Federated learning trains a shared model across devices that keep their raw data local, exchanging only model updates; it now works well enough to beat centralised baselines in specific edge tasks, but its privacy and robustness guarantees depend on cryptography and hardware that are still being built.
Summary
Federated learning (FL) inverts the usual machine learning pipeline. Instead of pooling data in a central store and training there, each participating device trains on its own data locally and sends only model updates to a server, which averages them into a global model. Federated Averaging (FedAvg) is the canonical aggregation rule. The claimed benefit is that raw data never leaves the device, so the approach fits domains where pooling is illegal, commercially impossible or physically impractical: patient signals, handset radio measurements, vehicle sensor streams, industrial telemetry.
The mechanism creates three new problems in place of the one it solves. First, model updates are not private by construction: gradients can be inverted to recover training data, which is why deployments layer on differential privacy, secure aggregation or secure multiparty computation. Second, those defences cost bandwidth and latency that edge devices often do not have; secure multiparty computation in particular imposes communication overhead described as prohibitive against IoT latency and energy budgets. Third, the system trusts its clients. Because the server sees only updates, a malicious participant can poison the global model, and recent work shows that in the quantum FL setting a single malicious client can cut accuracy by up to 50% under FedAvg even with popular Byzantine-robust defences in place.
The parameters that decide whether FL is the right choice are therefore: how heterogeneous and non-IID the client data is, how much communication per round the network can afford, whether the privacy claim needs to be enforceable rather than asserted, and how many clients can be assumed honest. A recurring theme in the current literature is that the answers are being pushed into hardware. Proposals include a hardware mechanism that guarantees only differentially private results can leave a device, removing the need to trust a third-party FL application that today is given full access to sensitive data, a TrustZone-based framework that moves cryptographic setup into idle windows and cuts active-phase latency by up to 74% versus synchronous secure aggregation, and a 65-nm neuromorphic encoder that supports federated learning at 357.32 nJ per training update.
A longer-standing framing places FL inside the wider privacy-enhancing technology (PET) stack alongside multiparty computation, homomorphic encryption and zero-knowledge proofs, on the thesis that securing data during processing unlocks a new market in confidential data collaboration ref. Practitioners in that stack caution that decentralisation is not automatically privacy: there is no general principle that distributed computing is more private than centralised computing, and it depends on system configuration, application requirements and the specific threat ref.
Evidence base
- 5 May 2026: a FedAvg-trained 1DCNN on over-the-air 5G SSB IQ samples reached 97% accuracy and 97% F1 for jamming detection, reported to outperform centralised MLP, 1DCNN, SVM and logistic regression baselines without sharing raw RF data
- 28 May 2026: under a circuit-level backdoor threat model on MNIST and CIFAR-10 with non-IID splits, a single malicious client degraded FedAvg accuracy severely, and Krum, Multi-Krum, FoolsGold, FLGuardian and Mud-HoG failed to eliminate worst cases where accuracy dropped up to 50%
- 16 June 2026: a fabricated 65-nm privacy-preserving neuromorphic encoder with federated learning support achieved 7.13 nJ per encoding, 76.44 nJ per prediction, 357.32 nJ per training update, 93.2% EMG accuracy and 96.1% UCI-HAR accuracy
- 16 June 2026: real-life FL deployments are described as assuming a third-party application can be trusted to implement differential privacy correctly, and are therefore given full access to sensitive data, motivating hardware-enforced privacy budgets
- 28 July 2026: CHRONOS reduced active-phase latency by up to 74% versus synchronous secure aggregation on a 32-node Rock Pi 4 and Orange Pi 5 testbed with a persistent Secure World footprint under 1.1 KB, on the premise that existing secure MPC defences exceed IoT latency and energy budgets
- 3 August 2026: FedQML-Edge reduced test log loss by 14.4% versus the strongest matched classical sketch on NGSIM and used 7 to 28 times less communication per round than larger MLPs on SUMO, sharing only classifier updates
- 2 August 2026: NSF VINES NextG awards of $559,850, $307,250 and $592,000 fund AI-enabled, quantum-secure cellular networks and secure hospital robotics with commitments to release open-source software and evaluation tools for standards development
Open questions
- Do the reported gains of federated over centralised training on 5G jamming detection (97% accuracy and F1) replicate on real multi-user handset populations with non-IID data, or are they an artefact of the SSB IQ dataset split?
- Can hardware-enforced differential privacy of the DataGuard type be integrated into commodity mobile and accelerator silicon at acceptable area and performance cost, and who certifies the guarantee?
- Does the CHRONOS result (74% active-phase latency reduction, sub-1.1 KB Secure World footprint) hold beyond 32 nodes and under realistic client churn?
- Is there any aggregation rule that bounds worst-case damage from a single malicious client without assuming a trusted enrolment process for clients?
Assessment drafted 2026-08-31 from up to 18 KB sources using the technology-scorecard framework; scores are a draft read pending review.