains both performance and confidence quality under non-adversarial corruption as well (Fig. 7 e). The threat matrix then consolidates attribution across attack types and budgets, explicitly showing that removing key modules (e.g., “No trust”) worsens impacts across the board relative to the full stack, which yields the lowest composite impact scores (Fig. 7 f). The figure includes two controls that prevent “it’s just deeper / more regularized” from being the default explanation. First, the IBN-removed fixed-threshold control demonstrates that IBN contributes distinct value beyond simple confidence gating: replacing IBN with a fixed threshold reduces utility (AUC ≈ 0.985 → 0.977) and worsens calibration (ECE ≈ 0.03), while policy outcomes degrade (blocked-malicious / allowed-benign: 0.94/0.96 → 0.88/0.94) under matched inference constraints (Fig. 7 g). Second, the single consolidated ablation table is structured to isolate calibration effects under parameter/PEFT-budget matching and depth/regularization-matched controls, and it reports not only ΔAUC/ΔECE but also p99 latency, MB/round, and J/round so gains cannot be dismissed as unreported compute/complexity. The table shows that removing calibration knobs yields material reliability loss at nearly unchanged tail latency (e.g., no temperature scaling: ΔAUC − 0.004, ΔECE + 0.008, 54.0 ms; no entropy regularizer: ΔAUC − 0.006, ΔECE + 0.010, 54.5 ms; no reliability penalty: ΔAUC − 0.005, ΔECE + 0.009, 54.2 ms), supporting the claim that calibration primarily drives confidence quality rather than “winning” via slower inference (Fig. 7 h). Meanwhile, the depth/regularization-matched control still underperforms the full model (ΔAUC − 0.01; ΔECE + 0.015; 53.0 ms; 1.1 MB/round; 13.5 J/round), directly addressing the concern that the reported robustness is purely a byproduct of extra depth/regularization (Fig. 7 h). To make the separation completely unambiguous (and easy for reviewers to parse), the most surgical addition is to include two extra rows in the same ablation table: a “Minimal stack” baseline (GAT + PEFT only, budget-matched) and a “Calibration-only add-on” variant (Minimal + calibration knobs, still budget-matched). These two rows would show, in the same ΔAUC/ΔECE/ /MB/J frame, the marginal benefit of calibration without trust normalization or IBN—closing the last remaining gap in the complexity attribution argument while keeping the results strictly comparable. Confidence-calibrated FedGAT trust/uncertainty diagnostics in the serving plane under latency SLO constraints Figure 8 reports serving-plane interpretability and trust diagnostics measured in the same runtime harness as Fig. 2 , using checkpoints exported from the learning plane and executed under matched inference budgets on named hardware (D1–D3), with Graph-FL/UQ-FL comparators included only when the required signals are available (attention, uncertainty estimates, or equivalent diagnostics) (Fig. 8 a–d). The attention maps indicate that HP-FedGAT-Trust-IBN’s decision logic is selective rather than diffuse: attention topology is sparse with a small number of dominant node → neighbor edges (Fig. 8 a), and the per-node normalized attention entropy concentrates in a low-to-mid range (~ 0.2–0.6) rather than approaching a uniform/high-entropy regime, consistent with sharper, confidence-linked attention (Fig. 8 b) 61 , 71 , 72 . Multi-head behavior supports complementarity under the confidence-calibrated regime: the 8 × 8 head-diversity matrix shows off-diagonal cosine similarities largely below 1.0 (low–moderate similarity rather than near-duplicate heads), suggesting non-redundant heads rather than capacity waste (Fig. 8 c) 61 , 73 , 74 . Trust–uncertainty overlays further show that trust assignment tracks uncertainty in an interpretable way: the reported “trust sharpness via Gini” is 0.42 for HP-FedGAT-Trust-IBN versus 0.41 for FedAvg + GAT (0.41 for Dirichlet-UQ where available), indicating slightly more concentrated trust mass when confidence is high and more dispersed allocation under uncertainty (Fig. 8 d) 29 , 61 , 71 . Fig. 8. Open in a new tab Interpreting trust and uncertainty (serving plane): attention structure, diversity, counterfactual stability, and attribution agreement, with UQ-FL and Graph-FL comparators when signals are available. a Attention topology. Node neighbor attention maps for representative samples. b Attention entropy distributions. Entropy/sharpness summaries linked to calibrated confidence outputs. c Head diversity. Cross-head similarity metrics (e.g., cosine similarity) assessing multi-head complementarity. d Trust–uncertainty overlays. Alignment of attention with trust weights and uncertainty scores (e.g., Dirichlet evidence or Bayesian predictive variance where available). e Decision rollouts. Attention rollouts highlighting dominant trust paths leading to decisions/policy triggers. f Counterfactual stability. Removal of top- trusted neighbors/edges with resulting logit/ AUC and 95% CIs. g Attribution agreement. Rank correlation between attention explanations and complementary attribution methods (e.g., SHAP-style summaries). h Failure-case compendium. Representative errors with aligned uncertainty/trust diagnostics (confidence, entropy, , counterfactual sensitivity) under matched inference constraints. Consistent with this, decision rollouts show that cumulative attention mass increases from ~ 0.56–0.62 at top-1 to ~ 1.0 by top-2 neighbors, implying most triggers/policy decisions are mediated through a small set of dominant trusted paths—useful for SLO-bounded loops because it yields compact rollouts under matched runtime constraints (Fig. 8 e) 29 , 73 – 75 . Counterfactual stress tests provide a serving-plane stability check under the same harness: removing the top-k trusted neighbors/edges produces smaller shifts for HP-FedGAT-Trust-IBN than for the baseline, with Δlogit rising ~ 0.08 (k = 1) →  ~ 0.96 (k = 10) versus ~ 0.15 →  ~ 1.30 for FedAvg + GAT, and the plotted 95% CIs quantify variance across samples/seeds (Fig. 8 f) 71 , 73 , 74 , 76 . Attribution agreement is treated explicitly as a diagnostic rather than assumed: the attention-vs-SHAP-style rank correlation is low (Spearman ρ ≈ 0.12), indicating attention explanations are not simply duplicating additive feature attributions and motivating multi-view interpretability checks when deploying safety–critical IoT policies (Fig. 8 g) 73 , 74 , 76 , 77 . Finally, the failure-case compendium operationalizes triage: errors concentrate in OOD spike (12) and Low SNR (9), followed by Sparse graph (7) and Adversarial-like (5), with mean uncertainty elevated (≈0.5–0.7) in the highest-risk categories—supporting the intended use of calibrated uncertainty + trust signals for review/deferral decisions under matched inference constraints (Fig. 8 h) 29 , 61 , 71 , 73 . Conclusion In conclusion, this work demonstrates that Confidence-Calibrated HP-FedGAT-Trust-IBN can simultaneously deliver high predictive utility and reliable uncertainty while meeting hardware-validated tail-latency SLOs for IoT enforcement loops, addressing a key gap between learning-centric federated methods and operationally constrained edge control. By combining confidence-calibrated dynamic graph attention, trust-weighted secure aggregation with parameter-efficient LoRA/PEFT updates (≤ 1.1 MB/round), and intent verification (IBN) triage prior to SDN enforcement, the system aligns model decisions with safety-oriented governance and measurable service guarantees. The two-plane evaluation makes the latency claim rigorous: learning-plane simulations quantify discrimination and