Federated Learning in Privacy-Preserving AI

Abstract

Federated learning enables multiple parties to collaboratively train a shared machine learning model without exchanging raw data, offering a promising path toward privacy-preserving AI in domains where data centralisation is legally prohibited or practically infeasible. However, the privacy guarantees of vanilla federated learning are weaker than commonly assumed: gradient updates can leak substantial information about individual training examples, and the distributed training process introduces unique vulnerabilities to poisoning and inference attacks. This study presents a systematic empirical evaluation of five federated learning configurations -- FedAvg (baseline), FedAvg with differential privacy (DP-FedAvg), FedProx, Secure Aggregation (SecAgg), and a combined DP + SecAgg protocol -- across four privacy-sensitive domains: clinical diagnosis (chest X-ray classification across 12 simulated hospitals), financial fraud detection (transaction data across 8 banks), mobile keyboard prediction (next-word across 500 simulated devices), and smart home activity recognition (sensor data across 200 households). A total of 2,400 training runs evaluated the privacy-utility trade-off under calibrated threat models. DP-FedAvg with epsilon = 8 achieved a mean accuracy reduction of only 2.4 +- 0.8% relative to centralised training while providing formal privacy guarantees, but epsilon = 1 (strong privacy) imposed a 12.8 +- 3.2% accuracy penalty. Secure Aggregation eliminated gradient leakage with less than 0.3% accuracy impact but did not protect against inference attacks on the final model. The combined DP + SecAgg protocol provided the strongest empirical privacy at epsilon = 4 with a manageable 4.8 +- 1.4% accuracy cost. Non-IID data distribution across clients was the dominant factor degrading federated model quality (partial R2 = 0.58), outweighing privacy mechanism overhead. A practical deployment guide mapping regulatory requirements and threat models to recommended FL configurations is proposed.