The core dilemma the review describes is architectural. The most accurate image-analysis models are built by centralizing data: collecting every image in one place so a neural network can learn from all of it. But centralizing surveillance footage concentrates exactly the kind of sensitive biometric and behavioral information that privacy laws, governance policies, and re-identification research worry about. Federated learning, introduced as a practical alternative in 2017, inverts the arrangement. Instead of shipping images to a central server, each camera or client trains a local copy of the model on its own data and sends only model updates—the gradients that describe how its parameters should change—to an aggregator, which averages them into a shared global model using the FedAvg algorithm. Raw footage never leaves the device. The scheme fits urban sensing naturally, because cities already have enormous numbers of distributed devices with local storage and limited bandwidth.

Yet federated learning alone, the review emphasizes, does not actually guarantee privacy. This is the surprise that transformed the field. In 2019, researchers demonstrated that the gradients a client uploads can be mathematically inverted to reconstruct training images pixel-for-pixel, in an attack memorably titled Deep Leakage from Gradients. Successive refinements made reconstruction feasible for realistically sized batches, extended the technique to whole image sets, and added recursive linear-algebraic attacks. A 2023 systematic categorization of the field divides gradient-leakage methods into bias attacks, optimization-based attacks, and linear equation-solver attacks, and confirms something especially worrying for surveillance: images are substantially more vulnerable to near-exact reconstruction than text or tabular data, because they are high-dimensional and redundant. Beyond gradient inversion, the review catalogues membership inference attacks that reveal whether a particular person’s image was in a training set, property inference attacks that deduce aggregate attributes of a client’s data, and model extraction attacks that steal the trained model itself. In other words, sharing updates instead of images is a necessary step, not a sufficient one.

That is where differential privacy enters. Differential privacy is a formal, mathematically defined guarantee: it bounds how much the learning process can be influenced by any single example in the training data, ensuring that the final model would look statistically similar whether or not any one image was included. In practice, the guarantee is implemented through an algorithm called DP-SGD, first benchmarked on image classification in 2016. DP-SGD computes gradients for each training example individually, clips each one to a bounded maximum size, and then adds calibrated Gaussian noise before the results are aggregated. The strength of the protection is governed by a privacy budget, denoted by the Greek letter epsilon. A smaller epsilon means stronger privacy but more noise and therefore lower accuracy—a fundamental trade-off that no amount of clever engineering has eliminated. Secure aggregation protocols are typically layered on top, using cryptography so the server sees only the noised sum of all clients’ updates and never any individual contribution. The combination of these ingredients is DPFL.

The review’s most striking quantitative finding concerns how fast this trade-off has improved. On CIFAR-10, the standard image-classification benchmark used across nearly a decade of research, the first DP-SGD results in 2016 reported 73.0 percent top-1 accuracy at a privacy budget of epsilon equal to 8, roughly 22 percentage points below a non-private baseline of about 95 percent. By 2022, careful scaling and tuning of large over-parameterized models had pushed the private state of the art to 81.4 percent at the same budget, narrowing the gap to roughly 13 to 14 points. Progress was not perfectly monotonic—the earliest result used pre-trained convolutional layers, which changes the effective privacy setup—and the trajectory has been powered by innovations such as adaptive and automatic clipping, which remove the need for hand-tuning the clipping threshold, and architecture designs optimized specifically for private training. The review also notes the cost of tighter protection: on the same architecture, accuracy falls from 73 percent at epsilon 8 to 67 percent at epsilon 2, so cities with stricter privacy requirements should expect to pay more in model performance.

Crucially, the authors draw a line that much of the broader literature blurs. Those celebrated benchmark numbers all come from centralized training on curated datasets, where a single trusted party holds everything. Federated DPFL adds a second layer of difficulty: gradients are clipped and noised locally, then aggregated across clients whose data distributions differ substantially—so-called non-IID data—because cameras in different locations see different scenes. Studies in this federated regime report smaller but more realistic gains. Clustered federated learning with adaptive local differential privacy improved the privacy-utility balance on heterogeneous Internet-of-Things data; adaptive noise mechanisms beat fixed-noise baselines at the same privacy level; and one reliable federated scheme improved accuracy by 1.1 percent while cutting convergence time by more than 9 percent. Evidence from medical imaging, which shares core mechanics with surveillance, suggests acceptable performance at moderate budgets around epsilon 10 but substantial degradation under strict budgets around epsilon 1.