calibration under matched Graph-FL and UQ-FL baselines, while the serving plane validates empirical p99 and SLO compliance directly on real edge devices, with decomposition that includes all calibration and Monte Carlo costs (K = 64) and separates any worst-case bounds from empirical percentiles. Finally, the study elevates deployability by reporting communication, energy, and carbon trade-offs, and by quantifying end-to-end privacy/security overheads (including CKKS + SMPC) in both latency and Joules, yielding a practical selection rule for choosing the strongest protection and verification settings that preserve calibration, robustness, and tail-latency compliance in real IoT deployments. Author contributions D.Y.: Writing—original draft, Writing—review & editing, Data curation. B.L.: Methodology, Investigation. L.W.: Project administration, Software. Q.D.: Formal analysis, Software. Data availability The data and codes are archived with 10.5281/zenodo.18885861 and released under the Creative Commons Attribution 4.0 International (CC BY 4.0) license. Declarations Competing interests The authors declare no competing interests. Footnotes Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. References 1. Naghib, A., Gharehchopogh, F. S. & Zamanifar, A. A comprehensive and systematic literature review on intrusion detection systems in the internet of medical things: Current status, challenges, and opportunities. Artif. Intell. Rev. 58 , 114 (2025). [ Google Scholar ] 2. El-Saleh, A. A., Sheikh, A. M., Albreem, M. A. & Honnurvali, M. S. The internet of medical things (IoMT): Opportunities and challenges. Wirel. Netw. 31 , 327–344 (2025). [ Google Scholar ] 3. Hamad, N. A. et al. Systematic analysis of federated learning approaches for intrusion detection in the internet of things environment. IEEE Access 10.1109/ACCESS.2025.3574672 (2025). [ Google Scholar ] 4. Chen, C. et al. Trustworthy federated learning: Privacy, security, and beyond. Knowl. Inf. Syst. 67 , 2321–2356 (2025). [ Google Scholar ] 5. Albanbay, N. et al. Federated learning-based intrusion detection in IoT networks: performance evaluation and data scaling study. J. Sens. Actuator Netw. 14 , 78 (2025). [ Google Scholar ] 6. Asif, M., Khan, T. A. & Song, W.-C. Leveraging cognitive machine reasoning and NLP for automated intent-based networking and e2e service orchestration. IEEE Access 10.1109/ACCESS.2025.3534282 (2025). [ Google Scholar ] 7. AlSamarneh, A. A., Al-Hammouri, A. T. & Al-Jarrah, O. Y. Navigating intent-based networking: From user descriptions to deployable configurations. Neural Comput. Appl. 10.1007/s00521-025-11193-7 (2025). [ Google Scholar ] 8. Hussein, D. H. & Ibnkahla, M. Privacy-preserving intelligent intent-based network slicing for IoT systems. IEEE Internet Things J. 10.1109/JIOT.2025.3564138 (2025). [ Google Scholar ] 9. Zhou, J. et al. Protecting your attention during distributed graph learning: efficient privacy-preserving federated graph attention network. IEEE Trans. Inf. Forensics Secur. 10.1109/TIFS.2025.3536612 (2025). [ Google Scholar ] 10. Wang, B. et al. in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2146–2168. 11. Njah, Y., Leivadeas, A., Violos, J. & Falkner, M. Toward intent-based network automation for smart environments: A healthcare 4.0 use case. IEEE Access 11 , 136565–136576 (2023). [ Google Scholar ] 12. Dubey, P. & Kumar, M. Integrating explainable AI with federated learning for next-generation IoT: A comprehensive review and prospective insights. Comput. Sci. Rev. 56 , 100697 (2025). [ Google Scholar ] 13. Khajehali, N., Yan, J., Chow, Y.-W. & Fahmideh, M. A comprehensive overview of IoT-based federated learning: Focusing on client selection methods. Sensors (Basel) 23 , 7235 (2023). