Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks

Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks Ali Akarma∗† , Toqeer Ali Syed∗ , Muhammad Khan‡ , Qurat-ul-ain Mastoi‡ , and Adeel Ahmad∗ ∗ AI Center, Faculty of Computer and Information Systems

Islamic University of Madinah, Madinah 42351, Saudi Arabia

arXiv:2609.02971v1 [cs.CR] 2 Sep 2026

† AI V&V Lab, King Fahd University of Petroleum and Minerals

Dhahran 31261, Saudi Arabia ‡ School of Computer Science and Creative Technologies

University of the West of England, Bristol BS16 1QY, U.K. Corresponding author: 443059463@stu.iu.edu.sa

Abstract—As vehicular networks move toward 5G/6G edge intelligence, federated learning (FL) is widely promoted as a privacy-preserving way for vehicles and infrastructure to train shared models without exposing raw sensor data. Yet the updates clients transmit still leak enough information to identify who sent them, which threatens the anonymity that safety-critical V2X applications assume and adds to existing concerns over adversarial ML, model poisoning, and backdoor attacks. We study server-side client identity inference from transmitted weight deltas using inertial (IMU) measurements, evaluated on the UCI Human Activity Recognition (HAR) benchmark as an accessible proxy for the IMU streams produced onboard connected vehicles. Across five attack classifiers and five non-IID partitions, an honest-but-curious server recovers client identity with nearperfect accuracy (≈1.000) from undefended updates, confirming a concrete identifiability risk. We then quantify the privacyutility trade-off of a lightweight clip-then-noise defense by sweeping Gaussian noise (σ ∈ {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}) at fixed clipping (C = 1.0), and report formal (ϵ, δ)-DP budgets through Rényi accounting. A practical region (σ ∈ [0.1, 0.2]) drives attack accuracy to near-random while costing under 5% relative FL accuracy. Ensemble FL supplies complementary structural privacy with a 1/K anonymity-set bound and no noise penalty. Results are supported by cryptographic (SHA256) train/evaluation gradient disjointness, three seeds, and a count-normalized attacker-advantage metric. We position HAR explicitly as a proxy and discuss what validation on true vehicular telemetry would require. Index Terms—Federated learning, V2X, vehicular networks, gradient leakage, client identity inference, adversarial ML, trustworthy AI, privacy-utility tradeoff.

I. I NTRODUCTION Machine learning and artificial intelligence increasingly drive vehicular applications such as autonomous driving, cooperative perception, and smart-city services as networks advance to 5G and 6G [1]. Federated learning (FL) [2] has become the default privacy-preserving recipe for training these services: vehicles collaboratively improve a global model while keeping their sensor data local to the device. That

choice, however, introduces attacks that cryptography alone does not address, because the gradients themselves leak. An honest-but-curious server can study the distribution of incoming updates and match them to individual vehicles, quietly de-anonymizing the network. In safety-critical settings, where trust under adversarial ML, privacy leakage, model poisoning, and backdoor attacks is already fragile, this leakage demands scrutiny. Inertial measurement is a useful lens on the problem because connected vehicles continuously emit IMU-style streams in dynamic, heterogeneous, and resource-constrained conditions. Such data leave distinctive traces in local gradients that remain recoverable even under non-IID partitioning [3]. Prior work has concentrated on input reconstruction [4] or membership inference [5], [6]; client identity inference has received far less attention. A subtler problem is that some defense evaluations protect the per-batch gradient rather than the artifact a client actually transmits, which overstates the privacy that survives in practice. We address both gaps with a corrected serverside threat model and a multi-classifier empirical analysis. We are explicit about scope: the experiments use the UCI HAR benchmark, which shares IMU modality with vehicular sensing but not its dynamics, so we treat HAR as a proxy and defer validation on true vehicular telemetry to Section V-F. Threat model. The server is honest-but-curious: it aggregates FL updates correctly but tries to attribute each transˆ t to the client that produced it. The mitted weight delta ∆ i adversary observes only the defended, transmitted deltas; it cannot access raw data, local gradients, or per-batch updates. Modeling the transmitted delta, rather than a per-batch gradient, removes a common source of optimism that inflates measured privacy. Contributions: 1) Corrected threat model. The defense is applied to the transmitted weight delta, eliminating a flaw present

