Abstract
Federated learning combined with differential privacy offers a practical way to train image-analysis models on distributed camera and sensor networks. This combination is most often implemented through DP-SGD, and it avoids centralizing raw visual data. This mini review examines differentially private federated learning (DPFL) in smart-city surveillance, tracing the method from the original DP-SGD formulation to newer, high-accuracy variants, and examining the gradient-leakage threat DPFL is intended to mitigate. We draw on more than 60 sources. These span federated-learning architectures, differential-privacy mechanisms, gradient-inversion attacks, and image-centric applications in surveillance, remote sensing, and IoT-enabled smart cities. Together, they show that DPFL is a credible, rapidly maturing framework rather than a finished solution. Across published CIFAR-10 results at a fixed privacy budget, the gap between private and non-private image classification has narrowed substantially. It fell from about 22 percentage points in 2016 to roughly 13–14 points by 2022. Applied smart-city systems now combine DP with secure aggregation, homomorphic encryption, or adaptive noise. These systems report accuracies above 90%, with reduced communication overhead. The review concludes by identifying the main barriers to moving DPFL from curated benchmarks and hybrid pilot systems to heterogeneous, real-world camera networks.
1 Introduction
Smart cities increasingly rely on dense networks of cameras and imaging sensors, supporting traffic management, public safety, and infrastructure monitoring. The resulting data streams are sensitive and distributed, spanning transportation, surveillance, healthcare, energy, and unmanned-aerial-vehicle monitoring. This makes privacy-preserving analytics a design requirement, not an add-on, for urban imaging systems (Pandya et al., 2023; ; Singh et al., 2025). Centralizing these data for model training concentrates sensitive biometric and behavioral information, raising privacy, governance, and re-identification concerns. Federated learning (FL) reduces this exposure: clients train locally and share only model updates instead of raw images, supporting decentralized urban sensing (; ; ). However, FL alone does not prevent information leakage from those shared updates; gradient-inversion and membership-inference attacks, demonstrated primarily in controlled research settings (Section 3.4), show that model updates can still reveal information about training data, making additional privacy protection necessary.
Differential privacy (DP) addresses this residual risk by adding calibrated noise to the training process and bounding the influence of any single example. In image-analysis pipelines, DP is most commonly combined with FL through DP-SGD, which clips and perturbs gradients before aggregation. This combination, differentially private federated learning (DPFL), is now the leading formal defense for privacy-preserving distributed image analysis, and a recent systematic review situates it as the dominant approach across the DP-FL literature (). Two imaging domains show why this matters most for this journal's scope. Remote sensing is a strong example: satellite and aerial image classification supports urban planning, construction, and water management, yet the underlying imagery is often sensitive and access-controlled (Zhu et al., 2023). Surveillance is the other core example: AI-enabled video systems improve public security but also collect highly sensitive visual data, raising confidentiality concerns for the people captured in them (; Qamar et al., 2026). Broader smart-city imaging pipelines, such as digital-twin-based traffic systems, face comparable exposure whenever camera or sensor data feed model training (Tariq et al., 2026; Wajid et al., 2025).
Prior surveys cover FL in smart cities broadly (; Pandya et al., 2023) or DP-FL mechanisms in general (), but neither centers the image-analysis, surveillance-specific reading of DPFL given here. This review's contribution is threefold: distinguishing centralized DP-SGD image benchmarks from federated DP-SGD (DPFL) results, a distinction the broader literature often blurs (Section 3.2–3.3); consolidating quantitative privacy–utility evidence, spanning CIFAR-10 benchmarks and applied smart-city, surveillance, and remote-sensing systems, into one comparative view (Table 1); and identifying the specific barriers separating strong benchmark results from reliable deployment on real, heterogeneous camera networks (Section 5). We trace DPFL's development from the original DP-SGD formulation to recent, high-accuracy, and hybrid variants, focusing on the privacy–utility trade-off that matters most for surveillance, remote sensing, and related smart-city deployments.