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 14. Qing, C. et al. GatS-Net: GAT-based superimposed CSI feedback. IEEE Transactions on Green Communications and Networking (2024). 15. Demelius, L., Kern, R. & Trügler, A. Recent advances of differential privacy in centralized deep learning: A systematic survey. ACM Comput. Surv. 57 , 1–28 (2025). [ Google Scholar ] 16. Xhemrishi, M., Östman, J., Wachter-Zeh, A. & i Amat, A. G. FedGT: Identification of malicious clients in federated learning with secure aggregation. IEEE Trans. Inf. Forensics Secur. 10.1109/tifs.2025.3539964 (2025). [ Google Scholar ] 17. Liu, W. et al. From accuracy to approximation: A survey on approximate homomorphic encryption and its applications. Comput. Sci. Rev. 55 , 100689 (2025). [ Google Scholar ] 18. Gharbaoui, M. & Castoldi, P. in 2025 25th Anniversary International Conference on Transparent Optical Networks (ICTON). 1–4 (IEEE). 19. Balanya, S. A., Maronas, J. & Ramos, D. Adaptive temperature scaling for robust calibration of deep neural networks. Neural Comput. Appl. 36 , 8073–8095 (2024). [ Google Scholar ] 20. Ahmed, U., Lin, J.C.-W. & Srivastava, G. Hyper-graph attention based federated learning methods for use in mental health detection. IEEE J. Biomed. Health Inform. 27 , 768–777 (2022). [ DOI ] [ PubMed ] [ Google Scholar ] 21. Molaei, S. et al. in International Conference on Artificial Intelligence and Statistics. 1342–1350 (PMLR). 22. Li, M. & Walsh, J. FedGAT-DCNN: Advanced credit card fraud detection using federated learning, graph attention networks, and dilated convolutions. Electronics 13 , 3169 (2024). [ Google Scholar ] 23. Abbas, S. R., Abbas, Z., Zahir, A. & Lee, S. W. in Healthcare. 2587 (MDPI). 24. Waheed, N. et al. in GLOBECOM 2023–2023 IEEE Global Communications Conference. 3855–3860 (IEEE). 25. Tang, X. & Hu, F. A privacy-enhancing mechanism for federated graph neural networks. Symmetry 17 , 565 (2025). [ Google Scholar ] 26. Chen, M., Shlezinger, N., Poor, H. V., Eldar, Y. C. & Cui, S. Communication-efficient federated learning. Proc. Natl. Acad. Sci. U. S. A. 118 , e2024789118 (2021). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 27. Nigade, V., Bauszat, P., Bal, H. & Wang, L. Inference serving with end-to-end latency SLOs over dynamic edge networks. Real Time Syst. 60 , 239–290 (2024). [ Google Scholar ] 28. Prasad, V. K. et al. Federated learning for the internet-of-medical-things: A survey. Mathematics 11 , 151 (2022). [ Google Scholar ] 29. Wu, C. et al. A federated graph neural network framework for privacy-preserving personalization. Nat. Commun. 13 , 3091 (2022). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 30. Yu, X., Tashakori, A., Zou, L. & Wang, Z. J. pfedbl: Federated bayesian learning with personalized prior. IEEE Transactions on Artificial Intelligence (2025). 31. Gao, R. et al. BI-FedGNN: Federated graph neural networks framework based on Bayesian inference. Neural Netw. 169 , 143–153 (2024). [ DOI ] [ PubMed ] [ Google Scholar ] 32. Li, K. H., de Gusmão, P. P. B., Beutel, D. J. & Lane, N. D. in Proceedings of the 2nd ACM International Workshop on Distributed Machine Learning. 8–14. 33. Liu, J. et al. A comprehensive privacy-preserving federated learning scheme with secure authentication and aggregation for internet of medical things. IEEE J. Biomed. Health Inform. 28 , 3282–3292 (2023). [ DOI ] [ PubMed ] [ Google Scholar ] 34. Ni, L. et al. rfedfw: Secure and trustable aggregation scheme for byzantine-robust federated learning in internet of things. Inf. Sci. 653 , 119784 (2024). [ Google Scholar ] 35. Park, K., Sung, S., Kim, H. & Jung, J.