in evaluations that defend an artifact the server never observes. 2) Five-classifier benchmark. Random and majority baselines, logistic regression, random forest, and a neural attacker, ranked by expressive power. 3) Cryptographically verified evaluation. SHA-256 hashing enforces train/evaluation gradient-set disjointness, so reported accuracy cannot be an artifact of train/test leakage. 4) Privacy-utility quantification. A six-level Gaussian noise sweep with formal (ϵ, δ)-DP estimates via Rényi DP, identifying the practical region (σ ∈ [0.1, 0.2]). 5) Normalized Attacker Advantage (NAA). A countnormalized rescaling that makes attacker advantage comparable across experiments with different client counts N . 6) Ensemble FL structural privacy. Client-group isolation across K ∈ {2, 3, 5} with a formal 1/K upper bound on achievable attack accuracy. II. R ELATED W ORK Federated averaging [2] defines the standard FL setting where clients perform local SGD and send updates to a central server without exposing raw data. Surveys by Mothukuri et al. [7] and Lyu et al. [8] categorize FL protocols, threats, and inference attacks in IoT and vehicular environments. Our work focuses on server-side client identity inference and extends prior studies into a calibrated privacy–utility analysis. Hsieh et al. [9] further show how non-IID data distributions increase inference vulnerability, motivating our fleet-diversity model. Most gradient-leakage studies target reconstruction attacks. Zhu et al. [4] reconstruct inputs from gradients, while Geiping et al. [3] scale inversion attacks to larger batches using cosine similarity. Membership inference methods [5], [10], [11] determine whether a record participated in training but do not attribute updates to specific clients. Wang et al. [12] are closest to our work, showing that non-IID FL gradients are separable using lightweight classifiers. Our approach differs in three ways: (1) the attacker observes defended transmitted weight deltas instead of per-batch gradients, (2) evaluation uses cryptographically disjoint train/test sets across five classifiers, and (3) we analyze defense operating points rather than reporting a single accuracy metric. Table I summarizes these differences. For defenses, Dwork and Roth [13] formalize differential privacy, Abadi et al. [14] introduce DP-SGD with gradient clipping, and Mironov [15] proposes the R’enyi accountant used to derive the (ϵ, δ) privacy budget. Geyer et al. [16] study client-level DP to hide participation itself, whereas our goal is preventing attribution after participation is known. Secure aggregation [17] cryptographically conceals updates but introduces coordination overhead unsuitable for many edge devices. Sattler et al. [18] demonstrate that sparse ternary updates preserve accuracy under non-IID data while altering exploitable gradient signatures. In vehicular networks, hierarchical blockchain-enabled FL [19], [20] provides auditable

TABLE I P OSITIONING RELATIVE TO PRIOR GRADIENT- PRIVACY WORK . E VAL . UNIT: ARTIFACT THE ATTACK / DEFENSE IS EVALUATED ON (PBG = PER - BATCH GRADIENT, WD = TRANSMITTED WEIGHT DELTA ). C ALIB .: REPORTS A PRIVACY- UTILITY OPERATING POINT. Target

Eval. unit

DP

Calib.

N

Zhu [4] Reconstruction Geiping [3] Reconstruction Shokri [5] Membership Nasr [10] Membership (WB) Wang [12] Client identity This work Client identity

PBG PBG Outputs Grad. PBG WD

— — — — — ✓

— — — — — ✓

— — — — 10–20 10

Work

trust management for the Internet of Vehicles, complementing the update-level defenses studied here. III. M ETHODOLOGY A. FL Formulation and Data Partitioning We consider a standard cross-device FL scenario with N = 10 clients and one central server. The global objective minimizes: N X Di Fi (w), (1) F (w) = D i=1 where Di is the local sample count and Fi (w) is client i’s empirical loss. Each round t, client i runs E local SGD epochs, computes the weight delta ∆ti = wit+1 − wt , applies the clipˆ t (Section III-C), and uploads then-noise defense to obtain ∆ i it. The server aggregates via FedAvg: wt+1 = wt +

N X Di

D i=1

ˆ ti . ∆

(2)

