arXiv CS open access

Trustworthy Distributed Machine Learning in Cloud-Edge-IoT Systems: A Heterogeneity-Aware Survey of Security, Privacy, and Robustness

Long Dang et al. · arxiv_cs

arXiv CS · Papers

cryptography cybersecurity privacy security

Distributed machine learning (DML), including conventional distributed training and federated learning (FL), enables collaborative model development across cloud-edge-IoT systems without fully centralizing raw data. However, distributing data, computation, updates, and orchestration increases the at

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

Trustworthy Distributed Machine Learning in Cloud-Edge-IoT Systems: A Heterogeneity-Aware Survey of Security, Privacy, and Robustness

arXiv:2610.38793v1 [cs.CR] 28 Oct 2026

Long Dang∗ , Ali Alfatemi∗ , Kaiqi Xiong, Senior Member, IEEE, Mohammed Aledhari, Senior Member, IEEE, Abdellah Chehri∗ , Senior Member, IEEE, Shawqi Al-Maliki, and Mohamed Rahouti, Member, IEEE

Abstract—Distributed machine learning (DML), including conventional distributed training and federated learning (FL), enables collaborative model development across cloud-edge-IoT systems without fully centralizing raw data. However, distributing data, computation, updates, and orchestration increases the attack surface and introduces coupled challenges across privacy, robustness, reliability, fairness, and governance. This survey presents a security-centered, heterogeneity-aware roadmap for trustworthy DML, with FL treated as a prominent high-risk case. We first characterize the assets, adversaries, trust assumptions, and coordination patterns that define DML/FL security boundaries. We then analyze how statistical, system, and trust heterogeneity, including non-IID data, resource asymmetry, intermittent participation, and cross-silo/cross-device trust differences, affect convergence, fairness, attack detectability, and defense reliability. Next, we synthesize attack-defense interactions across poisoning, backdoors, Byzantine manipulation, privacy leakage, model extraction, network/orchestration attacks, Sybil behavior, and strategic participation. We further compare layered defenses, including robust aggregation, drift-aware optimization, differential privacy, secure aggregation, homomorphic encryption, secure multiparty computation, trusted execution environments, watermarking, provenance, authenticated communication, and monitoring. Finally, we discuss deployment, evaluation, governance, and open research guidelines, emphasizing reproducible, non-independent and identically distributed (non-IID) partitions, attack-aware benchmarks, privacy budgets, attack success rate, client-level disparity, latency, communication, memory, energy/carbon overhead, and auditable lifecycle artifacts. Index Terms—Distributed machine learning, federated learning, cloud-edge-IoT systems, security, privacy, robustness, nonIID data, heterogeneity, trusted execution, secure aggregation.

© 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses. This is the accepted manuscript of an article published in IEEE Internet of Things Journal. DOI: https://doi. org/10.1109/JIOT.2026.3742225. The final authenticated version is available online at IEEE Xplore: https://ieeexplore.ieee.org/document/11733665. L. Dang and K. Xiong are with Cyber Florida, University of South Florida, Tampa, FL, USA (e-mail: {longdang; xiongk}@usf.edu). A. Alfatemi and M. Rahouti are with the Department of Computer and Information Science, Fordham University, New York, NY, USA (e-mail: {aalfatemi; mrahouti}@fordham.edu). M. Aledhari is with the Data Science Department, University of North Texas, Denton, 76207, USA (e-mail: mohammed.aledhari@unt.edu). A. Chehri is with the Department of Mathematics and Computer Science at the Royal Military College of Canada (RMC) in Kingston, Ontario, Canada (e-mail: chehri@rmc.ca). S. Al-Maliki is with the Information and Computing Technology (ICT) Division, College of Science and Engineering, Hamad Bin Khalifa University, Doha 34110, Qatar (e-mail: shalmaliki@hbku.edu.qa). Corresponding Author: Abdellah Chehri, (e-mail: chehri@rmc.ca) ∗ These authors contributed equally to this work.

I. I NTRODUCTION

ISTRIBUTED machine learning (DML) has become a core paradigm for training models across cloud, edge, and Internet of Things (IoT) environments. In these settings, data are often generated by heterogeneous devices, organizations, sensors, and embedded platforms, making centralized collection costly, privacy-sensitive, or infeasible. DML, including conventional distributed training and federated learning (FL), enables collaborative model development while keeping computation and data distributed across resource-diverse participants [1]–[3]. However, distributing learning also expands the attack surface. Model updates, gradients, aggregation logic, communication channels, client identities, and orchestration infrastructure may all become targets. These risks are amplified in IoToriented deployments, where devices often operate with limited compute, energy, and bandwidth resources, and with limited security hardening. In addition, statistical heterogeneity, especially non-independent and identically distributed (nonIID) data, can induce client drift, slow convergence, widen client-level performance disparities, and weaken assumptions behind many robust aggregation and privacy-preserving mechanisms [3], [4]. As a result, poisoning, backdoor insertion, Byzantine update manipulation, gradient leakage, model extraction, and network-level attacks must be studied jointly with system and data heterogeneity [5]. This survey takes a security-centered view of DML in cloud-edge-IoT systems. Rather than providing tutorial-level coverage of generic distributed computing platforms, basic optimization, or cloud ML services, we focus on how threat models, heterogeneity, privacy mechanisms, robustness limits, and deployment constraints interact. FL is treated as a prominent and high-risk instance of DML because it combines distributed data ownership, partial trust, client churn, and non-IID data. The goal is to provide a heterogeneity-aware roadmap for the design, evaluation, and deployment of trustworthy DML systems. A. Related Surveys Prior surveys have examined DML and FL from several complementary perspectives, including distributed training architectures, FL optimization, statistical heterogeneity, privacypreserving learning, adversarial robustness, trustworthiness, and evaluation practice [1], [3], [4], [6], [9]. Other surveys

TABLE I: Comparison of representative surveys related to secure distributed and federated machine learning. ✓ indicates substantial coverage, △ indicates partial or secondary coverage, and ✗ indicates limited or no meaningful coverage. The comparison reflects relative emphasis based on survey scope rather than an exhaustive claim about all topics mentioned in each paper Survey

Year DML / Threat / Heterogeneity AttackFL Trust Model Defense

Privacy / Deploy. / Main Emphasis Protected Eval. / Gov. Comp.

Verbraaken et 2020 ✓ al. [1] Li et al. [3] 2020 ✓

✗

△

✗

△

✓

△

2020 ✓

△

✓

△

et 2021 ✓

△

✓

△

Rodrı́guez2023 ✓ Barroso et al. [7] Zhang et al. [8] 2024 ✓

✓

△

✓

△

✓

△

2024 ✓

✗

✓

△

✗

✓

Wan et al. [10] 2024 ✓

△

✓

✗

△

Nguyen et 2024 ✓ al. [11] Zhao et al. [12] 2025 ✓

△

✗

✓

✗

△

✓

△

Feng et al. [13] 2025 ✓

✓

✗

✓

△

✗

Li et al. [14]

2025 ✓

△

✗

✓

✗

Zhang et al. [15] Uddin et al. [16] Mahmud et al. [17] This survey

2025 ✓

△

✗

△

✓

△

2025 ✓

△

✓

✗

△

2026 ✓

△

✓

△

2026 ✓

✓

Yang et al. [6] Kairouz al. [4]

Chai et al. [9]

focus more directly on FL security, including privacy and integrity attacks, backdoor and Byzantine threats, secure aggregation, and broader trustworthy-FL concerns [7], [8], [11]– [15], [17]. Robust FL and wireless/backdoor-oriented surveys further provide focused taxonomies for specific subareas [10], [16]. As summarized in Table I, existing work provides valuable coverage of individual aspects of DML and FL. However, fewer surveys synthesize the interaction among statistical and system heterogeneity, Byzantine and backdoor robustness, privacy mechanisms such as differential privacy and secure aggregation, stronger protected-computation techniques such as homomorphic encryption (HE), secure multiparty computation (MPC), and trusted execution environments (TEEs), and deployment-oriented concerns such as reproducibility, governance, and operational security. This survey addresses that gap by organizing secure DML around four connected questions: what assets and trust boundaries must be protected; how IoT-oriented heterogeneity changes learning and security assumptions; how attacks and defenses interact under realistic deployment constraints; and how systems should be evaluated beyond predictive accuracy.

Broad distributed deep learning systems survey focused mainly on scalability, orchestration, and infrastructure rather than security. Foundational FL survey covering architectures, statistical heterogeneity, communication efficiency, optimization, and privacy-related challenges. Early FL survey addressing concepts, communication settings, application domains, and adversarial considerations. Landmark FL survey spanning optimization, personalization, privacy, fairness, robustness, and open problems, but not centered on a security-systems roadmap. Comprehensive FL threats survey with attack/defense taxonomies and empirical analysis across privacy and integrity threats. Trustworthy FL survey covering privacy, security, fairness, explainability, and accountability under a broad trustworthiness lens. Survey focused on FL evaluation, benchmarking, metrics, fairness, and performance assessment rather than security mechanisms. Security-focused survey of backdoor attacks and defenses for FL in wireless communication settings. Systematic review of backdoor attacks and defenses in FL, emphasizing attack taxonomy and mitigation trends. Dedicated survey on FL privacy attacks and defenses, including inference risks, mitigation methods, applications, and policy considerations. Security-focused FL survey addressing backdoor, Byzantine, and adversarial threats with corresponding defense taxonomies. Focused survey of backdoor attacks and defenses in FL, including attack settings, triggers, and evaluation criteria. Survey dedicated to secure aggregation in FL, comparing protocol families, efficiency, and deployment trade-offs. Systematic/thematic review of robust FL methods, including clientand server-side robustness strategies, applications, and gaps. Broad FL survey covering architectures, synchronization, and security threats, but without a heterogeneity-centered security synthesis. Security-centered and heterogeneity-aware survey of DML that connects threat models, trust boundaries, heterogeneity, attack-defense interactions, protected computation, evaluation practice, and deployment/governance considerations.

B. Contributions This survey examines trustworthy DML under realistic IoToriented conditions involving non-IID data, resource asymmetry, partial trust, and adaptive adversaries. Its main contributions are: • Threat-centered DML taxonomy: We systematize the attack surface across distributed and FL, including poisoning, backdoors, Byzantine manipulation, privacy leakage, model extraction, and system/network-level attacks. • Heterogeneity-aware security analysis: We analyze how statistical, system, and trust heterogeneity affect convergence, fairness, attack detectability, and the reliability of common defenses. • Defense trade-off synthesis: We compare robust aggregation, differential privacy, secure aggregation, HE, MPC, TEEs, watermarking, fingerprinting, and provenance mechanisms in terms of accuracy, privacy, latency, communication, trust assumptions, and deployment complexity. • Deployment and evaluation guidance: We consolidate IoT-oriented evaluation practices, including attack-aware benchmarking, reproducible non-IID partitions, privacy

Non-IID Heterogeneity

Attack Surface

Defense Portfolio

Label skew

Feature/covariate shift

Byzantine/poisoning

Gradient inversion

Heterogeneityaware optimization

Robust aggregation

Pk (y)

Pk (x)

including backdoors

DLG / iDLG / IG

FedProx, SCAFFOLD

Median, Krum, RFA

Concept shift

Quantity skew

Pk (y | x)

Membership inference

Model extraction/stealing

Secure aggregation

Differential privacy

DP-SGD, PATE

|Dk |

Spatiotemporal skew

Cryptographic ML

IP protection

HE / MPC / TEE

Watermarking

Network tampering / MITM

Sybil & freerider behavior

Client vetting Anomaly scoring; attestation

report heterogeneity

report & certify

→ exacerbates

→ mitigate via

Evaluation & Standards Metrics

Benchmarks

Governance

Accuracy, ASR, per-client fairness DP (ϵ, δ), communication, energy

Standardized non-IID partitions and seeds Public, reproducible attack suites

Model/data cards and threat models Privacy accounting; NIST AI RMF; EU AI Act

Fig. 1: Roadmap for heterogeneity-aware trustworthy DML in cloud-edge-IoT systems. Statistical non-IID heterogeneity can exacerbate poisoning, Byzantine manipulation, privacy leakage, model extraction, network tampering, and Sybil/freerider behavior. These risks motivate a layered defense portfolio spanning heterogeneity-aware optimization, robust and secure aggregation, differential privacy, protected computation, intellectual property (IP) protection, and client vetting. Evaluation should report utility, attack success rate, client-level fairness, privacy budgets, communication/energy overhead, standardized non-IID partitions, public attack suites, and governance artifacts.

budgets, attack success rate, client-level disparity, communication overhead, latency, energy, and governanceoriented reporting. Fig. 1 summarizes the organizing logic of this survey. It illustrates how non-IID data and statistical heterogeneity should be explicitly reported, as they can exacerbate attacks on integrity, privacy, network, and strategic participation. The figure further maps this expanded attack surface to a layered defense portfolio and to evaluation and governance practices needed for trustworthy DML in cloud-edge-IoT systems. C. Paper Organization The remainder of this paper is organized as follows. Section II defines the DML/FL threat model and trust boundaries. Section III analyzes statistical, system, and trust heterogeneity in IoT-oriented DML. Section IV examines major attack surfaces and attack-defense interactions. Section V reviews layered defense mechanisms and their trade-offs. Section VI presents deployment, evaluation, and governance guidelines. Section VII discusses open research directions, and Section VIII concludes the paper.