Table 1
| Study/method | Setting | Reported result | Note |
|---|---|---|---|
| Benchmark studies—centralized DP-SGD, CIFAR-10 (not federated) | |||
| (), DP-SGD (pre-trained conv. layers) | CIFAR-10 benchmark, ε = 8 | 73.0% top-1 accuracy | First formal-DP image benchmark |
| Pre-2022 DP state of the art (various) | CIFAR-10 benchmark, ε = 8 | ~71.7% top-1 accuracy | Intermediate progress point |
| (), scale + tuning (WRN-40, from scratch) | CIFAR-10 benchmark, ε = 8 | 81.4% top-1 accuracy | New CIFAR-10 DP state of the art |
| Non-private baseline (approx., comparable architecture) | CIFAR-10 benchmark | ~95% top-1 accuracy | Reference ceiling |
| Applied studies—federated DPFL, real/simulated smart-city, surveillance, and remote-sensing systems | |||
| (Zhu et al. 2023), blockchain PPFL + secure aggregation | Remote-sensing classification, dishonest majority | 92.5% → 81.84% | As attacker share rises 20% → 80% |
| (Qamar et al. 2026), federated anomaly detection | Smart-city surveillance (CCTV) | 95% (random split), 86% (balanced) | Avoids raw footage sharing |
| (), DP + homomorphic encryption | Smart-city services | 95.2% at ε = 1.0 | Minimal degradation vs. non-private |
| (), HE + dynamic DP + compression | Smart-city datasets | 92.6% accuracy | −40% transmission, −43% latency |
| (Sudame et al. 2025), DP + quantum-inspired aggregation | Urban edge computing | 94.7% accuracy | −43% overhead, −2.1% degradation |
Representative accuracy and efficiency results for differential privacy in image classification and smart-city imaging applications.
The table is split into two groups that are not directly comparable: centralized DP-SGD benchmarks (single trusted party, CIFAR-10, no aggregation) and applied federated DPFL systems (real or simulated multi-client deployments), which differ in dataset, architecture, privacy accounting, and threat model.
2 Mechanism
In standard FL, each client trains a local model on its own image data. Clients send only model updates to a central aggregator. The aggregator averages these updates into a global model using the FedAvg algorithm (McMahan et al., 2017). DP-SGD () modifies the local training step. Per-example gradients are computed, then individually clipped to a bounded norm. They are summed and perturbed with calibrated Gaussian noise before the aggregator sees them. Figure 1 summarizes this training round.
Figure 1
The noise magnitude is governed by a privacy budget, ε. A smaller ε means stronger privacy but lower accuracy; Section 4 explores this trade-off quantitatively. Secure aggregation protocols () are frequently layered on top. This way, the server sees only the noised sum of client updates, never any individual client's contribution. Wei et al. (2020) provided the first systematic performance analysis of DP-SGD within the federated, rather than centralized, setting. Their work established convergence bounds that underpin most subsequent surveillance-oriented DPFL work. ) situate this within a broader taxonomy. That taxonomy spans input, objective, and output perturbation strategies across the DP-FL literature.
3 Literature review
The literature synthesized below was drawn from targeted searches across major digital repositories, including IEEE Xplore, ACM Digital Library, Google Scholar, and arXiv, using terms combining differential privacy, federated learning, DP-SGD, and image-centric applications in surveillance, remote sensing, and smart cities. Candidate publications were retained if they reported quantitative image-classification results under a stated privacy budget, introduced or analyzed a DP-SGD or DPFL mechanism, or applied DPFL to a surveillance, remote-sensing, or smart-city imaging task; duplicates and studies unrelated to image or visual-sensor data were excluded, yielding a corpus of more than sixty publications, spanning peer-reviewed venues and preprints, synthesized narratively below rather than through a systematic protocol.
3.1 Foundational federated learning architectures
FedAvg (McMahan et al., 2017) remains the base aggregation method most DPFL surveillance systems build on. ) extended this with secure aggregation, cryptographically masking client updates and remaining the standard companion to DP-SGD in production. More recent architectures add TEE-based isolation, or remove the need for a single trusted aggregator via distributed-DP frameworks (). Broad urban-systems surveys converge: FL fits smart-city sensing because it keeps raw data on-device while supporting citywide training (; Pandya et al., 2023; ; Tariq et al., 2026; ; ).