Applied smart-city systems are now demonstrating what hybrid designs can achieve. A federated anomaly-detection approach for CCTV surveillance avoided sharing raw footage entirely and achieved 95 percent accuracy under random data splits, or 86 percent under balanced splits. A remote-sensing classification framework designed to tolerate a dishonest majority of malicious participants saw accuracy fall from 92.5 percent with 20 percent attacker participation to 81.84 percent with 80 percent—an eleven-point penalty that quantifies the price of distrust. Perhaps most eye-catching are the hybrid stacks: a framework combining differential privacy with homomorphic encryption, which allows computation on encrypted data, retained 95.2 percent accuracy even at a strict privacy budget of epsilon 1.0 with minimal degradation. A companion approach pairing homomorphic encryption with dynamic differential privacy and compression reached 92.6 percent accuracy while cutting transmission volume by 40 percent and latency by 43 percent. And a quantum-inspired aggregation scheme reported 94.7 percent accuracy with 43 percent less overhead and only a 2.1 percent degradation relative to a non-private baseline. A blockchain-backed framework handling 100 clients with 15 percent malicious participants reported more than 90 percent accuracy, 32 percent lower overhead, and less than 4 percent accuracy loss at epsilon 1.

The authors insert an important dose of skepticism here: those applied figures are not directly comparable to one another or to the CIFAR-10 benchmarks. They use different datasets, architectures, privacy accounting methods, and threat models, and some easier task framings—such as binary anomaly detection rather than full multi-class classification—likely inflate apparent accuracy. Nor are epsilon values necessarily on a common scale across studies, since neighboring datasets can be defined differently, as adding or removing one image versus one client, and cumulative privacy loss across training rounds further erodes the guarantee over a full deployment. A single reported epsilon can therefore carry very different real-world implications depending on context. The review concludes that no standardized guidance exists for what privacy budget meaningfully protects citizens while preserving public-safety-relevant accuracy in surveillance settings.

That gap leads to the review’s central caution: DPFL is a credible, rapidly maturing framework rather than a finished solution. Nearly all gradient-leakage attacks have been demonstrated in controlled settings with known architectures and small batches, so their success rate against production-scale systems defended by secure aggregation remains an open empirical question. Real camera networks bring non-IID data, heterogeneous hardware, and communication constraints that curated benchmarks simply do not capture. Hybrid stacks that deliver the best accuracy also add system complexity and latency that may clash with real-time public-safety requirements. The authors’ proposed path forward is fourfold: benchmark DPFL on heterogeneous, non-IID camera data rather than curated datasets; validate resistance to gradient leakage against production-scale secure aggregation and adversarial client populations; converge on domain-specific epsilon guidance balancing public-safety accuracy against re-identification risk; and evaluate hybrid privacy stacks for the latency and complexity costs they impose, not only the accuracy they recover. For a field racing to keep cities intelligent without making their citizens transparent, that measured verdict may be the review’s most valuable contribution.

Subject of Research: Differentially private federated learning for privacy-preserving image analysis in smart-city surveillance systems

Article Title: Differentially private federated learning for image analysis in smart-city surveillance

Article References: Pandya, N., & Mistry, D. (2026). Differentially private federated learning for image analysis in smart-city surveillance. Frontiers in Imaging, 5, Article 1966936. https://doi.org/10.3389/fimag.2026.1966936

Image Credits: AI Generated

DOI: 10.3389/fimag.2026.1966936

Keywords: differential privacy, federated learning, DP-SGD, gradient leakage, smart-city surveillance, image classification, privacy-utility trade-off, homomorphic encryption, secure aggregation, remote sensing, CIFAR-10, urban IoT

Federated learning is not a new idea. Instead of shipping data to a central server, the technique sends the model to the data: each hospital trains the algorithm locally on its own patients and shares only the resulting parameter updates, which are then averaged into a global model. The problem, as the researchers emphasize, is that sharing gradients is not the same as sharing nothing. Sophisticated adversaries can reconstruct individual patient records from model updates, a class of threats known as gradient leakage and membership inference attacks. On top of that, real hospital networks are messy places, with devices of wildly different computing power, unreliable wireless links, and data distributions that differ from one ward to the next, a condition researchers call non-IID data. Conventional federated frameworks tend to stumble under exactly these conditions.

FedDeepRiskNet++ attacks the problem with four interlocking modules, each addressing a different failure mode. The first is differential privacy, a mathematically rigorous method of protecting individuals in a dataset by injecting carefully calibrated noise into the local model updates before they leave the hospital. The noise is large enough to make it impossible to infer whether any single patient’s record contributed to a result, but small enough that the aggregate statistical signal survives. The second module is secure aggregation based on CKKS homomorphic encryption, a scheme introduced by cryptographers Cheon, Kim, Kim and Song that allows arithmetic to be performed directly on encrypted numbers. In practice, this means the central server can combine the encrypted updates from all participating hospitals and never see any of them in decrypted form.