Our primary experiments use Dirichlet(α = 0.3) label skew [9], modeling the heterogeneity real fleets exhibit across road conditions, driving behaviors, and geography. We additionally evaluate four partitions to probe how heterogeneity affects identifiability: IID (uniform random), pathological (Kcls classes per client), quantity skew (Dirichlet(β) sample counts), and feature skew (per-client Gaussian feature noise). B. Task Model and Attack Protocol The task model is a multilayer perceptron (MLP) [561 → 256 → 128 → 6] with LayerNorm, ReLU, and dropout (0.3) after each hidden layer. We use LayerNorm rather than BatchNorm because BatchNorm accumulates running mean and variance statistics that FedAvg averages incorrectly across non-IID clients, degrading convergence in the non-stationary vehicular regime [21]. The complete system is illustrated in Figure 1. The attack proceeds in three phases. (1) Collection (rounds ˆt 1–K = 8): the server records defended weight deltas ∆ i with SHA-256 hash registration. (2) Training (round K + 1): five classifiers, ranked by expressive power, train on ˆ t , client idi ) pairs after L2 normalization, Z-score stan(∆ i dardization, and PCA (50 components). The classifiers are a random baseline (hard lower bound 1/N ), a majority baseline

TABLE II F ORMAL (ϵ, δ)-DP B UDGET (T = 20, C = 1.0, δ = 10−5 ) σ

Optimal α

ϵ (δ = 10−5 )

0.05 0.10 0.20 0.50 1.00

1.07 1.24 1.76 3.07 2.07

>1000 ≈296 ≈74 ≈12.1 ≈31.4

E. Ensemble FL and Privacy Metrics

Fig. 1. System architecture of a differentially private federated learning framework under an inference attack by an honest-but-curious server.

(guards class imbalance), ℓ2 -regularized logistic regression (C = 1.0, a linear-separability test), a 100-tree random forest (non-linear baseline), and an MLP attacker [d → 256 → 128 → N ] (strongest). (3) Evaluation (rounds K + 1–T = 20): the trained classifiers are applied to new uploads, with SHA-256 hash disjointness enforced so that no evaluation update was seen during training. C. Defense Mechanisms Two defenses are applied sequentially to the transmitted weight delta ∆ti , both chosen for low overhead compatible with vehicular edge constraints. Gradient Clipping bounds the ℓ2 norm to at most C:   C t t ˜ ∆i = ∆i · min 1, . (3) ∥∆ti ∥2 Gaussian Noise Injection adds isotropic noise calibrated to the clipped sensitivity:
ˆ ti = ∆ ˜ ti + N 0, σ 2 C 2 I . ∆ (4) The effective noise scale σC follows the Gaussian mechanism [13], [14]. In E2, C = 1.0 is fixed and σ = 0.00 denotes clipping only, not the undefended baseline (E1). D. Formal Differential Privacy Analysis Under the Gaussian mechanism, a single defense step satisfies (α, ϵα )-Rényi DP [15] with ϵα = α/(2σ 2 ). After T rounds, converting to (ϵ, δ)-DP at δ = 10−5 :   ln(1/δ) Tα + . (5) ϵ(δ) = min α>1 2σ 2 α−1 Table II reports ϵ at T = 20, C = 1.0. Modest noise (σ = 0.1) already incurs a large ϵ (≈296), which confirms that low noise gives empirical rather than formal DP and motivates the combined defense.

In the Ensemble configuration, clients are split into nonoverlapping groups of K clients, each served by its own sub-model and communicating exclusively with it. This maps naturally to vehicular segmentation by RSU coverage zone or trust domain, giving structural privacy without per-update noise overhead. Proposition 1 (Ensemble FL Identity-Inference Bound): Partition the N clients into non-overlapping groups of K clients, each served by its own sub-model. A server-side attacker observing a single sub-model identifies the originating client with probability at most 1/K, provided updates within a group are statistically indistinguishable. proof 1 (Sketch): A sub-model receives updates from the K clients in its group. When within-group updates are indistinguishable, the attacker’s best strategy is a uniform guess among the K members, achieving accuracy 1/K; any better strategy would require distinguishing within-group gradients, contradicting the assumption. Remark. The 1/K bound is a best case for the defender: it holds only while within-group updates are indistinguishable. Heavy intra-group label or feature skew, or very small groups, can restore separability and push empirical attack accuracy above 1/K. Deployments should therefore monitor withingroup separability rather than assume the bound, and treat K as a tunable anonymity-set size. Privacy and utility are summarized by the Privacy Score (PS) = 1 − best attack accuracy and the Normalized Attacker Advantage: NAA =

attack acc − 1/N , 1 − 1/N

(6)

where NAA = 0 indicates no gain over random guessing and NAA = 1 a perfect attack. NAA is a count-normalized rescaling of attack accuracy, not a new statistical quantity: it plays the role membership advantage plays for membership inference [5], but normalizes by the random-guess floor 1/N so advantage is comparable across experiments with different client counts. We use it for cross-experiment comparison, not as a standalone privacy guarantee. IV. E XPERIMENTAL S ETUP The UCI HAR dataset [22] contains 10,299 observations from 30 subjects performing six activities, each a 561dimensional feature vector derived from triaxial accelerometer and gyroscope readings at 50 Hz. This is the IMU

TABLE III H YPERPARAMETER C ONFIGURATION Component

Hyperparameter

Value

FL Training

Rounds T / Local epochs E Batch size / LR Clients N / Aggregation

20 / 5 32 / 0.01 (SGD, µ = 0.9) 10 / FedAvg

Task Model

Architecture / Norm. Dropout / Weight init.

