The core dilemma the review describes is architectural. The most accurate image-analysis models are built by centralizing data: collecting every image in one place so a neural network can learn from all of it. But centralizing surveillance footage concentrates exactly the kind of sensitive biometric and behavioral information that privacy laws, governance policies, and re-identification research worry about. Federated learning, introduced as a practical alternative in 2017, inverts the arrangement. Instead of shipping images to a central server, each camera or client trains a local copy of the model on its own data and sends only model updates—the gradients that describe how its parameters should change—to an aggregator, which averages them into a shared global model using the FedAvg algorithm. Raw footage never leaves the device. The scheme fits urban sensing naturally, because cities already have enormous numbers of distributed devices with local storage and limited bandwidth.

Yet federated learning alone, the review emphasizes, does not actually guarantee privacy. This is the surprise that transformed the field. In 2019, researchers demonstrated that the gradients a client uploads can be mathematically inverted to reconstruct training images pixel-for-pixel, in an attack memorably titled Deep Leakage from Gradients. Successive refinements made reconstruction feasible for realistically sized batches, extended the technique to whole image sets, and added recursive linear-algebraic attacks. A 2023 systematic categorization of the field divides gradient-leakage methods into bias attacks, optimization-based attacks, and linear equation-solver attacks, and confirms something especially worrying for surveillance: images are substantially more vulnerable to near-exact reconstruction than text or tabular data, because they are high-dimensional and redundant. Beyond gradient inversion, the review catalogues membership inference attacks that reveal whether a particular person’s image was in a training set, property inference attacks that deduce aggregate attributes of a client’s data, and model extraction attacks that steal the trained model itself. In other words, sharing updates instead of images is a necessary step, not a sufficient one.

That is where differential privacy enters. Differential privacy is a formal, mathematically defined guarantee: it bounds how much the learning process can be influenced by any single example in the training data, ensuring that the final model would look statistically similar whether or not any one image was included. In practice, the guarantee is implemented through an algorithm called DP-SGD, first benchmarked on image classification in 2016. DP-SGD computes gradients for each training example individually, clips each one to a bounded maximum size, and then adds calibrated Gaussian noise before the results are aggregated. The strength of the protection is governed by a privacy budget, denoted by the Greek letter epsilon. A smaller epsilon means stronger privacy but more noise and therefore lower accuracy—a fundamental trade-off that no amount of clever engineering has eliminated. Secure aggregation protocols are typically layered on top, using cryptography so the server sees only the noised sum of all clients’ updates and never any individual contribution. The combination of these ingredients is DPFL.

The review’s most striking quantitative finding concerns how fast this trade-off has improved. On CIFAR-10, the standard image-classification benchmark used across nearly a decade of research, the first DP-SGD results in 2016 reported 73.0 percent top-1 accuracy at a privacy budget of epsilon equal to 8, roughly 22 percentage points below a non-private baseline of about 95 percent. By 2022, careful scaling and tuning of large over-parameterized models had pushed the private state of the art to 81.4 percent at the same budget, narrowing the gap to roughly 13 to 14 points. Progress was not perfectly monotonic—the earliest result used pre-trained convolutional layers, which changes the effective privacy setup—and the trajectory has been powered by innovations such as adaptive and automatic clipping, which remove the need for hand-tuning the clipping threshold, and architecture designs optimized specifically for private training. The review also notes the cost of tighter protection: on the same architecture, accuracy falls from 73 percent at epsilon 8 to 67 percent at epsilon 2, so cities with stricter privacy requirements should expect to pay more in model performance.

Crucially, the authors draw a line that much of the broader literature blurs. Those celebrated benchmark numbers all come from centralized training on curated datasets, where a single trusted party holds everything. Federated DPFL adds a second layer of difficulty: gradients are clipped and noised locally, then aggregated across clients whose data distributions differ substantially—so-called non-IID data—because cameras in different locations see different scenes. Studies in this federated regime report smaller but more realistic gains. Clustered federated learning with adaptive local differential privacy improved the privacy-utility balance on heterogeneous Internet-of-Things data; adaptive noise mechanisms beat fixed-noise baselines at the same privacy level; and one reliable federated scheme improved accuracy by 1.1 percent while cutting convergence time by more than 9 percent. Evidence from medical imaging, which shares core mechanics with surveillance, suggests acceptable performance at moderate budgets around epsilon 10 but substantial degradation under strict budgets around epsilon 1.