-i. Technology trends and challenges in SDN and service assurance for end-to-end network slicing. Comput. Netw. 234 , 109908 (2023). [ Google Scholar ] 36. Sanjalawe, Y., Alqurashi, T., Alharbi, Z. H., Makhadmeh, S. N. & Alsharaiah, M. Adaptive graph attention-based federated learning for IoT intrusion detection: Mitigating poisoning attacks. PeerJ Comput. Sci. 11 , e3281 (2025). [ Google Scholar ] 37. Wichary, T., Mongay Batalla, J., Mavromoustakis, C. X., Żurek, J. & Mastorakis, G. Network slicing security controls and assurance for verticals. Electronics 11 , 222 (2022). [ Google Scholar ] 38. Futami, F. & Fujisawa, M. Information-theoretic generalization analysis for expected calibration error. Adv. Neural Inf. Process. Syst. 37 , 84246–84297 (2024). [ Google Scholar ] 39. Minderer, M. et al. Revisiting the calibration of modern neural networks. Adv. Neural. Inf. Process. Syst. 34 , 15682–15694 (2021). [ Google Scholar ] 40. Sambyal, A. S., Niyaz, U., Krishnan, N. C. & Bathula, D. R. Understanding calibration of deep neural networks for medical image classification. Comput. Methods Programs Biomed. 242 , 107816 (2023). [ DOI ] [ PubMed ] [ Google Scholar ] 41. Šuster, S., Baldwin, T. & Verspoor, K. Analysis of predictive performance and reliability of classifiers for quality assessment of medical evidence revealed important variation by medical area. J. Clin. Epidemiol. 159 , 58–69 (2023). [ DOI ] [ PubMed ] [ Google Scholar ] 42. Coppock, P. H. et al. in Proceedings of the ACM SIGOPS 31st Symposium on Operating Systems Principles. 1–17. 43. Iyer, R., Unal, M., Kogias, M. & Candea, G. in Proceedings of the 29th Symposium on Operating Systems Principles. 466–481. 44. Zhao, H. & Georgantas, N. in Proceedings of the Middleware for Autonomous AIoT Systems in the Computing Continuum 25–30 (2025). 45. Nguyen, D. C. et al. Federated learning for internet of things: A comprehensive survey. IEEE Commun. Surv. Tut. 23 , 1622–1658 (2021). [ Google Scholar ] 46. Cao, Z., Li, Y., Kim, D.-H. & Shin, B.-S. Deep neural network confidence calibration from stochastic weight averaging. Electronics 13 , 503 (2024). [ Google Scholar ] 47. Wang, L. et al. Parameter-efficient fine-tuning in large language models: A survey of methodologies. Artif. Intell. Rev. 58 , 227 (2025). [ Google Scholar ] 48. Zhang, R., Gatsonis, C. & Steingrimsson, J. A. Role of calibration in uncertainty-based referral for deep learning. Stat. Methods Med. Res. 32 , 927–943 (2023). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 49. Hong, S., Kim, Y., Nam, J. & Kim, S. On the analysis of inter-relationship between auto-scaling policy and QoS of FaaS workloads. Sensors 24 , 3774 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 50. Zhang, X., Luo, Y. & Li, T. A review of research on secure aggregation for federated learning. Future Internet 17 , 308 (2025). [ Google Scholar ] 51. Dritsas, E. & Trigka, M. Federated learning for IoT: A survey of techniques, challenges, and applications. J. Sens. Actuator Netw. 14 , 9 (2025). [ Google Scholar ] 52. Li, X., Li, Y., Wan, H. & Wang, C. Enhancing Byzantine robustness of federated learning via tripartite adaptive authentication: X. Li et al.. J. Big Data 12 , 121 (2025). [ Google Scholar ] 53. Padmavathi, V. & Saminathan, R. A federated edge intelligence framework with trust based access control for secure and privacy preserving IoT systems. Sci. Rep. 15 , 35832 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 54. Zhai, K., Ren, Q., Wang, J. & Yan, C. Byzantine-robust federated learning via credibility assessment on non-IID data. arXiv preprint arXiv:2109.02396 (2021). [ DOI ] [ PubMed ] 55. Brecko, A., Kajati, E., Koziorek, J. & Zolotova, I. Federated learning for edge computing: A survey. Appl. Sci. 12 , 9124 (2022). [ Google Scholar ] 56. Li, Y., Li, W. & Xue, Z. Federated learning with stochastic quantization. Int. J. Intell. Syst. 37 , 11600–11621 (2022). [ Google Scholar ] 57. Liu, B., Lv, N., Guo, Y. & Li, Y. Recent advances on federated learning: A systematic survey. Neurocomputing 597 , 128019 (2024). [ Google Scholar ] 58. Lu, S., Li, R., Liu, W., Guan, C. & Yang, X. Top-k sparsification with secure aggregation for privacy-preserving federated learning. Comput. Secur. 