MLP [561 → 256 → 128 → 6] / LN 0.3 / Kaiming normal

Attack

Collect rounds K / Eval start PCA components / Std.

8 / round 9 50 / Z-score

Defense Repro.

Clipping C / Noise σ Master seed / count

1.0 / 0.0–1.0 42 / 3

TABLE IV P RIVACY-U TILITY T RADEOFF , G AUSSIAN N OISE S WEEP (E2, FIXED C = 1.0) σ

FL Acc. (±std)

Atk. Acc. (±std)

PS

0.00 0.05 0.10 0.20 0.50 1.00

0.944 ± 0.004 0.942 ± 0.004 0.930 ± 0.016 0.896 ± 0.034 0.665 ± 0.014 0.382 ± 0.005

0.127 ± 0.020 0.164 ± 0.034 0.148 ± 0.028 0.164 ± 0.027 0.158 ± 0.017 0.148 ± 0.026

0.873 0.836 0.852 0.836 0.842 0.852

TABLE V S UMMARY OF K EY M ETRICS (N = 10, UCI HAR, 3 SEEDS ). PS = P RIVACY S CORE ; NAA = N ORMALIZED ATTACKER A DVANTAGE .

modality shared with vehicular onboard driving-state and occupant-behavior recognition, which is why we adopt it as a proxy; Section V-F states the limits of that choice. Training samples are partitioned across N = 10 clients using Dirichlet(α = 0.3), and all features are standardized using training-set statistics only. Seven conditions are evaluated: E1 (no-defense FedAvg); E2 (Gaussian noise sweep, σ ∈ {0.00, 0.05, 0.10, 0.20, 0.50, 1.00}, fixed C = 1.0); E3 (clipping ablation, C ∈ {0.1, 0.5, 1.0, 2.0, 5.0}, σ = 0); E4 (combined defense); E5 (Ensemble FL, K ∈ {2, 3, 5}); E6–E7 (non-IID heterogeneity). Hyperparameters appear in Table III; all results are mean ± std over three seeds (42, 43, 44). V. R ESULTS AND D ISCUSSION A. Baseline: Gradient Identifiability (E1)

Condition

FL Acc.

Atk. Acc.

PS

NAA

E1: No defense E2: σ = 0.00 E2: σ = 0.10 E2: σ = 0.50 E4: Combined E5: Ensemble K = 3 E7: Pathological

∼0.944 ∼0.944 ∼0.930 ∼0.665 ∼0.940 ∼0.920 ∼0.880

∼1.000 ∼0.127 ∼0.148 ∼0.158 ∼0.120 ∼0.330 ∼1.000

∼0.000 ∼0.873 ∼0.852 ∼0.842 ∼0.880 ∼0.670 ∼0.000

∼1.000 ∼0.030 ∼0.053 ∼0.064 ∼0.022 ∼0.256 ∼1.000

for the Gaussian mechanism to satisfy DP semantics [14]; adding Gaussian noise without clipping provides no reliable DP guarantee. D. Ensemble FL and Structural Privacy (E5)

Without defense under Dirichlet(α! =!0.3) at N ! =!10, logistic regression, random forest, and MLP attackers achieve near-perfect accuracy on held-out uploads (rounds 9–20), each scoring ≈!1.000 (PS ≈ 0, NAA ≈ 1), while random and majority baselines remain at 0.100. This strong separability indicates that client gradients occupy distinct regions of parameter space. Consequently, an honest-but-curious 5G/6G edge aggregator can de-anonymize V2X participants using model updates alone.

Ensemble FL provides structural privacy without noise and naturally aligns with RSU-zone or trust-domain segmentation. By Proposition 1, the optimal attack accuracy for groups of K clients is 1/K; empirically we observe 0.50, 0.33, and 0.20 for K! =!2, 3, 5, closely matching theory while maintaining FL accuracy near 0.92. Larger K increases anonymity but slightly reduces specialization. The K! =!3 setting in Table V offers the best balance between anonymity and accuracy for latency-sensitive VANETs where noise-induced degradation is undesirable.