II. T HREAT M ODEL AND DML T RUST B OUNDARIES Distributed machine learning (DML) distributes data, computation, model updates, and orchestration logic across workers, edge devices, organizational silos, and cloud services. Conventional distributed training often operates within a single administrative domain. In contrast, FL and IoT-oriented DML commonly involve partially trusted clients, intermittent participation, heterogeneous resources, and non-IID local data [1], [3], [4]. From a security perspective, the central issue is therefore not only how models are optimized, but where trust boundaries arise and what information crosses them. A. Assets, Adversaries, and Trust Assumptions The primary assets in DML include raw local data, labels, gradients, model updates, global model parameters, aggregation rules, client identities, communication metadata, audit logs, and deployed model artifacts. In regulated IoT domains such as healthcare, finance, industrial automation, and smart cities, these assets may encode sensitive personal, operational, or proprietary information. Protecting them requires simultaneous attention to confidentiality, integrity, availability, robustness, and model ownership. Adversaries may be external or internal. External adversaries can eavesdrop on, replay, or tamper with model traffic; query deployed models to extract or infer membership; or inject malicious inputs at inference time. Internal adversaries include compromised clients, malicious data owners, curious aggregators, compromised gateways, free-riding participants, and Sybil clients that create multiple identities to bias training or incentives [18]–[20]. Aggregators and cloud providers may be trusted, honest-but-curious, or partially compromised, depending on the deployment model. These assumptions determine whether defenses such as secure aggregation, differential privacy (DP), HE, secure MPC, TEEs, or robust aggregation are appropriate. B. DML/FL Coordination Patterns as Security Boundaries Coordination architecture determines which entities observe local updates, where aggregation occurs, and how failures or attacks propagate. In parameter-server training, workers send gradients or updates to one or more central servers, concentrating trust and making the servers potential bottlenecks, privacyleakage points, and targets for poisoning [3], [21]. Collective communication mechanisms such as AllReduce reduce dependence on a persistent parameter server in trusted clusters. However, they still require authenticated group membership, secure transport, and resilience to faulty participants [22], [23]. Data-parallel, model-parallel, and hybrid-parallel execution also expose different security surfaces. Data parallelism communicates gradients or model deltas from local data shards, making it especially relevant to poisoning, gradient leakage, and robust aggregation. Model and pipeline parallelism communicate activations, gradients, and intermediate states across model partitions, thereby creating additional dependency paths and increasing the risk of fault propagation [24]–[26]. Synchronization further shapes security: synchronous training simplifies aggregation analysis but is vulnerable to stragglers and

denial-of-service behavior, whereas asynchronous or boundedstaleness training improves throughput under heterogeneity but introduces stale updates, replay risk, and weaker anomaly attribution [27]–[29].

A. Statistical Heterogeneity: Non-IID Data, Client Drift, and Fairness Disparity In distributed and FL, client k typically holds data from a local distribution Dk and optimizes fk (w) := E(x,y)∼Dk [ℓ(w; x, y)],

C. IoT-Specific Exposure Points: Edge Clients, Gateways, Aggregators, and Cloud Services

while global training seeks f (w) :=

IoT-oriented DML adds exposure points not typically present in controlled data-center training. Edge clients may have weak hardware isolation, limited patching, intermittent power, and constrained storage or compute. Gateways and roadside/industrial edge nodes may aggregate updates from multiple devices and therefore become attractive targets for poisoning, traffic analysis, or model substitution [30]. Cloud aggregators and ML-as-a-service platforms provide scalability but also introduce concerns related to multi-tenancy, data residency, access control, and model extraction [31]. Beyond conventional FL threat models, IoT deployments introduce physical and operational constraints that directly shape security design [32]. Clients may be battery-powered, intermittently connected, memory-limited, weakly patched, or physically accessible to an adversary. Sensing modalities may also differ across devices, e.g., cameras, accelerometers, medical wearables, industrial vibration sensors, vehicular LiDAR/radar, or environmental sensors, producing modality-specific drift and uneven update quality. In addition to network-level tampering, IoT systems are exposed to physical-layer disruption, sensor spoofing, jamming, device theft, firmware compromise, gateway compromise, and stale or replayed telemetry. These risks make it insufficient to assume that every participating client is continuously available, computationally capable, or semantically trustworthy. Secure IoT DML therefore requires explicit placement decisions across the client, gateway, edge, and cloud layers: lightweight filtering and attestation near devices; buffering, rate control, and anomaly screening at gateways; aggregation, privacy accounting, and provenance at edge/cloud servers; and rollback or fallback policies for safetycritical deployments [33]. Accordingly, IoT DML should be analyzed as a layered system comprising client-side data and local training; gatewaylevel filtering and buffering; server-side aggregation and model governance; and cloud/edge deployment of inference services. Each layer can alter the feasibility and cost of privacy, robustness, and cryptographic defenses [34].

III. H ETEROGENEITY D IMENSIONS IN I OT-O RIENTED DML Heterogeneity is a structural property of IoT-oriented DML rather than an implementation detail. It affects convergence, fairness, privacy leakage, attack detectability, and the reliability of defense mechanisms. We distinguish three interacting forms: statistical heterogeneity, system heterogeneity, and trust heterogeneity.

K X k=1

pk fk (w),

pk ≥ 0,

K X

pk = 1.

k=1

Non-IID data means that the local distributions D1 , . . . , DK differ in feature marginals P (x), label marginals P (y), conditional distributions P (y|x), or data volume. Common forms include label skew, feature or covariate shift, concept shift, quantity skew, and spatiotemporal skew [4], [35]–[37]. Non-IID data induces gradient dissimilarity between local and global objectives. When clients perform multiple local updates before synchronization, local models may drift toward client-specific optima, slowing or destabilizing convergence and increasing client-level performance disparities [3], [38], [39]. See Fig. 2b, 2c, and 2d for the impact of non-IID data on robust aggregation methods and potential solutions. This is not only an optimization concern. Many Byzantine-robust aggregation rules assume that benign updates are relatively concentrated; under severe heterogeneity, honest updates may already appear as outliers, making malicious updates harder to detect [40], [41]. Non-IID evaluations should therefore report both the partition protocol and explicit measures of heterogeneity. A common approach is Dirichlet label partitioning, in which each client’s class proportions are sampled from a Dirichlet distribution with concentration parameter α; smaller α values yield more highly skewed client distributions, whereas larger α values yield more nearly uniform distributions. Common heterogeneity metrics include Earth Mover’s Distance (EMD), the minimum cost of transporting probability mass between distributions; Hellinger distance, a bounded measure of separation between probability distributions; Jensen-Shannon (JS) divergence, a symmetric and bounded variant of KullbackLeibler divergence; and Kullback-Leibler (KL) divergence, a directed measure of relative entropy. Naturally heterogeneous benchmarks include LEAF, FEMNIST, and Shakespeare [37], [39], [42], [43]. These partitioning approaches and metrics are discussed further in the next sections. B. System Heterogeneity: Device, Bandwidth, Energy, and Participation Asymmetry IoT DML systems also exhibit strong system heterogeneity. Clients may differ in processor type, memory, battery level, sensor modality, local storage, communication bandwidth, and reliability. These differences affect which clients participate, how often they synchronize, and how expensive each defense becomes. For example, secure aggregation, MPC, and HE can increase communication or computation overhead; DP can reduce utility under small local datasets; and robust aggregation can require additional client scoring, clipping, or auditing.

0 0

(a) IID data. 50

0 10

(b) Non-IID degradation.

True Average Average Median TrMean Krum GeometricMedian

(d) Bucketing [45].

Fig. 2: Effect of heterogeneity on Byzantine-robust aggregation. Robust rules such as median, trimmed mean, Krum, and geometric median are more reliable when benign updates are concentrated; under non-IID data, honest dispersion can reduce attack detectability. Preprocessing methods such as nearest-neighbor mixing and bucketing can partially mitigate this effect. Data points are from [6], implemented using [46]. System heterogeneity also affects availability and reliability. Stragglers, dropped clients, gateway failures, software incompatibilities, and unstable networks may delay or bias aggregation. Classical mechanisms such as checkpointing, rollback, replication, speculative execution, and elastic scheduling remain relevant, but they must be adapted to continuously evolving model states and repeated communication rounds [22], [47]. Algorithm-based fault tolerance and Byzantineresilient aggregation further link reliability and security, as corrupted updates can arise from either accidental faults or malicious behavior [40], [41], [48]. Energy and latency are also first-class constraints. A statistically effective defense may be infeasible on battery-powered sensors, mobile devices, or real-time industrial/vehicular platforms. Thus, secure IoT DML requires reporting on communication, latency, memory, and energy overhead, as well as accuracy and robustness. C. Trust Heterogeneity: Cross-Device, Cross-Silo, and MultiTenant Settings Trust assumptions vary substantially across deployment settings. In cross-silo FL, participants such as hospitals, banks, or factories may be identifiable institutions with contractual obligations but strict data-governance requirements [49]. In cross-device FL, participation is large-scale, intermittent, and

difficult to vet [50] fully. In multi-tenant cloud ML, the provider, tenants, APIs, and infrastructure introduce additional risks related to access control, isolation, and model extraction. These trust differences directly affect defense selection. Cross-silo deployments may justify TEEs, MPC, contractual audit logs, and stronger identity management [51]. Crossdevice deployments often require secure aggregation, capped client sampling, Sybil resistance, DP, and lightweight anomaly scoring. Multi-tenant MLaaS settings require authenticated interfaces, rate limiting, output control, watermarking, and provenance mechanisms. A defense that is suitable under one trust model may be ineffective or too costly under another. Taken together, these three dimensions of heterogeneity provide the analytical lens for the remainder of the survey. Statistical heterogeneity affects convergence, benignupdate dispersion, fairness, and poisoning detectability; system heterogeneity determines whether defenses are computationally and energetically feasible; and trust heterogeneity determines which privacy, aggregation, cryptographic, provenance, and governance mechanisms are appropriate. Sections IV-VI therefore analyze attacks, defenses, and evaluation practices through these three coupled dimensions rather than treating heterogeneity as a standalone optimization issue. IV. ATTACK S URFACE AND ATTACK -D EFENSE I NTERACTIONS DML attacks target the training pipeline, inference interface, communication substrate, identity layer, and deployed model artifact. Their impact extends beyond aggregate accuracy to safety, privacy, fairness, intellectual property, operational continuity, and regulatory exposure. To move beyond a descriptive taxonomy, Table II compares major attack classes in terms of threat assumptions, adversary capabilities, attack objectives, affected pipeline stages, candidate defenses, and residual defense limitations. The table should be read as an analytical roadmap for the subsections that follow. Section IV-A first examines trainingtime integrity attacks, including poisoning, backdoors, and Byzantine manipulation. The subsequent subsections address privacy and IP leakage; network/orchestration and strategicparticipation attacks; and, finally, the cross-cutting role of heterogeneity in shaping attack detectability and defense reliability. A. Poisoning, Backdoors, and Byzantine Manipulation Training-time attacks corrupt data, labels, local optimization, or communicated updates. In data poisoning, an adversary manipulates local training examples or labels to bias the learned decision function [6], [18]. In model-update poisoning, the attacker directly submits malicious gradients or parameters that need not correspond to any real local dataset. These attacks may target availability by degrading convergence or accuracy or integrity by selectively changing model behavior for chosen inputs or classes. Backdoor attacks are a structured form of integrity poisoning. The model behaves normally on clean inputs but misclassifies inputs containing an attacker-controlled trigger

TABLE II: Analytical comparison of major DML/FL attack classes and defense-composition limits in cloud-edge-IoT systems Attack class

Threat assumptions and adversary capability

Goal stage

Data/model poisoning and backdoors

Malicious clients or data owners can corrupt local data, labels, loss functions, or submitted updates; attackers may be single-client, colluding, or adaptive.

Byzantine manipulation

A bounded or unbounded fraction of clients may submit arbitrary, coordinated, or optimizationaware updates independent of any local dataset. Confidentiality breach during training, aggregation, or inference.