Applied smart-city systems are now demonstrating what hybrid designs can achieve. A federated anomaly-detection approach for CCTV surveillance avoided sharing raw footage entirely and achieved 95 percent accuracy under random data splits, or 86 percent under balanced splits. A remote-sensing classification framework designed to tolerate a dishonest majority of malicious participants saw accuracy fall from 92.5 percent with 20 percent attacker participation to 81.84 percent with 80 percent—an eleven-point penalty that quantifies the price of distrust. Perhaps most eye-catching are the hybrid stacks: a framework combining differential privacy with homomorphic encryption, which allows computation on encrypted data, retained 95.2 percent accuracy even at a strict privacy budget of epsilon 1.0 with minimal degradation. A companion approach pairing homomorphic encryption with dynamic differential privacy and compression reached 92.6 percent accuracy while cutting transmission volume by 40 percent and latency by 43 percent. And a quantum-inspired aggregation scheme reported 94.7 percent accuracy with 43 percent less overhead and only a 2.1 percent degradation relative to a non-private baseline. A blockchain-backed framework handling 100 clients with 15 percent malicious participants reported more than 90 percent accuracy, 32 percent lower overhead, and less than 4 percent accuracy loss at epsilon 1.

The authors insert an important dose of skepticism here: those applied figures are not directly comparable to one another or to the CIFAR-10 benchmarks. They use different datasets, architectures, privacy accounting methods, and threat models, and some easier task framings—such as binary anomaly detection rather than full multi-class classification—likely inflate apparent accuracy. Nor are epsilon values necessarily on a common scale across studies, since neighboring datasets can be defined differently, as adding or removing one image versus one client, and cumulative privacy loss across training rounds further erodes the guarantee over a full deployment. A single reported epsilon can therefore carry very different real-world implications depending on context. The review concludes that no standardized guidance exists for what privacy budget meaningfully protects citizens while preserving public-safety-relevant accuracy in surveillance settings.

That gap leads to the review’s central caution: DPFL is a credible, rapidly maturing framework rather than a finished solution. Nearly all gradient-leakage attacks have been demonstrated in controlled settings with known architectures and small batches, so their success rate against production-scale systems defended by secure aggregation remains an open empirical question. Real camera networks bring non-IID data, heterogeneous hardware, and communication constraints that curated benchmarks simply do not capture. Hybrid stacks that deliver the best accuracy also add system complexity and latency that may clash with real-time public-safety requirements. The authors’ proposed path forward is fourfold: benchmark DPFL on heterogeneous, non-IID camera data rather than curated datasets; validate resistance to gradient leakage against production-scale secure aggregation and adversarial client populations; converge on domain-specific epsilon guidance balancing public-safety accuracy against re-identification risk; and evaluate hybrid privacy stacks for the latency and complexity costs they impose, not only the accuracy they recover. For a field racing to keep cities intelligent without making their citizens transparent, that measured verdict may be the review’s most valuable contribution.

Subject of Research: Differentially private federated learning for privacy-preserving image analysis in smart-city surveillance systems

Article Title: Differentially private federated learning for image analysis in smart-city surveillance

Article References: Pandya, N., & Mistry, D. (2026). Differentially private federated learning for image analysis in smart-city surveillance. Frontiers in Imaging, 5, Article 1966936. https://doi.org/10.3389/fimag.2026.1966936

Image Credits: AI Generated

DOI: 10.3389/fimag.2026.1966936

Keywords: differential privacy, federated learning, DP-SGD, gradient leakage, smart-city surveillance, image classification, privacy-utility trade-off, homomorphic encryption, secure aggregation, remote sensing, CIFAR-10, urban IoT