B. Privacy-Utility Tradeoff Under Gaussian Noise (E2)

E. Non-IID Heterogeneity and Summary (E6, E7)

Table IV shows the Gaussian noise sweep at fixed C! =!1.0. Clipping alone (σ! =!0.00) reduces attack accuracy from ≈!1.000 to 0.127!±!0.020, showing that magnitude normalization weakens gradient separability while directional information still leaks identity. Increasing noise progressively reduces FL accuracy: σ! =!0.2 lowers FL accuracy to 0.896, while σ! =!1.0 collapses performance to 0.382. The range σ! ∈![0.1, 0.2] provides the best tradeoff, keeping attack accuracy near random while preserving FL accuracy above 0.89, making it suitable for vehicular edge deployments.

Greater non-IID heterogeneity, representing differences in driving behavior, hardware, or geography, increases gradient distinguishability. Pathological partitioning (E7, Kcls ! =!2 classes per client) produces nearly orthogonal updates and maximizes separability. Even under IID data (E6), attacks outperform random guessing during early rounds because of minibatch stochasticity and initialization effects. The strongest overall defense (σ! =!0.01, C! =!1.0) achieves the highest Privacy Score (0.880) while maintaining FL accuracy near 0.940, supporting the DP principle of clipping before adding calibrated noise. Table V summarizes all conditions.

C. Gradient Clipping and Combined Defense (E3, E4) Clipping improves privacy by removing gradient-norm variance, the main magnitude channel distinguishing clients. Some identity information remains in gradient direction. The combined defense (E4: σ! ∈![0.01, 0.1, 0.2], C! =!1.0) achieves the strongest balance. Clipping bounds the ℓ2 sensitivity required

F. Limitations Several limitations constrain these findings. UCI HAR shares IMU sensing modalities with vehicular systems but lacks realistic driving dynamics such as speed variation, road excitation, and GPS-correlated structure. Real vehicular

datasets may therefore be either more or less separable. Experiments use only N ! =!10 clients, T ! =!20 rounds, and three seeds; larger studies would improve estimate reliability and DP accounting. The threat model also assumes a single honest-but-curious server, excluding colluding clients, adaptive attackers, and malicious aggregators that may achieve stronger inference. Finally, Proposition 1 assumes within-group indistinguishability, which strong intra-group non-IID skew may violate VI. C ONCLUSION Federated learning does not by itself anonymize the clients that participate in it. Using inertial data, we showed that an honest-but-curious 5G/6G edge server can attribute transmitted model updates to individual clients with accuracy approaching 100% under realistic non-IID partitions, across five classifiers. Correcting a common evaluation flaw, defending the perbatch gradient instead of the transmitted artifact, removes a false comfort prior setups offer. A lightweight clip-then-noise defense closes most of the gap: at σ ∈ [0.1, 0.2] with C = 1.0, attack accuracy falls to near-random while FL accuracy stays above 0.89. Rényi accounting tempers any overclaim, since these levels buy strong empirical privacy but only loose formal (ϵ, δ) guarantees at T = 20, with meaningful budgets needing σ ≥ 0.5 or longer training. Ensemble FL adds a structural 1/K bound that aligns with RSU-zone segmentation and avoids noise-induced utility loss, suiting latency-sensitive vehicular AI. The recipe is to clip then add noise calibrated to the clipped sensitivity, and to layer cross-cutting protections such as secure aggregation [17] and blockchain-based trust management where warranted. Confirming these effects on true vehicular telemetry, and against adaptive or colluding adversaries, is the immediate next step, alongside PRV-accountant analysis for extended training (T ≥ 100), 1D-CNN models for raw time series, and multi-access edge computing under realistic 5G/6G constraints. DATA AVAILABILITY The complete framework is available at https://github.com/ aliakarma/PPFL-Sensors; the UCI HAR dataset [22] is on the UCI ML Repository. R EFERENCES [1] S. Jan, A. Akarma, T. A. Syed, M. A. Muhammad, and S. Kamal, “Eagf: A four-pillar ethical ai governance framework for trustworthy cybersecurity in 5g renewable energy iot systems,” Scientific Reports, 2026. [2] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, ser. Proceedings of Machine Learning Research, vol. 54. PMLR, 2017, pp. 1273–1282. [3] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients – how easy is it to break privacy in federated learning?” in Advances in Neural Information Processing Systems 33 (NeurIPS 2020), vol. 33. Curran Associates, Inc., 2020, pp. 16 937–16 947. [4] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Advances in Neural Information Processing Systems 32 (NeurIPS 2019), vol. 32. Curran Associates, Inc., 2019, pp. 14 774–14 784.