Gradient leakage, membership inference, and property inference An honest-but-curious server, compromised aggregator, eavesdropper, or inference API user observes gradients, updates, model snapshots, or outputs.

and

affected

Primary defenses

Defense limitations and tensions

Availability degradation or targeted integrity failure during local training, update submission, and aggregation. Aggregation-time integrity and convergence disruption.

Robust aggregation, clipping, anomaly scoring, backdoor validation, client vetting, provenance.

Robust rules often assume concentrated benign updates; severe non-IID data can make honest minority updates appear anomalous. Secure aggregation can hide update-level signals needed for anomaly detection. DP noise and clipping may mask weak malicious signals or reduce the utility of rare classes. Guarantees weaken under collusion, high dimensionality, adaptive attacks, client drift, and heterogeneous benign updates. Cryptographic confidentiality does not ensure the semantic correctness of encrypted updates.

DP-SGD/PATE, secure aggregation, HE/MPC, TEEs, output control, privacy accounting.

Secure aggregation hides individual updates but not necessarily leakage from the final model. DP provides formal privacy but may reduce accuracy, fairness, and robustness, especially for small or non-IID clients. HE/MPC/TEEs add latency, memory, communication, energy, or hardware-trust costs. Rate limiting, confidence masking, query monitoring, watermarking, fingerprinting, and provenance.

Model extraction and IP theft

Querying adversary, malicious tenant, or insider can repeatedly access prediction APIs or deployed artifacts.

Model/IP theft during inference and deployment.

Network and orchestration attacks

On-path adversaries, compromised gateways, or orchestration faults can replay, delay, downgrade, substitute, or tamper with updates and control messages.

Sybil, free-rider, and game-theoretic attacks

Open or weakly vetted clients create multiple identities, submit low-effort updates, or strategically adapt to rewards, sampling, and detection rules.

Confidentiality, integrity, and availability failures during communication, scheduling, and synchronization. Bias aggregation, manipulate incentives, or obtain benefits without useful contribution during admission, sampling, and training.

[11], [52]. In FL, model-replacement backdoors are especially dangerous because a small number of malicious clients may implant persistent trigger behavior while preserving high clean accuracy. Byzantine attacks generalize this threat model by allowing malicious clients to submit arbitrary or coordinated updates [53], [54]. Robust aggregation rules such as coordinate-wise median, trimmed mean, Krum, geometric median/Robust Federated Aggregation (RFA), and signSGD with majority vote can reduce the influence of corrupted updates. Still, their guarantees often weaken under strong non-IID data, collusion, or adaptive attack strategies [40], [41], [55].

B. Privacy Leakage, Model Extraction, and IP Threats DML can leak sensitive training information even when raw data are not explicitly shared. Gradient inversion and related reconstruction attacks can recover features or labels from shared gradients or updates, particularly when updates are fine-grained or insufficiently protected [56], [57]. Membership inference attacks attempt to determine whether a specific record was used during training, with strong likelihood-ratio methods demonstrating substantial risk even under blackbox access [58], [59]. Property inference can further reveal aggregate or sensitive attributes about a client population.

Median/trimmed mean, Krum, geometric median/RFA, sign-based aggregation, norm bounding.

Authenticated transport, update signing, replay protection, attestation, secure aggregation, monitoring.

Output restriction can reduce usability and calibration. Watermarking/fingerprinting supports ownership verification but does not prevent poisoning or privacy leakage and may be weakened by fine-tuning, pruning, or model distillation. Channel security cannot stop malicious authenticated clients. Attestation and signing increase key management complexity and may not address denial-of-service attacks, stragglers, or stale-update attacks.

Identity management, capped sampling, reputation, contribution auditing, incentive design, anomaly monitoring.

Privacy-preserving aggregation limits direct auditing of contributions. Reputation systems may be gamed, and strong identity controls can be costly or impractical in cross-device IoT settings.

Model extraction attacks threaten intellectual property by using prediction APIs or exposed inference services to train surrogate models that approximate a proprietary model [60]. These attacks can enable competitive misuse, downstream adversarial transfer, or unauthorized redistribution. Watermarking, fingerprinting, output throttling, confidence masking, query monitoring, and extraction-aware API design are, therefore, important complements to privacy-preserving training. C. Network, Orchestration, and Sybil/Game-Theoretic Attacks DML repeatedly exchanges gradients, model updates, metadata, and control messages across networks. On-path adversaries may eavesdrop, replay, downgrade, substitute, or tamper with updates, enabling privacy leakage, model replacement, or poisoning in transit [56], [61]. Authentication, encrypted transport, update signing, replay protection, secure aggregation, and round-level attestation are therefore necessary system-level protections. Wireless and IoT deployments introduce additional physical-layer (PHY) and medium-access vulnerabilities because training depends on shared, time-varying communication channels [62]. Jamming and selective interference can cause client dropout, delay synchronization, or bias participation toward clients with more reliable connectivity [63]. Spoofing, channel manipulation, and compromised gateways or ac-

cess points can alter client identities, scheduling information, or transmitted updates [64]. In over-the-air aggregation, where wireless signals are superimposed to compute an aggregate, adversarial manipulation of transmission power or waveform may directly bias the resulting update [65]. Wireless backdoor and poisoning attacks can further exploit compromised edge devices and unreliable links while preserving apparently normal clean-model behavior [10]. Evaluations should therefore consider mobility, channel variation, link failures, selective jamming, and compromised network intermediaries alongside conventional poisoning and Byzantine attacks. Open or weakly authenticated FL settings are also vulnerable to Sybil and free-rider attacks. Sybil adversaries create multiple fake clients to amplify poisoning, bias aggregation, or manipulate incentives [18]. Free riders or lazy clients submit fabricated, noisy, or low-effort updates to obtain rewards without contributing useful information [20]. Game-theoretic models are useful for these settings because attackers and defenders adapt strategically through sampling policies, clipping thresholds, acceptance rules, incentives, and reputation mechanisms [66]–[68].

D. How Heterogeneity Changes Attack Detectability and Defense Reliability Heterogeneity changes both attack feasibility and defense reliability. Under IID-like conditions, malicious updates may be easier to identify because benign updates cluster more tightly. Under realistic IoT heterogeneity, however, benign updates vary because of label skew, domain shift, device quality, sensor modality, and participation patterns. This dispersion can cause robust aggregation to reject useful minority-client updates or accept malicious updates that resemble benign outliers [40], [41], [69]. Accordingly, attack evaluation should not rely on a single partition or clean aggregate metric. It should vary the number and participation frequency of malicious clients, the skew severity, the synchronization regime, the client sampling policy, and the defense configuration. Clean accuracy should be reported together with attack success rate (ASR), backdoor persistence, client-level disparity, privacy leakage, communication cost, latency, and energy. V. D EFENSE M ECHANISMS AND T RADEOFFS Securing DML requires coordinated defenses across the learning lifecycle. As summarized in Table III, local-training defenses include drift-aware optimization and differential privacy. Before and during aggregation, secure computation and robust aggregation protect the confidentiality and integrity of updates. After aggregation, watermarking, fingerprinting, and provenance mechanisms support model ownership and accountability. These protections involve trade-offs: privacy mechanisms may reduce utility or increase latency, robust aggregation may reject valid minority-client updates, and cryptographic methods may increase computation, memory, and communication costs.

TABLE III: Defense mechanisms in IoT-oriented DML Phase Local training

Mechanism Drift-aware optimization Differential privacy Cryptographic protection

Reference [3], [35], [38], [70], [71] , [72]–[74] [75], [76] [77]–[79], [80], [81], [82]

Before aggregation

Secure aggregation

[61]

During the aggregation

Robust aggregation

[40], [53]–[55]

After aggregation

Watermarking

[83], [84]

Fingerprinting

[85]

Provenance

[86]

A. Robust Aggregation and Drift-Aware Optimization Robust aggregation methods aim to limit the influence of faulty or malicious updates. Coordinate-wise median, trimmed mean, Krum, geometric-median-based RFA, and signSGD with majority vote are representative approaches [40], [53]– [55]. These methods can improve resilience to Byzantine behavior, but their effectiveness depends on the concentration of benign updates, the adversary fraction, dimensionality, and non-IID data. Severe non-IID data can substantially degrade the performance of FL models protected by robust aggregation methods relative to IID settings [41]. Li et al. [41] evaluated these methods under severe data heterogeneity using Dirichlet(α = 0.1). Under federated stochastic gradient descent (FedSGD), they reported poor accuracy with Krum, Geometric Median (GM), Auto-weighted Geometric Median (AutoGM) [87], and Median relative to their IID counterparts. Under Federated Averaging (FedAvg), performance similarly degraded across the evaluated aggregation methods. The evaluated Byzantine attacks include inner-product manipulation (IPM), which crafts malicious updates to oppose the intended aggregate direction; sign flipping (SF), which reverses or negatively scales client updates; label flipping (LF), which corrupts local training labels; and A Little Is Enough (ALIE), which constructs malicious updates within the apparent statistical range of benign updates to evade detection. On CIFAR-10 with FedAvg, Li et al. [41] evaluated Centered Clipping (CC) with a fixed malicious-client fraction of 25% and reported test accuracy under IID and non-IID data, using Dirichlet(α = 0.1) for the non-IID partition. Alharbi et al. [88] evaluated CC under non-IID data using Dirichlet(α = 0.5), varied the number of attackers, and reported test error. Table IV summarizes the results of the two studies separately. Because the studies use different levels of heterogeneity, attacker configurations, and evaluation metrics, their numerical results are not directly comparable. Within each study, however, the results indicate that CC’s performance can deteriorate substantially under poisoning attacks and nonIID data. Non-IID data can alter both attack effectiveness and defense reliability. Backdoor attacks seek to associate inputs containing

a trigger with an attacker-selected output. In the experiments of Zawad et al. [89], some evaluated backdoor attacks became less effective as data heterogeneity increased. This result is limited to the experimental configurations examined in that study and should not be interpreted as evidence that nonIID data generally protects against backdoor attacks. Zawad et al. [89] also found that, in their experiments, non-IID training caused benign and malicious updates to exhibit similar overfitting characteristics, which reduced the effectiveness of defenses that used overfitting to identify malicious updates. Drift-aware optimization addresses the non-IID conditions that often undermine robustness. F ED P ROX limits local drift through proximal regularization, SCAFFOLD uses control variates to correct client drift, F ED DYN aligns local and global objectives, and F ED O PT variants stabilize server-side optimization [3], [38], [70], [71]. Modeling-layer methods such as F ED BN, personalization, clustered FL, and client-specific heads can further reduce domain shift and fairness disparities [35], [72]–[74]. In security-sensitive settings, these methods should be evaluated jointly with poisoning and Byzantine attacks, not only under benign non-IID training. B. Differential Privacy and Secure Aggregation Differential privacy protects individual training records by limiting the influence of any single example on the released model. Differentially private stochastic gradient descent (DPSGD) clips per-example gradients. It injects calibrated noise, while Private Aggregation of Teacher Ensembles (PATE) uses noisy aggregation of teacher predictions to train a private student model [75], [76]. These methods provide formal privacy guarantees but can reduce utility, especially for small clients, rare classes, or highly non-IID data [90]. Secure aggregation protects communicated updates by ensuring that the server observes only the aggregate sum, not individual client updates [61]. It is particularly useful under an honest-but-curious server model and is often combined with clipping and DP. However, secure aggregation does not, by itself, prevent poisoning or guarantee the privacy of the final model; it must be paired with robust aggregation, anomaly detection, and privacy accounting, tailored to the threat model. C. HE, MPC, and TEE-Based Protected Computation HE, MPC, and TEEs support protected computation when raw data, intermediate values, or local updates should not be exposed. HE enables selected computations over ciphertexts and is most mature for encrypted inference or HE-friendly linear operations. Still, it remains constrained by ciphertext expansion, expensive rotations, bootstrapping, and limited native support for nonlinear operators [77]–[79]. MPC allows parties to jointly compute functions without revealing private inputs, often using secret sharing or mixed protocols; systems such as ABY3 and CrypTen improve practicality but remain sensitive to communication, preprocessing, nonlinear operations, and network conditions [80], [81]. TEEs can execute richer ML logic with lower algorithmic redesign, but they rely on hardware trust, attestation, enclave memory limits, and side-channel resistance [82].