124 , 102993 (2023). [ Google Scholar ] 59. Zhao, Z. et al. Towards efficient communications in federated learning: A contemporary survey. J. Frankl. Inst. 360 , 8669–8703 (2023). [ Google Scholar ] 60. Posocco, N. & Bonnefoy, A. in International conference on artificial neural networks. 139–150 (Springer). 61. Silva Filho, T. et al. Classifier calibration: a survey on how to assess and improve predicted class probabilities. Mach. Learn. 112 , 3211–3260 (2023). [ Google Scholar ] 62. Kang, Y. & Lee, J.-H. Federated domain generalization with source knowledge preservation via discriminative ensembles. Inform. Sci. , 122804 (2025). 63. Liu, Q., Chen, C., Qin, J., Dou, Q. & Heng, P.-A. in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 1013–1023. 64. Nguyen, A. T., Torr, P. & Lim, S. N. FedSR: A simple and effective domain generalization method for federated learning. Adv. Neural Inf. Process. Syst. 35 , 38831–38843 (2022). [ Google Scholar ] 65. Xu, D. et al. Decentralized federated domain generalization with cluster alignment for fault diagnosis. Control Eng. Pract. 148 , 105951 (2024). [ Google Scholar ] 66. Koutsoubis, N. et al. Privacy-preserving federated learning and uncertainty quantification in medical imaging. Radiol.: Artif. Intell. 7 , e240637 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 67. Peng, H., Yu, H., Tang, X. & Li, X. Fedcal: Achieving local and global calibration in federated learning via aggregated parameterized scaler. arXiv preprint arXiv:2405.15458 (2024). 68. Zhu, M. et al. Federated inference with reliable uncertainty quantification over wireless channels via conformal prediction. IEEE Trans. Signal Process. 72 , 1235–1250 (2024). [ Google Scholar ] 69. Forest, F. & Fink, O. Calibrated adaptive teacher for domain-adaptive intelligent fault diagnosis. Sensors (Basel) 24 , 7539 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 70. Ojeda, F. M. et al. Calibrating machine learning approaches for probability estimation: A comprehensive comparison. Stat. Med. 42 , 5451–5478 (2023). [ DOI ] [ PubMed ] [ Google Scholar ] 71. Chen, L.-Y. & Li, Y.-P. Uncertainty quantification with graph neural networks for efficient molecular design. Nat. Commun. 16 , 3262 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 72. Yan, Y., Yu, G. & Yan, X. Entropy-enhanced attention model for explanation recommendation. Entropy (Basel) 24 , 535 (2022). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 73. Agarwal, C., Queen, O., Lakkaraju, H. & Zitnik, M. Evaluating explainability for graph neural networks. Sci. Data 10 , 144 (2023). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 74. Funke, T., Khosla, M., Rathee, M. & Anand, A. Zorro: Valid, sparse, and stable explanations in graph neural networks. IEEE Trans. Knowl. Data Eng. 35 , 8687–8698 (2022). [ Google Scholar ] 75. Vrahatis, A. G., Lazaros, K. & Kotsiantis, S. Graph attention networks: A comprehensive review of methods and applications. Future Internet 16 , 318 (2024). [ Google Scholar ] 76. Thanh, T. H. T., Huynh, T., Vu, H. & Le, B. Shapley-based graph explanation in embedding space. Knowl. Based Syst. 300 , 112244 (2024). [ Google Scholar ] 77. Akkas, S. & Azad, A. in Proceedings of the ACM Web Conference 2024. 827–838. Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Data Availability Statement The data and codes are archived with 10.5281/zenodo.18885861 and released under the Creative Commons Attribution 4.0 International (CC BY 4.0) license. Articles from Scientific Reports are provided here courtesy of Nature Publishing Group ACTIONS View on publisher site PDF (7.8 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top