[5] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP). IEEE, 2017, pp. 3–18. [6] T. A. Syed, A. Akarma, A. Alatify, M. T. Naqash, and A. Alqurashi, “Agentic ai-enhanced digital twins for smart city civil infrastructure: A secure, autonomous and auditable management framework,” PLoS One, vol. 21, no. 7, p. e0353610, 2026. [7] V. Mothukuri, R. M. Parizi, S. Pouriyeh, Y. Huang, A. Dehghantanha, and G. Srivastava, “A survey on security and privacy of federated learning,” Future Generation Computer Systems, vol. 115, pp. 619–640, 2021. [8] L. Lyu, H. Yu, X. Ma, C. Chen, L. Sun, J. Zhao, Q. Yang, and P. S. Yu, “Privacy and robustness in federated learning: Attacks and defenses,” IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 7, pp. 8726–8746, 2024. [9] K. Hsieh, A. Phanishayee, O. Mutlu, and P. B. Gibbons, “The non-iid data quagmire of decentralized machine learning,” in Proceedings of the 37th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 119. PMLR, 2020, pp. 4387–4398. [10] M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 739–753. [11] R. Ismail, T. A. Syed, and S. Musa, “Design and implementation of an efficient framework for behaviour attestation using n-call slides,” in Proceedings of the 8th International Conference on Ubiquitous Information Management and Communication, ser. ICUIMC ’14. New York, NY, USA: Association for Computing Machinery, 2014. [Online]. Available: https://doi.org/10.1145/2557977.2558002 [12] Z. Wang, M. Song, Z. Zhang, Y. Song, Q. Wang, and H. Qi, “Beyond inferring class representatives: User-level privacy leakage from federated learning,” in IEEE INFOCOM 2019 - IEEE Conference on Computer Communications. IEEE, 2019, pp. 2512–2520. [13] C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014. [14] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2016, pp. 308–318. [15] I. Mironov, “Rényi differential privacy,” in 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, 2017, pp. 263–275. [16] R. C. Geyer, T. Klein, and M. Nabi, “Differentially private federated learning: A client level perspective,” in NeurIPS 2017 Workshop on Machine Learning on the Phone and Other Consumer Devices, 2017. [17] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1175–1191. [18] F. Sattler, S. Wiedemann, K.-R. Müller, and W. Samek, “Robust and communication-efficient federated learning from non-IID data,” IEEE Transactions on Neural Networks and Learning Systems, vol. 31, no. 9, pp. 3400–3413, 2020. [19] T. A. Syed, M. S. Siddiqui, A. Akarma, and A. Formisano, “Fedagentchain: A secure federated and agentic ai framework for multilingual disability-inclusive employment in ai cities,” Smart Cities, vol. 9, no. 7, 2026. [Online]. Available: https://www.mdpi.com/2624-6511/9/7/106 [20] T. A. Syed, A. Akarma, M. T. Naqash, D. Hameed, S. Kamal, and A. Formisano, “Agentic ai for climate-resilient cities: A prisma-guided review and digital twin framework,” Sustainability, vol. 18, no. 17, 2026. [Online]. Available: https://www.mdpi.com/2071-1050/18/17/8917 [21] X. Li, M. Jiang, X. Zhang, M. Kamp, and Q. Dou, “Fedbn: Federated learning on non-iid features via local batch normalization,” in International Conference on Learning Representations, 2021. [22] D. Anguita, A. Ghio, L. Oneto, X. Parra, and J. L. Reyes-Ortiz, “A public domain dataset for human activity recognition using smartphones,” in 21st European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning (ESANN), 2013, pp. 437–442.

Related documents

• A scalable and secure federated learning authentication scheme for IoT.#1227
• FEDBUD: Joint Incentive and Privacy Optimization for Resource-Constrained Federated Learning#10317
• Efficient Verifiable Protocol for Privacy-Preserving Aggregation in Federated Learning#177285
• LADSG: Label-Anonymized Distillation and Similar Gradient Substitution for Label Privacy in Vertical Federated Learning#139179
• Statistical Limits and Efficient Algorithms for Differentially Private Federated Learning#200490