Practically, HE is best suited to carefully redesigned encrypted inference or selected protected operations; MPC is attractive when participants can tolerate communication and preprocessing costs; and TEEs are often engineering-compatible when hardware trust is acceptable. Because energy reporting remains inconsistent, studies should report at least latency, communication volume, memory pressure, and, when possible, joules per inference or per training round. D. Watermarking, Fingerprinting, and Provenance Model watermarking and fingerprinting protect DML model intellectual property by embedding verifiable ownership signals into parameters or model behavior. White-box methods may embed signatures directly into weights, whereas blackbox methods use trigger or behavior-based verification through the prediction interface [83]–[85], [91]. Effective ownership mechanisms should preserve utility, remain stealthy, survive compression or fine-tuning, and support defensible post hoc verification. Provenance mechanisms complement watermarking. Signed model artifacts, versioned checkpoints, client-update logs, secure audit trails, and deployment metadata help establish which data, clients, aggregation rules, and defenses contributed to a released model [86]. In regulated IoT settings, provenance also supports accountability, rollback, incident response, and evidence of compliance. E. Defense Composition: Non-Compositional Trade-offs No defense provides comprehensive protection, and combining defenses does not necessarily yield additive benefits. Secure aggregation improves confidentiality by concealing individual client updates, but this reduced visibility can limit anomaly detection, client scoring, and robust aggregation [4], [40], [61]. Similarly, DP-induced clipping and noise may reduce the statistical separation between benign heterogeneous updates and weak poisoning or backdoor signals. At the same time, aggressive robust filtering may reject useful updates from honest minority clients [75], [90], [92]. The threat model should therefore guide defense composition, required update visibility, heterogeneity level, resource constraints, and residual trust assumptions. Compatibility should be evaluated jointly across confidentiality, integrity, privacy, utility, and operational cost rather than inferred from the effectiveness of each defense in isolation. Section VI and Table V provide deployment-specific guidance and reporting criteria for selecting and evaluating such defense portfolios. VI. D EPLOYMENT, E VALUATION , AND G OVERNANCE G UIDELINES Deployment context determines which threats are most relevant, which defenses are practical, and which evaluation metrics should be reported. In IoT-oriented DML, security design is shaped not only by data sensitivity and trust assumptions, but also by device constraints, intermittent connectivity, heterogeneous sensing modalities, physical exposure, gateway reliability, and edge-cloud orchestration. Representative deployments include industrial sensing, vehicular IoT,

TABLE IV: Centered Clipping (CC) results reported by two independent studies on CIFAR-10 with FedAvg. The left column summarizes test accuracy from [41] using a fixed malicious-client fraction of 25% under IID and non-IID data (Dirichlet α = 0.1 for the non-IID partition). The right column summarizes test error from [88] for non-IID data (Dirichlet, α = 0.5) as the number of attackers varies. Because the studies use different data partitions, attacker configurations, and evaluation metrics, their numerical results are not directly comparable Attack

Test accuracy reported in [41]: IID and non-IID (α = 0.1), 25% malicious clients

Test error reported in [88]: non-IID (α = 0.5), varying attacker counts

Inner Product Manipulation (IPM)

Under IPM with ϵ = 0.5, CC achieves 77.77% test accuracy with IID data and 56.97% with non-IID data. Under the stronger IPM attack with ϵ = 100, its test accuracy falls to 10.00% in both settings.

CC maintains a test error of approximately 60% as the number of IPM attackers increases from 3 to 18.

Sign Flipping (SF)

Under SF, CC achieves only 10.00% test accuracy with both IID and non-IID data.

CC reaches a test error of approximately 90% when the number of SF attackers exceeds 9.

Label Flipping (LF)

Under LF, CC achieves 69.80% test accuracy with IID data and 52.41% with non-IID data.

CC reaches a test error of approximately 90% when the number of LF attackers exceeds 12.

A Little Is Enough (ALIE)

Under ALIE, CC achieves 78.53% test accuracy with IID data and 59.29% with non-IID data.

CC reaches a test error of approximately 90% when the number of ALIE attackers exceeds 12.

smart healthcare and wearables, smart cities/cyber-physical system (CPS), IoT cybersecurity, and cloud-edge IoT services. Table V summarizes these settings by mapping each domain to its typical topology, IoT-specific constraints and threats, recommended defense practices, and reporting metrics. A. IoT-Domain Deployment Constraints Industrial IoT and smart factories require DML designs that tolerate plant-level skew, heterogeneous sensors, legacy devices, intermittent links, gateway faults, and physical manipulation. In these settings, model failures can affect product quality, safety, downtime, and operational continuity; therefore, defenses should combine authenticated communication, device identity management, gateway-level anomaly screening, drift monitoring, robust aggregation, provenance, and fail-safe rollback policies [93]–[95]. Vehicular IoT and connected/autonomous vehicles operate under a different regime: highly mobile clients, intermittent vehicle-to-everything (V2X) connectivity, spatiotemporal data skew, strict tail-latency requirements, and safety-critical exposure to poisoning, backdoors, stale updates, sensor spoofing, and jamming. These deployments, therefore, require hierarchical vehicle-RSUedge/cloud aggregation, stale-update control, signed updates, distribution-aware robustness, backdoor stress testing, and local fallback policies when communication or aggregation is delayed [3], [6], [98]. Smart healthcare and wearable systems introduce privacysensitive, patient-level non-IID data collected from batterypowered, memory-constrained, and intermittently connected devices. Wearable clients may also experience sensor drift, missing measurements, device loss, or compromise. As a result, IoT-health deployments should favor lightweight local training, dropout-tolerant secure aggregation, carefully budgeted DP, fairness auditing across patients or clinical sites, and stronger attestation or audit controls for managed medical gateways [100], [101]. Human-centered IoT sensing also includes behavioral biometrics, in which user-specific patterns captured by commodity devices support authentication and personalization [111].

For example, Huang et al. [112] developed a smartphonebased, content-independent handwriting authentication system that abstracts identity-discriminative writing style from the specific written content. Such applications illustrate an important trustworthy-learning tension: behavioral signals must remain sufficiently stable for identity recognition while being robust to content variation, sensor variability, imitation, and distribution shift [113]. When these models are trained collaboratively, raw handwriting trajectories, learned representations, and shared updates should also be treated as identity-sensitive information requiring privacy protection, secure aggregation, and robustness evaluation. Smart-city and CPS deployments combine heterogeneous ownership, district-level domain shift, public-service reliability requirements, personally identifiable data, and physical-layer disruptions affecting cameras, meters, roadside units, or environmental sensors. These settings require cross-domain governance, secure aggregation, DP when personally identifiable information (PII) is present, personalization or clustered FL for spatial skew, audit logs, and resilience testing under device, gateway, and link failures [102], [103]. Cloud-edge IoT services add orchestration-level constraints that generic FL threat models do not capture. Training, filtering, aggregation, monitoring, privacy accounting, and rollback may be split across devices, gateways, edge servers, and cloud platforms. This placement affects latency, energy, communication cost, data residency, attack visibility, and trust boundaries. Cloud-hosted DML and MLaaS further introduce multitenancy, access control, model extraction, API abuse, cost, and carbon constraints, motivating authenticated interfaces, rate limiting, output control, provenance, deployment gates, model rollback, and explicit reporting of energy and carbon overhead [1], [31], [106], [114]–[117]. Across these domains, security claims should be scoped to the concrete IoT topology rather than stated generically. Crosssilo healthcare or industrial FL may tolerate stronger identity management, TEEs, MPC, and audit trails. In contrast, crossdevice wearable or vehicular FL often requires lightweight client sampling, asynchronous participation, dropout-tolerant

TABLE V: IoT-centered DML deployment settings, constraints, design guidelines, and reporting metrics. Abbrev.: DP = differential privacy; DP-SGD = differentially private stochastic gradient descent; HE = homomorphic encryption; MPC = secure multiparty computation; TEE = trusted execution environment; RSU = roadside unit; ASR = attack success rate; SLO = service-level objective; OEE = overall equipment effectiveness; PHI = protected health information; AUROC = area under the receiver operating characteristic curve; AUPRC = area under the precision-recall curve; DDoS = distributed denial of service; IDS = intrusion detection system; TPR = true-positive rate; FPR = false-positive rate IoT domain / setting Industrial sensing / IIoT

Use cases Predictive maintenance; quality inspection; adaptive scheduling

DML pattern / topology Cross-silo FL; plant gatewayedge/cloud hybrid; periodic or eventdriven synchronization

IoT-specific constraints and threats Plant/site skew, heterogeneous sensors, legacy devices, intermittent links, constrained gateways, physical tampering, gateway compromise, data locality, and operational safety

Vehicular IoT

Cooperative perception; fleet learning; controller/model updates

Cross-device FL; hierarchical vehicleRSU-edge/cloud learning

High mobility, spatiotemporal skew, intermittent V2X links, stale updates, strict tail latency, physical/environmental interference, and safety-critical poisoning/backdoors

Smart healthcare and wearables

Wearable monitoring; collaborative diagnostics; outcome prediction; imaging

Cross-device wearable FL; cross-silo hospital FL; edge/cloud orchestration

PHI sensitivity, patient/site-level non-IID data, cohort shift, label imbalance, battery limits, small memory, intermittent participation, sensor drift, missing measurements, and device loss or compromise

Smart cities / CPS

Traffic control; energy response; environmental monitoring; anomaly detection

Cross-domain FL across agencies/utilities; edge federation across cameras, meters, roadside units, and gateways

Device heterogeneity, district-level domain shift, heterogeneous ownership, PII exposure, public-service reliability, physical-layer disruption, and unreliable clients/gateways

IoT cybersecurity

DDoS/IDS; malware detection; log and telemetry analytics

Cross-tenant or cross-organization FL; streaming edge telemetry; gateway/cloud aggregation

Highly non-IID traffic, adaptive adversaries, poisoned telemetry, compromised clients/gateways, tenant isolation, model/IP exposure, and evolving attacks

Cloud-edge IoT services

Managed IoT training/inference; federated MLOps; edge analytics

Device/gateway streams with cloudhosted training, inference, monitoring, and rollback

Edge-cloud placement, multi-tenancy, access control, model extraction, orchestration faults, data residency, cost, and energy/carbon constraints

aggregation, energy-aware scheduling, and fallback operation. Thus, trustworthy IoT-oriented DML should report not only clean utility and attack success rate, but also client dropout, stale-update rate, communication overhead, memory footprint, tail latency, energy consumption, fairness across sites or device groups, and residual trust assumptions. B. Attack-Aware Benchmarks and Reproducibility DML evaluations should be reproducible and attack-aware. For non-IID studies, authors should specify the skew type, partition-generation protocol, Dirichlet α or equivalent parameter, client sampling policy, number of clients, malicious-client fraction, and random seeds. When possible, studies should use open-source evaluation frameworks or release partitions and scripts [9], [42]. For security evaluation, attack settings should include poisoning, backdoors, Byzantine manipulation, gradient leakage, membership inference, model extraction, and network tampering when relevant to the claimed threat model. Robustness should be tested under multiple skew severities rather than a single near-IID partition. Backdoor studies should report both clean accuracy and ASR; privacy studies should report ϵ/δ, attack success, and any utility loss; and robust aggregation studies should report breakdown behavior under different malicious-client fractions and non-IID regimes. C. Non-IID Data Partition Dirichlet partitioning is one of the most widely used approaches for simulating non-IID data [37], [41], [118], [119]. Its concentration parameter α controls the degree of

Recommended defenses / practices Authenticated transport, device identity management, gateway-level anomaly screening, non-IID-aware aggregation, robust aggregation, provenance, drift monitoring, and fail-safe rollback policies [93]–[97] Hierarchical aggregation, stale-update control, signed updates, distribution-aware robust aggregation, poisoning/backdoor stress tests, edge placement for latency-sensitive tasks, and local fallback policies [3], [6], [98], [99] Lightweight local training, dropout-tolerant secure aggregation, DP-SGD/PATE with explicit privacy accounting, selected HE/MPC or TEE support for sensitive operations, gateway buffering, attestation for managed devices, and fairness auditing across patients/sites [3], [99]– [101] Cross-domain governance, secure aggregation, DP when PII is present, personalization/FedBN or clustered FL for spatial skew, authenticated communication, audit logs, and resilience testing under device, gateway, and link failures [99], [102]–[105] Byzantine-robust aggregation, clipping/norm bounds, secure aggregation where compatible, attack-aware benchmarks, provenance, authenticated telemetry, query/interface monitoring, and model watermarking/fingerprinting when IP risk is high [6], [7], [106], [107] Access control, authenticated APIs, rate limiting, output control, provenance, deployment gates, model rollback, explicit placement of filtering/aggregation/privacy accounting, and energy/carbon-aware scheduling [106], [108]– [110]

Metrics to report OEE/throughput, defect rate, downtime, false alarms, ASR, communication, latency, memory, energy, and fairness across lines/sites mAP or task utility, tail/edge latency, stale-update rate, link dropout, ASR, backdoor persistence, client-drift metrics, and communication/energy cost AUROC/AUPRC, DP ϵ/δ, per-site or per-patient disparity, dropout rate, ASR, latency, memory, communication, and battery/energy overhead