The third and arguably most novel component is what the authors call adaptive privacy-budget scheduling, or APBS. Differential privacy is governed by a parameter called epsilon, the privacy budget: a smaller epsilon means stronger privacy but noisier, less useful updates, while a larger epsilon improves accuracy at the cost of confidentiality. Most systems fix this value once and live with the trade-off. APBS instead treats it as a dynamic dial, adjusting the privacy budget in real time according to each client’s reliability, energy status, and communication conditions. A well-connected, trustworthy hospital node running on stable power can operate with tighter privacy; a struggling device on a congested network can be allocated a different budget so that the global model’s utility does not collapse. The researchers report that this adaptive scheduling significantly improves the privacy-utility trade-off compared with static allocation, a conclusion they back up with ablation experiments that remove individual modules and measure the damage.

The fourth module tackles a less glamorous but equally critical bottleneck: communication. In large-scale federated systems, the sheer volume of model updates shuttling between hospitals and the aggregation server can overwhelm networks and drain the batteries of edge devices. FedDeepRiskNet++ employs adaptive gradient sparsification, transmitting only the most significant portions of each update rather than the full parameter set, combined with what the authors describe as encryption-aware communication packaging, which bundles the sparse updates so that the overhead of homomorphic encryption does not erase the savings. The result, according to the paper, is a reduction in communication cost of approximately 23 percent compared with standard approaches, with cumulative communication overhead held to 165 megabytes.

The performance numbers are the study’s headline claim. Tested on two widely used clinical datasets, PhysioNet 2023 and MIMIC-III, the framework achieved 91.2 percent classification accuracy and a 90.1 percent F1-score, a balanced measure of precision and recall that matters greatly in medical settings where both missed diagnoses and false alarms carry costs. Crucially, these results were obtained while maintaining a low privacy budget of epsilon equal to 2.9, a level that represents meaningful formal privacy protection rather than a token gesture. The authors compared their system against a series of established baselines, including the canonical FedAvg algorithm, the differentially private DP-FedAvg, the privacy-aware hierarchical framework PAHFL, Health-FedNet, and their own earlier FedDeepRiskNet, and found that the new framework also converged faster under heterogeneous non-IID hospital conditions, meaning it needed fewer communication rounds to reach a usable model.

Why does this matter beyond the benchmark tables? The Internet of Medical Things has expanded explosively, with connected monitors, infusion pumps, wearable sensors and imaging devices generating continuous streams of clinical data. Predictive models trained on a single hospital’s population inevitably inherit its blind spots, and the COVID-19 pandemic demonstrated both the promise and the difficulty of cross-institutional collaboration, as researchers who built federated models for predicting clinical outcomes in COVID-19 patients learned firsthand. A framework that combines formal privacy guarantees, cryptographic protection, and communication efficiency could make it practical for networks of hospitals, including smaller facilities with limited infrastructure, to contribute to large-scale diagnostic models without exposing their patients or exhausting their networks.

The study also reflects a broader shift in how the machine learning community thinks about privacy. For years, differential privacy and homomorphic encryption were seen as alternatives, each too costly to combine with the other. FedDeepRiskNet++ is part of a growing body of work arguing that layered defenses, noise plus encryption plus sparsification, can coexist if each layer is engineered with the others in mind. The adaptive scheduling of the privacy budget is particularly significant because it acknowledges a truth that static designs ignore: privacy is not a fixed setting but a resource that must be spent wisely across a fleet of heterogeneous devices. The work builds on the team’s earlier energy-aware FedDeepRiskNet system for multi-hospital environments, extending it with the encryption and scheduling machinery needed for security-critical deployments.

There are, of course, limits to what any single study can establish. The experiments were conducted on retrospective datasets rather than in live hospital deployments, and the authors note that no datasets were newly generated or analyzed beyond the benchmark evaluations. Real-world rollouts will need to confront regulatory audits, adversarial participants, and the operational realities of hospital IT departments. The research was funded by the Deanship of Graduate Studies and Scientific Research at Jazan University, and the team includes Noha Mostafa of Jazan’s computer sciences department and Ayman A. Alharbi of Umm Al-Qura University. Still, the central demonstration stands: strong privacy protection, communication efficiency, and high diagnostic reliability can coexist within large-scale federated healthcare systems. If frameworks like FedDeepRiskNet++ mature from benchmarks into clinical infrastructure, the era in which hospitals must choose between protecting their patients and advancing medicine may finally be drawing to a close.

Subject of Research: Privacy-preserving federated learning for secure medical Internet of Things systems

Article Title: FedDeepRiskNet++: a privacy-enhanced federated learning framework for secure and scalable medical IoT systems

Article References: FedDeepRiskNet++: a privacy-enhanced federated learning framework for secure and scalable medical IoT systems. (n.d.). https://doi.org/10.1007/s10586-026-06616-6

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06616-6

Keywords: federated learning, differential privacy, homomorphic encryption, medical IoT, healthcare AI, data privacy, secure aggregation, communication efficiency, non-IID data, clinical prediction, edge computing, privacy budget