Service reliability, availability, traveltime or response utility, privacy budget, ASR, fairness by district/site, communication overhead, latency, and energy

TPR@FPR, false positives, ASR/backdoor persistence, detection latency, communication, memory, energy, and model-extraction risk

Cost/hour, time-to-accuracy, SLO adherence, tail latency, extraction risk, memory, energy, kgCO2 e, and rollback frequency

heterogeneity: smaller values, such as 0.1-0.5, generally produce highly skewed client distributions, whereas larger values produce more nearly uniform distributions [41]. Another common approach is class-based partitioning, which restricts the number of classes assigned to each client. For example, the one-class and two-class settings in [39] assign data from only one or two classes, respectively, to each client. To model heterogeneity that varies across both geographic locations and time, Jimenez et al. [37] employed the St-Dirichlet method to generate spatiotemporal non-IID partitions. Alternatively, benchmark suites such as LEAF [42] and OARF [120] provide naturally heterogeneous federated datasets for more realistic evaluation. D. Non-IID Metrics To determine whether a data distribution is non-IID, a quantitative metric is often used to measure its distance from a global (aggregated) distribution. As research on quantifying the level of non-IID advances, common distribution-based non-IID metrics, including EMD [39], Hellinger distance, Jensen-Shannon divergence [121], and KL divergence [122], are being used to characterize the non-IID in label distribution, feature distributions, and data volume distributions across participating clients [123]. For example, during the FL initialization phase, EMD was used to measure the total cost of moving a client’s label distribution to another client ’s [39]. A large cost value indicates a significant difference between the two local distributions [39], leading to poor performance of the FL global model. Furthermore, the Jensen-Shannon divergence quantifies the dissimilarity between pairs of client label distributions, revealing the extent of distributional heterogeneity

across federated image, audio, video, and text datasets [121]. In the FL model aggregation phase, the KL divergence allows the server to adaptively assign weights based on how well a client’s model weight distribution aligns with the aggregated model weight distribution [122]. E. Metrics Beyond Accuracy: ASR, Privacy Budget, Disparity, Latency, Communication, and Energy Average test accuracy is insufficient for trustworthy DML. At minimum, evaluation should report clean model utility, attack success rate [124], poisoned-versus-clean trade-offs, privacy budget [125], [126], client-level or site-level disparity, convergence behavior [127], communication overhead [128], latency [129], memory [125], and energy [130]. For safetycritical or IoT settings, additional metrics may include tail latency, availability, rollback frequency, fairness by site or district, domain-drift indicators, and service-level objective adherence [99], [131]. Energy and carbon should be reported using a clear boundary, such as client-side compute, server-side compute, enclave, or cryptographic accelerator costs, and network transfer energy. When direct power measurement is unavailable, latency and communication volume should be reported as firstorder proxies, especially for HE-, MPC-, TEE-, and secureaggregation-based systems. F. Open-Source Evaluation Frameworks Evaluation-oriented techniques aim to assess and compare FL algorithms according to diverse dimensions: non-IID data partitions (data heterogeneity) and device heterogeneity [132], data-type and task scalability [121], robustness against adversarial threats [46], [133], [134]. Each offers structured guidance for implementing new algorithms, along with standardized evaluation protocols for fair and replicable comparisons. Beyond test accuracy metrics, FedScale [121] provides software tools to measure system performance in terms of wall-clock time, communication cost, and device availability duration [121]. LEAF [42] provides realistic FL datasets while [135] simulated non-IID data silo cases by using six different partition strategies. Under the effects of data heterogeneity, BYZFL [46], FedSecurity [134], and FLPoison [133] focus on systematically evaluating the robustness of various defense mechanisms against data, model poisoning, and FL privacy attacks using ASR and other specific metrics. Table VI illustrates a comparative analysis of the open-source FL algorithm benchmarking tools. FLHetBench [132] evaluates FL algorithms under differences in device computational capability and availability. Using this framework, Zhang et al. found that longer wallclock times and lower resource utilization were associated with lower model accuracy in the device-heterogeneous settings they evaluated. Other benchmarking frameworks provide standardized evaluation protocols and metrics for multimodal data [136], large language models [134], and safety-critical domains [137].

G. Governance Artifacts and Compliance-Oriented Reporting Governance translates technical guarantees into deployable evidence. A trustworthy DML deployment should document the threat model, trust assumptions, client admission policy, aggregation rule, privacy mechanism, non-IID evaluation protocol, attack suite, known defense limitations, and rollback or incident-response procedure [139]. Audit logs, signed checkpoints, model cards, data-use records, privacyaccounting reports, and provenance metadata support both internal accountability and external compliance. Security should also be integrated into MLOps [140]. Promotion gates should require attack-aware validation before a model is deployed; runtime monitors should track drift, abnormal client behavior, ASR indicators, and privacy-relevant query patterns; and rollback mechanisms should be available when poisoning, backdoors, or severe performance drift are detected. In this view, adversarial robustness is not a one-time experiment but a lifecycle property that must be monitored, documented, and periodically revalidated [141]. VII. O PEN R ESEARCH D IRECTIONS The preceding sections show that trustworthy DML in cloud-edge-IoT systems cannot be achieved through isolated defenses. Robustness, privacy, heterogeneity management, protected computation, incentive design, reproducibility, and governance must be treated as interacting design requirements. This section summarizes the main open research directions that follow from this security-centered view. A. Heterogeneity-Aware Security Benchmarks A major barrier to progress is the lack of widely accepted benchmarks for evaluating attacks and defenses under realistic non-IID conditions. Existing studies often use different partition generators, skew severities, client-sampling policies, attacker fractions, and reporting metrics, making results difficult to compare. Future benchmarks should provide public partitions, fixed seeds, explicit heterogeneity diagnostics, and standardized attack suites covering poisoning, backdoors, Byzantine behavior, privacy leakage, and model extraction. Metrics such as Dirichlet α, Earth Mover’s Distance, Hellinger distance, Jensen-Shannon divergence, quantity-skew indices, and client-level performance should be reported alongside clean accuracy and attack success rate [9], [11], [37]. B. Distribution-Aware Robustness Under Adaptive Attacks Robust aggregation remains fragile when benign updates are naturally dispersed due to label skew, feature shift, class imbalance, or spatiotemporal variation. Future work should develop defenses whose breakdown behavior is explicitly characterized under heterogeneous benign updates rather than near-IID assumptions. This includes robust aggregation, client vetting, anomaly scoring, and backdoor detection methods that distinguish malicious deviations from legitimate minority-client behavior. Evaluation should vary skew severity, maliciousclient fraction, attacker participation frequency, synchronization regime, and client-sampling policy, while reporting both global and per-client outcomes [37], [40], [41].

TABLE VI: Comparison of open-source federated learning benchmark tools Ref.

Non-IID data partitioning

Supported attacks and defenses

Reported metrics

[42]

Federated image datasets (FEMNIST and CelebA), text datasets (Sentiment140, Shakespeare, and Reddit), and a synthetic tabular dataset.

No support.

Statistical metrics: device-level test accuracy, training loss, and number of samples per user. System metrics: total computation across devices, measured in FLOPs, and client-server network traffic, measured in bytes written.

[135]

Label-distribution skew based on fixedsample and Dirichlet partitioning; featuredistribution skew based on Gaussian and cube-based sampling; quantity skew based on a Dirichlet distribution; and FEMNIST.

No support.

Test accuracy, computation time (seconds), and communication volume (MB).

[121]

Twenty real-world FL datasets spanning different scales and task categories, together with a client system-behavior dataset.

Limited support.

Accuracy or loss, rounds to target accuracy, time to target accuracy, power (W), energy (J), latency (seconds), wall-clock time, communication cost, and deviceavailability duration.

[46]

Dirichlet- and gamma-similarity-based distributions.

Attacks: six Byzantine attacks. Defenses: four pre-aggregation methods and ten Byzantine-robust aggregation methods.

Test accuracy, training loss, and worst-case accuracy.

[134], [138]

Dirichlet partitioning; LEAF datasets (FEMNIST and Shakespeare); and PubMedQA.

Attacks: four model-poisoning, two datapoisoning, and three data-reconstruction methods. Defenses: twelve preaggregation, three aggregation-stage, and two post-aggregation methods.

Test accuracy and test loss.

[133]

Dirichlet partitioning and FEMNIST.

Attacks: eight model-poisoning, two datapoisoning, and five hybrid-poisoning methods. Defenses: six methods against data poisoning and fifteen methods against model poisoning.

Test accuracy, attack success rate (ASR), targeted attack impact, and targeted defense robustness.

C. End-to-End Privacy Leakage Measurement Privacy leakage in DML depends on training mode, architecture, normalization layers, gradient granularity, clipping, mixed precision, microbatching, and whether secure aggregation is enabled. Yet privacy evaluations are often conducted under simplified configurations. Future studies should jointly report formal privacy budgets, reconstruction quality, membership inference performance, model utility, and system overhead under realistic training pipelines. DP-SGD, PATE, secure aggregation, output control, and cryptographic protection should be evaluated as composable defenses rather than isolated mechanisms [61], [75], [76], [142], [143]. D. Practical Protected Computation for IoT DML HE, MPC, and TEEs are increasingly relevant for privacypreserving DML, but their deployment costs remain highly workload-dependent. HE still faces ciphertext expansion, bootstrapping cost, rotation overhead, and limited native support for nonlinear operators. MPC can support richer computation but often shifts cost to communication, preprocessing, and interaction. TEEs preserve more standard ML execution patterns but rely on hardware trust, attestation, enclave-memory limits, and side-channel resistance. Future research should prioritize predictable performance, compiler support, operator libraries, autotuning, profiling, and end-to-end integration with DML workflows, especially for latency- and energy-constrained IoT deployments [77]–[82].

E. Joint Robustness, Privacy, Fairness, and Efficiency Optimization Many defenses improve one dimension while weakening another. Differential privacy can reduce leakage but may degrade utility or exacerbate client-level disparities in severely non-IID data. Secure aggregation protects individual updates but can limit server-side anomaly detection. Robust aggregation can reduce the impact of poisoning but may suppress valid minority-client updates. Cryptographic protection can strengthen confidentiality but increase latency, memory, communication, and energy costs. Future work should move toward Pareto-style evaluation that jointly reports clean utility, ASR, privacy budget, per-client disparity, convergence, latency, communication, memory, energy, and carbon footprint [109], [110], [121]. F. Incentive-Compatible and Sybil-Resistant Participation Open and cross-device DML systems are vulnerable to free-riding, sparse participation, collusion, and Sybil behavior. Existing defenses often treat malicious clients as static adversaries, whereas real participants may adapt strategically to rewards, privacy costs, computational burdens, and detection policies. Future research should integrate mechanism design, reputation, attestation, contribution valuation, and participation control to encourage truthful behavior while limiting adversarial influence. Such methods must remain effective under non-IID data, intermittent availability, and privacy-preserving

aggregation, where direct inspection of local updates may be limited [18]–[20], [144]. G. Governance, Reproducibility, and Lifecycle Assurance Secure DML research also needs stronger reproducibility and governance practices. Reproducible studies should release partitions, seeds, attack scripts, defense configurations, telemetry, and system-cost measurements where possible. Governance-oriented deployments should translate technical controls into auditable artifacts, including threat models, privacy-accounting reports, model cards, data-use records, signed checkpoints, risk registers, and incident-response procedures. Future work should map technical guarantees to regulatory and institutional requirements so that secure aggregation, DP, provenance, and monitoring can support complianceoriented review rather than remain purely technical claims [9], [121], [145], [146]. Overall, future progress in trustworthy DML will depend on integrated, deployment-aware research that jointly addresses heterogeneity, privacy leakage, adversarial robustness, protected computation, incentive alignment, reproducibility, and governance. The field should move beyond isolated algorithmic defenses toward lifecycle-oriented secure DML systems that can be evaluated, deployed, monitored, and audited under realistic cloud-edge-IoT conditions. VIII. C ONCLUSION Distributed machine learning (DML) enables collaborative model development without requiring complete data centralization, but it also introduces interconnected risks to security, privacy, reliability, and fairness. This survey examined these risks across conventional distributed learning and federated learning in cloud-edge-IoT environments. A central conclusion is that heterogeneity is not merely an optimization issue. Non-IID data, resource asymmetry, intermittent participation, and unequal trust can affect attack effectiveness, anomaly detection, robust aggregation, privacy protection, and client-level fairness. Security evaluations must therefore state their threat and trust assumptions and test defenses under representative heterogeneity and system conditions. No individual mechanism protects the entire DML lifecycle. Dependable deployments require complementary controls for local training, aggregation, communication, model ownership, monitoring, and recovery. Their evaluation should extend beyond clean accuracy to include attack effectiveness, privacy guarantees, client-level disparities, system overhead, and reproducibility. Progress toward trustworthy DML will depend on defenses that remain effective, auditable, and operationally practical under realistic cloud-edge-IoT conditions. R EFERENCES [1] J. Verbraeken, M. Wolting, J. Katzy, J. Kloppenburg, T. Verbelen, and J. S. Rellermeyer, “A survey on distributed machine learning,” ACM Computing Surveys (CSUR), vol. 53, no. 2, pp. 1–33, 2020. [2] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics. Pmlr, 2017, pp. 1273–1282.

[3] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated learning: Challenges, methods, and future directions,” IEEE Signal Processing Magazine, vol. 37, no. 3, pp. 50–60, 2020. [4] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al., “Advances and open problems in federated learning,” Foundations and trends® in machine learning, vol. 14, no. 1–2, pp. 1–210, 2021. [5] X. Yuan, P. He, Q. Zhu, and X. Li, “Adversarial Examples: Attacks and Defenses for Deep Learning,” IEEE transactions on neural networks and learning systems, vol. 30, no. 9, pp. 2805–2824, 9 2019. [6] Z. Yang, A. Gang, and W. U. Bajwa, “Adversary-resilient distributed and decentralized statistical inference and machine learning: An overview of recent advances under the byzantine threat model,” IEEE Signal Processing Magazine, vol. 37, no. 3, pp. 146–159, 2020. [7] N. Rodrı́guez-Barroso, D. Jiménez-López, M. V. Luzón, F. Herrera, and E. Martı́nez-Cámara, “Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,” Information Fusion, vol. 90, pp. 148–173, 2023. [8] Y. Zhang, D. Zeng, J. Luo, X. Fu, G. Chen, Z. Xu, and I. King, “A survey of trustworthy federated learning: Issues, solutions, and challenges,” ACM Transactions on Intelligent Systems and Technology, vol. 15, no. 6, pp. 1–47, 2024. [9] D. Chai, L. Wang, L. Yang, J. Zhang, K. Chen, and Q. Yang, “A survey for federated learning evaluations: Goals and measures,” IEEE transactions on knowledge and data engineering, vol. 36, no. 10, pp. 5007–5024, 2024. [10] Y. Wan, Y. Qu, W. Ni, Y. Xiang, L. Gao, and E. Hossain, “Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,” IEEE Communications Surveys & Tutorials, vol. 26, no. 3, pp. 1861–1897, 2024. [11] T. D. Nguyen, T. Nguyen, P. Le Nguyen, H. H. Pham, K. D. Doan, and K.-S. Wong, “Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions,” Engineering Applications of Artificial Intelligence, vol. 127, p. 107166, 2024. [12] J. Zhao, S. Bagchi, S. Avestimehr, K. Chan, S. Chaterji, D. Dimitriadis, J. Li, N. Li, A. Nourian, and H. Roth, “The federation strikes back: A survey of federated learning privacy attacks, defenses, applications, and policy landscape,” ACM Comput. Surv., vol. 57, no. 9, Apr. 2025. [Online]. Available: https://doi.org/10.1145/3724113 [13] Y. Feng, Y. Guo, Y. Hou, Y. Wu, M. Lao, T. Yu, and G. Liu, “A survey of security threats in federated learning,” Complex & Intelligent Systems, vol. 11, no. 2, p. 165, 2025. [14] Z. Li, J. Lan, Z. Yan, and E. Gelenbe, “Backdoor attacks and defense mechanisms in federated learning: A survey,” Information Fusion, vol. 123, p. 103248, 2025. [15] X. Zhang, Y. Luo, and T. Li, “A review of research on secure aggregation for federated learning,” Future Internet, vol. 17, no. 7, p. 308, 2025. [16] M. P. Uddin, Y. Xiang, M. Hasan, J. Bai, Y. Zhao, and L. Gao, “A systematic literature review of robust federated learning: Issues, solutions, and future research directions,” ACM Computing Surveys, vol. 57, no. 10, pp. 1–62, 2025. [17] F. Mahmud, F. Mahmud, and R. M. Rahman, “A survey of federated learning: Advances in architecture, synchronization, and security threats.” Computers, Materials & Continua, vol. 86, no. 3, 2026. [18] C. Fung, C. J. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv preprint arXiv:1808.04866, 2018. [19] M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20), 2020, pp. 1605–1622. [20] Y. Fraboni, R. Vidal, and M. Lorenzi, “Free-rider attacks on model aggregation in federated learning,” in International conference on artificial intelligence and statistics. PMLR, 2021, pp. 1846–1854. [21] M. Li, D. G. Andersen, J. W. Park, A. J. Smola, A. Ahmed, V. Josifovski, J. Long, E. J. Shekita, and B.-Y. Su, “Scaling Distributed Machine Learning with the Parameter Server,” in 11th {USENIX} Symposium on Operating Systems Design and Implementation ({OSDI} 14). Broomfield, CO: {USENIX} Association, 10 2014, pp. 583–598. [Online]. Available: https://www.usenix.org/conference/ osdi14/technical-sessions/presentation/li mu [22] R. Mayer and H.-A. Jacobsen, “Scalable deep learning on distributed infrastructures: Challenges, techniques, and tools,” ACM Computing Surveys (CSUR), vol. 53, no. 1, pp. 1–37, 2020. [23] “NVIDIA Collective Communications Library (NCCL) — NVIDIA Developer.” [Online]. Available: https://developer.nvidia.com/nccl

[24] M. Shoeybi, M. Patwary, R. Puri, P. LeGresley, J. Casper, and B. Catanzaro, “Megatron-lm: Training multi-billion parameter language models using model parallelism,” arXiv preprint arXiv:1909.08053, 2019. [25] Y. Huang, Y. Cheng, A. Bapna, O. Firat, D. Chen, M. Chen, H. Lee, J. Ngiam, Q. V. Le, Y. Wu et al., “Gpipe: Efficient training of giant neural networks using pipeline parallelism,” Advances in neural information processing systems, vol. 32, 2019. [26] D. Narayanan, M. Shoeybi, J. Casper, P. LeGresley, M. Patwary, V. Korthikanti, D. Vainbrand, P. Kashinkunti, J. Bernauer, B. Catanzaro et al., “Efficient large-scale language model training on gpu clusters using megatron-lm,” in Proceedings of the international conference for high performance computing, networking, storage and analysis, 2021, pp. 1–15. [27] J. Chen, X. Pan, R. Monga, S. Bengio, and R. Jozefowicz, “Revisiting distributed synchronous sgd,” arXiv preprint arXiv:1604.00981, 2016. [28] A. Sapio, M. Canini, C.-Y. Ho, J. Nelson, P. Kalnis, C. Kim, A. Krishnamurthy, M. Moshref, D. Ports, and P. Richtárik, “Scaling distributed machine learning with {In-Network} aggregation,” in 18th USENIX Symposium on Networked Systems Design and Implementation (NSDI 21), 2021, pp. 785–808. [29] H. Cui, J. Cipar, Q. Ho, J. K. Kim, S. Lee, A. Kumar, J. Wei, W. Dai, G. R. Ganger, P. B. Gibbons et al., “Exploiting bounded staleness to speed up big data analytics,” in 2014 USENIX Annual Technical Conference (USENIX ATC 14), 2014, pp. 37–48. [30] P. Mahadevappa, R. Al-amri, G. Alkawsi, A. A. Alkahtani, M. F. Alghenaim, and M. Alsamman, “Analyzing threats and attacks in edge data analytics within iot environments,” IoT, vol. 5, no. 1, pp. 123–154, 2024. [31] J. Liu and P. Cui, “Data heterogeneity modeling for trustworthy machine learning,” in Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2, 2025, pp. 6086–6095. [32] M. K. Quan, P. N. Pathirana, M. Wijayasundara, S. Setunge, D. C. Nguyen, C. G. Brinton, D. J. Love, and H. V. Poor, “Federated learning for cyber physical systems: a comprehensive survey,” IEEE Communications Surveys & Tutorials, 2025. [33] M. Goudarzi, M. Palaniswami, and R. Buyya, “A distributed deep reinforcement learning technique for application placement in edge and fog computing environments,” IEEE Transactions on Mobile Computing, vol. 22, no. 5, pp. 2491–2505, 2023. [34] A. Al-Dulaimy, M. Jansen, B. Johansson, A. Trivedi, A. Iosup, M. Ashjaei, A. Galletta, D. Kimovski, R. Prodan, K. Tserpes et al., “The computing continuum: From iot to the cloud,” Internet of Things, vol. 27, p. 101272, 2024. [35] X. Li, M. Jiang, X. Zhang, M. Kamp, and Q. Dou, “Fedbn: Federated learning on non-iid features via local batch normalization,” arXiv preprint arXiv:2102.07623, 2021. [36] Q. Li, B. He, and D. Song, “Model-contrastive federated learning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 10 713–10 722. [37] D. M. Jimenez-Gutierrez, M. Hassanzadeh, A. Anagnostopoulos, I. Chatzigiannakis, and A. Vitaletti, “A thorough assessment of the noniid data impact in federated learning,” Journal of Industrial Information Integration, p. 101052, 2025. [38] S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for federated learning,” in International conference on machine learning. PMLR, 2020, pp. 5132–5143. [39] Y. Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V. Chandra, “Federated learning with non-iid data,” arXiv:1806.00582, 2018. [40] K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” IEEE Transactions on Signal Processing, vol. 70, pp. 1142–1154, 2022. [41] S. Li, E. C.-H. Ngai, and T. Voigt, “An experimental study of byzantinerobust aggregation schemes in federated learning,” IEEE Transactions on Big Data, vol. 10, no. 6, pp. 975–988, 2024. [42] S. Caldas, S. M. K. Duddu, P. Wu, T. Li, J. Konečnỳ, H. B. McMahan, V. Smith, and A. Talwalkar, “Leaf: A benchmark for federated settings,” arXiv preprint arXiv:1812.01097, 2018. [43] K.-Y. Chen, C.-R. Shyu, Y.-Y. Tsai, W. I. Baskett, C.-Y. Chang, C.-Y. Chou, J. J. Tsai, and Z.-Y. Shae, “Effective non-iid degree estimation for robust federated learning in healthcare datasets,” Journal of Healthcare Informatics Research, pp. 1–28, 2025. [44] Y. Allouah, S. Farhadkhani, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan, “Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity,” in International Conference on Artificial Intelligence and Statistics. PMLR, 2023, pp. 1232–1300.

[45] S. P. Karimireddy, L. He, and M. Jaggi, “Byzantine-robust learning on heterogeneous datasets via bucketing,” in International Conference on Learning Representations, 2022. [Online]. Available: https://openreview.net/forum?id=jXKKDEi5vJt [46] M. González, R. Guerraoui, R. Pinot, G. Rizk, J. Stephan, and F. Taı̈ani, “Byzfl: Research framework for robust federated learning,” arXiv preprint arXiv:2505.24802, 2025. [47] L. Myllyaho, M. Raatikainen, T. Männistö, J. K. Nurminen, and T. Mikkonen, “On misbehaviour and fault tolerance in machine learning systems,” Journal of Systems and Software, vol. 183, p. 111096, 2022. [48] S. Roffe and A. D. George, “Evaluation of algorithm-based fault tolerance for machine learning and computer vision under neutron radiation,” in 2020 IEEE Aerospace Conference. IEEE, 2020, pp. 1–9. [49] A. Kyriakidou-Zacharoudiou, E. Tsappi, and M. Georgiades, “Toward a federated organizational intelligence capability model: Cross-silo federated learning as a distributed dynamic capability,” Sustainability, vol. 18, no. 10, p. 4762, 2026. [50] K. Pfeiffer, M. Rapp, R. Khalili, and J. Henkel, “Federated learning for computationally constrained heterogeneous devices: A survey,” ACM Computing Surveys, vol. 55, no. 14s, pp. 1–27, 2023. [51] A. Korneev and J. Ramon, “A survey on verifiable cross-silo federated learning,” Transactions on Machine Learning Research, Jun. 2025. [Online]. Available: https://openreview.net/forum?id=uMir8UIHST [52] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics. PMLR, 2020, pp. 2938–2948. [53] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” Advances in neural information processing systems, vol. 30, 2017. [54] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in International conference on machine learning. Pmlr, 2018, pp. 5650–5659. [55] J. Bernstein, J. Zhao, K. Azizzadenesheli, and A. Anandkumar, “signsgd with majority vote is communication efficient and fault tolerant,” arXiv preprint arXiv:1810.05291, 2018. [56] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems, vol. 32, 2019. [57] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems, vol. 33, pp. 16 937– 16 947, 2020. [58] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP). IEEE, 2017, pp. 3–18. [59] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, “Membership inference attacks from first principles,” in 2022 IEEE symposium on security and privacy (SP). IEEE, 2022, pp. 1897– 1914. [60] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction {APIs},” in 25th USENIX security symposium (USENIX Security 16), 2016, pp. 601–618. [61] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1175–1191. [62] P. Angueira, I. Val, J. Montalban, Ó. Seijo, E. Iradier, P. S. Fontaneda, L. Fanari, and A. Arriola, “A survey of physical layer techniques for secure wireless communications in industry,” IEEE Communications Surveys & Tutorials, vol. 24, no. 2, pp. 810–838, 2022. [63] S. Alhawas and M. A. Rassam, “Federated learning in edge computing: Vulnerabilities, attacks, and defenses—a survey,” Sensors (Basel, Switzerland), vol. 26, no. 4, p. 1275, 2026. [64] I. Butun, P. Österberg, and H. Song, “Security of the internet of things: Vulnerabilities, attacks, and countermeasures,” IEEE Communications Surveys & Tutorials, vol. 22, no. 1, pp. 616–644, 2020. [65] I. F. Mendes, D. L. F. Duarte, L. G. B. Guedes, L. S. Souza, R. S. Silva, V. D. Souto, and R. D. Souza, “Survey on federated learning in ris, star-ris, and bd-ris-assisted wireless networks,” IEEE Open Journal of the Communications Society, 2026. [66] M. Brückner and T. Scheffer, “Stackelberg games for adversarial prediction problems,” in Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining, 2011, pp. 547–555.

[67] Y. Chen, Y. Liu, and C. Podimata, “Learning strategy-aware linear classifiers,” Advances in Neural Information Processing Systems, vol. 33, pp. 15 265–15 276, 2020. [68] S. Liu, Y. Wang, and X.-S. Gao, “Game-theoretic unlearnable example generator,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 19, 2024, pp. 21 349–21 358. [69] Y. Wang, D.-H. Zhai, and Y. Xia, “Rfvir: A robust federated algorithm defending against byzantine attacks,” Information Fusion, vol. 105, p. 102251, 2024. [70] D. A. E. Acar, Y. Zhao, R. M. Navarro, M. Mattina, P. N. Whatmough, and V. Saligrama, “Federated learning based on dynamic regularization,” arXiv preprint arXiv:2111.04263, 2021. [71] S. Reddi, Z. Charles, M. Zaheer, Z. Garrett, K. Rush, J. Konečnỳ, S. Kumar, and H. B. McMahan, “Adaptive federated optimization,” arXiv preprint arXiv:2003.00295, 2020. [72] A. Fallah, A. Mokhtari, and A. Ozdaglar, “Personalized federated learning with theoretical guarantees: A model-agnostic meta-learning approach,” Advances in neural information processing systems, vol. 33, pp. 3557–3568, 2020. [73] C. T Dinh, N. Tran, and J. Nguyen, “Personalized federated learning with moreau envelopes,” Advances in neural information processing systems, vol. 33, pp. 21 394–21 405, 2020. [74] T. Li, S. Hu, A. Beirami, and V. Smith, “Ditto: Fair and robust federated learning through personalization,” in International conference on machine learning. PMLR, 2021, pp. 6357–6368. [75] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318. [76] N. Papernot, S. Song, I. Mironov, A. Raghunathan, K. Talwar, and Ú. Erlingsson, “Scalable private learning with pate,” arXiv preprint arXiv:1802.08908, 2018. [77] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in International conference on the theory and application of cryptology and information security. Springer, 2017, pp. 409–437. [78] L. Wu et al., “Homomorphic encryption for machine learning applications with ckks algorithms: A survey of developments and applications,” Computers, Materials & Continua, vol. 85, no. 1, pp. 89–119, 2025. [Online]. Available: http://www.techscience.com/cmc/ v85n1/63510 [79] J. Yuan, W. Liu, J. Shi, and Q. Li, “Approximate homomorphic encryption based privacy-preserving machine learning: a survey,” Artificial Intelligence Review, vol. 58, no. 3, p. 82, 2025. [80] P. Mohassel and P. Rindal, “Aby3: A mixed protocol framework for machine learning,” in Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 35– 52. [81] B. Knott, S. Venkataraman, A. Hannun, S. Sengupta, M. Ibrahim, and L. van der Maaten, “Crypten: Secure multi-party computation meets machine learning,” Advances in Neural Information Processing Systems, vol. 34, pp. 4961–4973, 2021. [82] O. Ohrimenko, F. Schuster, C. Fournet, A. Mehta, S. Nowozin, K. Vaswani, and M. Costa, “Oblivious {Multi-Party} machine learning on trusted processors,” in 25th USENIX Security Symposium (USENIX Security 16), 2016, pp. 619–636. [83] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proceedings of the 2017 ACM on international conference on multimedia retrieval, 2017, pp. 269–277. [84] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in 27th USENIX security symposium (USENIX Security 18), 2018, pp. 1615–1631. [85] D. Oliynyk, R. Mayer, and A. Rauber, “I know what you trained last summer: A survey on stealing machine learning models and defences,” ACM Computing Surveys, vol. 55, no. 14s, pp. 1–41, 2023. [86] I. Nikolic, T. Baluta, and P. Saxena, “Model provenance testing for large language models,” vol. 38, Main Conference, pp. 34 126–34 153, 2025. [Online]. Available: https://proceedings.neurips.cc/paper files/paper/2025/file/ 30e55dfbfa8e76e3526de7f2ab029cda-Paper-Conference.pdf [87] S. Li, E. Ngai, and T. Voigt, “Byzantine-robust aggregation in federated learning empowered industrial iot,” IEEE Transactions on Industrial Informatics, vol. 19, no. 2, pp. 1165–1175, 2023. [88] E. Alharbi, L. S. Marcolino, A. Gouglidis, and Q. Ni, “Robust federated learning method against data and model poisoning attacks with heterogeneous data distribution.” in ECAI, 2023, pp. 85–92.

[89] S. Zawad, A. Ali, P.-Y. Chen, A. Anwar, Y. Zhou, N. Baracaldo, Y. Tian, and F. Yan, “Curse or redemption? how data heterogeneity affects the robustness of federated learning,” in Proceedings of the AAAI conference on artificial intelligence, vol. 35, no. 12, 2021, pp. 10 807–10 814. [90] X. Zhang, Y. Kang, K. Chen, L. Fan, and Q. Yang, “Trading off privacy, utility, and efficiency in federated learning,” ACM Transactions on Intelligent Systems and Technology, vol. 14, no. 6, pp. 1–32, 2023. [91] B. G. Tekgul, Y. Xia, S. Marchal, and N. Asokan, “Waffle: Watermarking in federated learning,” in 2021 40th International Symposium on Reliable Distributed Systems (SRDS). IEEE, 2021, pp. 310–320. [92] H. Chen, T. Zhu, T. Zhang, W. Zhou, and P. S. Yu, “Privacy and fairness in federated learning: On the perspective of tradeoff,” ACM Computing Surveys, vol. 56, no. 2, pp. 1–37, 2023. [93] M. Shafique, T. Theocharides, C.-S. Bouganis, M. A. Hanif, F. Khalid, R. Hafız, and S. Rehman, “An overview of next-generation architectures for machine learning: Roadmap, opportunities and challenges in the iot era,” in 2018 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2018, pp. 827–832. [94] D. P. Penumuru, S. Muthuswamy, and P. Karumbu, “Identification and classification of materials using machine vision and machine learning in the context of industry 4.0,” Journal of Intelligent Manufacturing, vol. 31, no. 5, pp. 1229–1241, 2020. [95] J. Dalzochio, R. Kunst, E. Pignaton, A. Binotto, S. Sanyal, J. Favilla, and J. Barbosa, “Machine learning and reasoning for predictive maintenance in industry 4.0: Current status and challenges,” Computers in Industry, vol. 123, p. 103298, 2020, publisher: Elsevier. [96] W. Z. Khan, M. H. Rehman, H. M. Zangoti, M. K. Afzal, N. Armi, and K. Salah, “Industrial internet of things: Recent advances, enabling technologies and open challenges,” Computers & Electrical Engineering, vol. 81, p. 106522, Jan. 2020. [97] M. Younan, E. H. Houssein, M. Elhoseny, and A. A. Ali, “Challenges and recommended technologies for the industrial internet of things: A comprehensive review,” Measurement, vol. 151, p. 107198, Feb. 2020. [98] T. Zeng, O. Semiari, M. Chen, W. Saad, and M. Bennis, “Federated learning on the road: Autonomous controller design for connected and autonomous vehicles,” arXiv preprint arXiv:2102.03401, 2021. [99] L. U. Khan, W. Saad, Z. Han, E. Hossain, and C. S. Hong, “Federated learning for internet of things: Recent advances, taxonomy, and open challenges,” IEEE Communications Surveys & Tutorials, vol. 23, no. 3, pp. 1759–1799, 2021. [100] Z. L. Teo, L. Jin, N. Liu, S. Li, D. Miao, X. Zhang, W. Y. Ng, T. F. Tan, D. M. Lee, K. J. Chua et al., “Federated machine learning in healthcare: A systematic review on clinical applications and technical architecture,” Cell Reports Medicine, vol. 5, no. 2, 2024. [101] A. Qayyum, K. Ahmad, M. A. Ahsan, A. Al-Fuqaha, and J. Qadir, “Collaborative federated learning for healthcare: Multimodal covid-19 diagnosis at the edge,” 2021. [Online]. Available: https://arxiv.org/abs/2101.07511 [102] K. Ahmad, M. Maabreh, M. Ghaly, K. Khan, J. Qadir, and A. AlFuqaha, “Developing future human-centered smart cities: Critical analysis of smart city security, interpretability, and ethical challenges,” arXiv preprint arXiv:2012.09110, 2020. [103] X. Liu, J. Cao, Y. Yang, and S. Jiang, “Cps-based smart warehouse for industry 4.0: a survey of the underlying technologies,” Computers, vol. 7, no. 1, p. 13, 2018. [104] Y. Qian, Y. Jiang, J. Chen, Y. Zhang, J. Song, M. Zhou, and M. Pustišek, “Towards decentralized IoT security enhancement: A blockchain approach,” Computers & Electrical Engineering, vol. 72, pp. 266–273, Nov. 2018. [105] R. Gupta, S. Tanwar, F. Al-Turjman, P. Italiya, A. Nauman, and S. W. Kim, “Smart Contract Privacy Protection Using AI in Cyber-Physical Systems: Tools, Techniques and Challenges,” IEEE Access, vol. 8, pp. 24 746–24 772, 2020. [106] A. Qayyum, A. Ijaz, M. Usama, W. Iqbal, J. Qadir, Y. Elkhatib, and A. Al-Fuqaha, “Securing machine learning in the cloud: A systematic review of cloud machine learning security,” Frontiers in big Data, vol. 3, 2020. [107] Q. Yang, A. Huang, L. Fan, C. S. Chan, J. H. Lim, K. W. Ng, D. S. Ong, and B. Li, “Federated learning with privacy-preserving and model ip-right-protection,” Machine Intelligence Research, vol. 20, no. 1, pp. 19–37, 2023. [108] I. Sittón-Candanedo, R. S. Alonso, J. M. Corchado, S. Rodrı́guezGonzález, and R. Casado-Vara, “A review of edge computing reference architectures and a new global edge proposal,” Future Generation Computer Systems, vol. 99, pp. 278–294, Oct. 2019.

[109] A. Yousefpour, S. Guo, A. Shenoy, S. Ghosh, P. Stock, K. Maeng, S.-W. Krüger, M. Rabbat, C.-J. Wu, and I. Mironov, “Green federated learning,” arXiv preprint arXiv:2303.14604, 2023. [110] D. Thakur, A. Guzzo, G. Fortino, and F. Piccialli, “Green federated learning: A new era of green aware ai,” ACM Computing Surveys, vol. 57, no. 8, pp. 1–36, 2025. [111] S. Essahraui and I. Lamaakal, “A comprehensive survey of tinymlbased biometric recognition for iot edge devices,” IEEE Internet of Things Journal, 2026. [112] J. Huang, Y. Feng, F.-Q. Cui, X. Zhang, Z. Liu, X. Liu, J. Liu, F. Zhang, and M. Li, “Identifying who you are no matter what you write through abstracting handwriting style,” IEEE Transactions on Dependable and Secure Computing, vol. 23, no. 3, pp. 6890–6905, 2026. [113] Y. Liang, S. Samtani, B. Guo, and Z. Yu, “Behavioral biometrics for continuous authentication in the internet-of-things era: An artificial intelligence perspective,” IEEE Internet of Things Journal, vol. 7, no. 9, pp. 9128–9143, 2020. [114] “Google. 2021. google cloud tpu.” [Online]. Available: https: //cloud.google.com/tpu [115] “Amazon web services. 2021. amazon sagemaker.” [Online]. Available: https://aws.amazon.com/sagemaker/developer-resources/ [116] “Microsoft. 2021. microsoft azure machine learning.” [Online]. Available: https://azure.microsoft.com/en-us/overview/machine-learning/ [117] “IBM Cloud. 2021. IBM Watson Machine Learning.” [Online]. Available: https://www.ibm.com/cloud/machine-learning [118] T. T. Thein, Y. Shiraishi, and M. Morii, “Personalized federated learning-based intrusion detection system: Poisoning attack and defense,” Future Generation Computer Systems, vol. 153, pp. 182–192, 2024. [119] H. Zeng, J. Li, J. Lou, S. Yuan, C. Wu, W. Zhao, S. Wu, and Z. Wang, “Bsr-fl: An efficient byzantine-robust privacy-preserving federated learning framework,” IEEE Transactions on Computers, vol. 73, no. 8, pp. 2096–2110, 2024. [120] S. Hu, Y. Li, X. Liu, Q. Li, Z. Wu, and B. He, “The oarf benchmark suite: Characterization and implications for federated learning systems,” ACM Transactions on Intelligent Systems and Technology (TIST), vol. 13, no. 4, pp. 1–32, 2022. [121] R. Goussakov, “Hellinger distance-based similarity measures for recommender systems,” 2020. [122] D.-D. Le, T.-N. Huynh, and N. T. Le, “Fedklentropy: Enhancing federated learning via model entropy and kullback-leibler divergence,” in Proceedings of the International Conference on Research in Adaptive and Convergent Systems, 2025, pp. 1–8. [123] D. M. J. Gutierrez, D. Solans, M. A. Heikkilä, A. Vitaletti, N. Kourtellis, A. Anagnostopoulos, and I. Chatzigiannakis, “Non-iid data in federated learning: A survey with taxonomy, metrics, methods, frameworks and future directions,” arXiv:2411.12377, 2024. [124] P. M. S. Sánchez, A. H. Celdrán, N. Xie, G. Bovet, G. M. Pérez, and B. Stiller, “Federatedtrust: A solution for trustworthy federated learning,” Future Generation Computer Systems, vol. 152, pp. 83–98, 2024. [125] F. Tanveer, F. Iradat, W. Iqbal, H. S. Alsagri, H. A. A. Alhakbani, A. Ahmad, and F. A. Khan, “Balancing privacy and performance in healthcare: A federated learning framework for sensitive data,” Digital Health, vol. 11, p. 20552076251381769, 2025. [126] I. Wagner and D. Eckhoff, “Technical privacy metrics: a systematic survey,” ACM Computing Surveys (Csur), vol. 51, no. 3, pp. 1–38, 2018. [127] A. Koloskova, S. U. Stich, and M. Jaggi, “Sharper convergence guarantees for asynchronous sgd for distributed and federated learning,” Advances in Neural Information Processing Systems, vol. 35, pp. 17 202–17 215, 2022. [128] M. Kim, W. Saad, M. Debbah, and C. S. Hong, “Spafl: Communicationefficient federated learning with sparse models and low computational overhead,” Advances in Neural Information Processing Systems, vol. 37, pp. 86 500–86 527, 2024. [129] C. Thapa, P. C. M. Arachchige, S. Camtepe, and L. Sun, “Splitfed: When federated learning meets split learning,” in Proceedings of the AAAI conference on artificial intelligence, vol. 36, no. 8, 2022, pp. 8485–8493. [130] J. Xia, Y. Zhang, and Y. Shi, “Towards energy-aware federated learning via marl: A dual-selection approach for model and client,” in Proceedings of the 43rd IEEE/ACM International Conference on ComputerAided Design, 2024, pp. 1–9. [131] Y. Li, J. Ibrahim, H. Chen, D. Yuan, and K.-K. R. Choo, “Holistic evaluation metrics: Use case sensitive evaluation metrics for federated learning,” arXiv:2405.02360, 2024.

[132] J. Zhang, S. Zeng, M. Zhang, R. Wang, F. Wang, Y. Zhou, P. P. Liang, and L. Qu, “Flhetbench: Benchmarking device and state heterogeneity in federated learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12 098–12 108. [133] H. Zhang, Y. Liu, X. He, J. Wu, T. Cong, and X. Huang, “Sok: Benchmarking poisoning attacks and defenses in federated learning,” arXiv:2502.03801, 2025. [134] S. Han, B. Buyukates, Z. Hu, H. Jin, W. Jin, L. Sun, X. Wang, W. Wu, C. Xie, Y. Yao et al., “Fedsecurity: A benchmark for attacks and defenses in federated learning and federated llms,” in Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 5070–5081. [135] Q. Li, Y. Diao, Q. Chen, and B. He, “Federated learning on non-iid data silos: An experimental study,” in 2022 IEEE 38th international conference on data engineering (ICDE). IEEE, 2022, pp. 965–978. [136] T. Feng, D. Bose, T. Zhang, R. Hebbar, A. Ramakrishna, R. Gupta, M. Zhang, S. Avestimehr, and S. Narayanan, “Fedmultimodal: A benchmark for multimodal federated learning,” in Proceedings of the 29th ACM SIGKDD conference on knowledge discovery and data mining, 2023, pp. 4035–4045. [137] J. Ogier du Terrail, S.-S. Ayed, E. Cyffers, F. Grimberg, C. He, R. Loeb, P. Mangold, T. Marchand, O. Marfoq, E. Mushtaq et al., “Flamby: Datasets and benchmarks for cross-silo federated learning in realistic healthcare settings,” Advances in Neural Information Processing Systems, vol. 35, pp. 5315–5334, 2022. [138] C. He, S. Li, J. So, X. Zeng, M. Zhang, H. Wang, X. Wang, P. Vepakomma, A. Singh, H. Qiu et al., “Fedml: A research library and benchmark for federated machine learning,” arXiv:2007.13518, 2020. [139] C. Chen, J. Liu, H. Tan, X. Li, K. I.-K. Wang, P. Li, K. Sakurai, and D. Dou, “Trustworthy federated learning: privacy, security, and beyond,” arXiv preprint arXiv:2411.01583, 2024. [140] R. Patel, H. Tripathi, J. Stone, N. Amiri Golilarz, S. Mittal, S. Rahimi, and V. Chaudhary, “Towards secure mlops: Surveying attacks, mitigation strategies, and research challenges,” ACM Trans. AI Secur. Priv., Mar. 2026, just Accepted. [Online]. Available: https://doi.org/10.1145/3796728 [141] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin, “On evaluating adversarial robustness,” arXiv preprint arXiv:1902.06705, 2019. [142] V. Carletti, P. Foggia, C. Mazzocca, G. Parrella, and M. Vento, “{SoK}: Gradient inversion attacks in federated learning,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 6439–6459. [143] L. Leite, Y. Santo, B. L. Dalmazo, and A. Riker, “Federated learning under attack: Improving gradient inversion for batch of images,” arXiv preprint arXiv:2409.17767, 2024. [144] J. Tan, Z. Liu, K. Guo, and M. Zhao, “Long-term client selection for federated learning with non-iid data: A truthful auction approach,” IEEE Internet of Things Journal, vol. 12, no. 5, pp. 4953–4970, 2025. [145] A. Abbasi, “Carbon-aware federated learning with model size adaptation,” in Proceedings of the 2024 IEEE International Conference on, 2024. [146] E. Tabassi, “Artificial intelligence risk management framework (AI RMF 1.0),” no. NIST AI 100-1, 2023, accessed: October 5, 2026. [Online]. Available: https://tsapps.nist.gov/publication/get pdf. cfm?pub id=936225

Long Dang received the M.S. degree in Computer Science from the University of South Florida (USF), Tampa, FL, USA. He is currently pursuing the Ph.D. degree in Computer Science and Engineering at USF. His research interests include machine learning security, adversarial machine learning, data privacy, and trustworthy artificial intelligence, with a focus on securing machine learning systems against adversarial and data poisoning attacks.

Ali Alfatemi received the M.S. degree in computer science from South China University of Technology in 2021. He is currently a Ph.D. candidate and Teaching Fellow with the Department of Computer Science, Fordham University, New York, NY, USA. His research interests include AI for network security, robust and data-efficient machine learning, computer vision, large language models, and multimodal systems.

Kaiqi Xiong (Senior Member, IEEE) received the Ph.D. degree in computer science from the North Carolina State University and the Ph.D. degree in mathematics from the Claremont Graduate School. Before returning to academia, he was with IT industry for several years. He is currently a Professor in the Intelligent Computer Networking and Security Laboratory with the University of South Florida (USF), affiliated with the Florida Center for Cybersecurity, the Department of Mathematics and Statistics, and the Department of Electrical Engineering. His research was supported by the National Science Foundation (NSF), NSF/BBN, the Air Force Research Laboratory, Amazon AWS, the Florida Center for Cybersecurity, and the Office of Naval Research. His research interests include machine learning/deep learning, security, and networking with their applications to various real-world computing systems. He received the Best Demo Award at the 22nd GENI Engineering Conference and the U.S. Ignite Application Summit with his team in 2015. He also received the best paper award at several conferences and the Global Research Award from the USF. He is a Senior Member of IEEE and ACM.

Mohammed Aledhari (Senior Member, IEEE) received his Ph.D. in computer science from Western Michigan University, Kalamazoo, MI, USA, in 2018. He is currently an Associate Professor in the Department of Data Science and the Department of Computer Science and Engineering at the University of North Texas, Denton, TX, USA, where he founded and directs the Computational Healthcare and Biotechnology Laboratory. His research interests include artificial intelligence, physical AI, machine learning, computational medicine, and wearable biosensors. Dr. Aledhari has been named to the Stanford/Elsevier list of the World’s Top 2% Most-Cited Scientists.

Abdellah Chehri (Senior Member, IEEE) is a Full Professor in the Department of Mathematics and Computer Science at the Royal Military College of Canada (RMC) in Kingston, Ontario. He also holds affiliate professorships at the Université du Québec en Outaouais (UQO) and the Université du Québec à Chicoutimi (UQAC), as well as an adjunct professorship at the University of Ottawa. His research spans a wide spectrum of advanced technologies, including intelligent mobility systems, sustainable transportation infrastructure, and vehicular communications. Dr. Chehri is internationally recognized for his contributions to V2X communications, 5G/6G and next-generation wireless networks, and AIdriven edge computing. His work integrates the Internet of Things (IoT), RF sensing, and signal processing to enable real-time decision-making in autonomous systems and smart environments. Dr. Chehri has served as a guest and associate editor for numerous highly regarded academic journals. He is actively involved in several professional societies, including the IEEE Public Safety Technology (PST) Initiative—where he serves as co-chair of the Transportation Committee—as well as the IEEE Communications Society (ComSoc), IEEE Vehicular Technology Society (VTS), and IEEE Photonics Society.

Shawqi Al-Maliki received the M.Sc. degree in computer science from King Fahd University of Petroleum and Minerals (KFUPM), Dhahran, Saudi Arabia, in 2018, and the Ph.D. degree in computer science from Hamad Bin Khalifa University (HBKU), Doha, Qatar, in 2023. He is currently a Postdoctoral Researcher with HBKU. He was a Full-Stack Web Developer and Project Manager at Alyaum Media House, Dammam, Saudi Arabia, from 2009 to 2019, and a Computer Instructor at New Horizon Institute, Industrial Jubail, Saudi Arabia, from 2006 to 2008. His research interests include adversarial robustness, LLM security, privacy, reliability, and human-LLM alignment.

Mohamed Rahouti received the Ph.D. degree in electrical engineering from the University of South Florida, Tampa, FL, USA, in 2020. He is currently an Associate Professor with the Department of Computer and Information Science, Fordham University, New York, NY, USA. His research has been supported by the U.S. National Science Foundation, the Florida Center for Cybersecurity, and the Qatar Research, Development, and Innovation Council. His research interests include computer networks and security, blockchain technologies, and artificial intelligence. Dr. Rahouti has served on the technical program committees of numerous conferences and workshops and currently serves in associate editor and guest editor roles for several peer-reviewed journals.

Trustworthy Distributed Machine Learning in Cloud-Edge-IoT Systems: A Heterogeneity-Aware Survey of Security, Privacy, and Robustness

Analyze & explore related research in Conceptio

Related documents