3.2 Centralized DP-SGD benchmarks for image classification
This subsection covers centralized DP-SGD: a single trusted party holds the full dataset and trains under DP, with no federated aggregation step. ) established per-example gradient clipping plus Gaussian noise addition as the standard DP-SGD mechanism, reporting the first benchmark image-classification results under formal privacy, evaluated centrally on CIFAR-10 (see Section 4; Table 1). ) formalized the algorithmic foundations underpinning later variants. Subsequent centralized work has narrowed DP-SGD's accuracy gap: ) proposed adaptive clipping to remove manual clipping-norm tuning; ) proposed automatic clipping for stronger, easier-to-tune private training; ) showed that careful tuning and larger, over-parameterized models substantially close the private/non-private gap, setting a new centralized CIFAR-10 state of the art under DP; and Sasse et al. (2022) showed that CNN architecture choices alone can meaningfully improve DP accuracy at fixed budgets. None of these benchmarks involve multiple clients or aggregation; they set the accuracy ceiling that federated DPFL, below, must approach under the added constraint of distributed, non-IID data.
3.3 Federated DP-SGD (DPFL) for image and sensor tasks
Federated DP-SGD adds a second layer of difficulty absent from the centralized setting: gradients are clipped and noised locally, then aggregated across clients with heterogeneous, non-IID data (Section 3), reporting smaller but consistent gains closer to real camera networks than curated centralized benchmarks. Clustered FL with adaptive local DP improved the privacy–utility balance on heterogeneous IoT data (); adaptive-noise mechanisms improved accuracy over fixed-noise baselines at the same privacy level (Xue et al., 2024); a performance-enhanced DP-FL scheme for IoT outperformed earlier fixed-budget approaches (Shen et al., 2022); and a reliable FL scheme for IoT tasks improved accuracy by 1.1% while cutting convergence time by over 9% (Wang et al., 2023). Medical DP reviews (Mohammadi et al., 2026), sharing core mechanics with surveillance DPFL, report acceptable performance at moderate budgets (ε ≈ 10) but substantial degradation under strict budgets (ε ≈ 1). ) and ) provide early federated demonstrations for multi-institutional image analysis; Section 3.5 covers real smart-city instances.
3.4 Gradient leakage and other privacy threats DP-SGD addresses
The motivating threat for adding DP to FL is gradient leakage. Zhu and Han (2019) showed that shared gradients can be inverted to reconstruct training images pixel-for-pixel. Zhao et al. (2020) improved label recovery. ) showed that reconstruction remains feasible for realistically sized batches and models. Yin et al. (2021) extended this to full image batches. Zhu and Blaschko (2021) introduced a recursive linear-algebraic attack. ) systematically categorize the field into bias attacks, optimization-based attacks, and linear equation-solver attacks. They confirm that image data is substantially more susceptible to near-exact gradient reconstruction than tabular or text data, because it is high-dimensional and redundant. ) echo this conclusion at the systems level. They note that uploaded gradients or parameters can still reveal raw data or training-set membership, even when raw images are never shared (see also Zhu et al., 2023; ). These demonstrations are almost all conducted in controlled settings with known architectures and small batches; Section 5 discusses the open question of whether they hold against production-scale, defended systems.
Zhang et al. (2020) demonstrated a related generative model-inversion attack. Membership inference attacks (Shokri et al., 2017) present a distinct risk: revealing whether an individual's image was in a training set at all, a serious concern for surveillance datasets that may include vulnerable populations. Two further threat classes matter for image-centric DPFL. Property inference attacks infer aggregate, unrelated attributes of a client's data from shared updates, without reconstructing any individual image (; Melis et al., 2019). Model extraction attacks instead target the trained model itself, threatening intellectual property even when DP protects the training data. Together, this justifies two claims: FL alone is insufficient for image-centric systems, and DP is the main formal defense layered on top, though it does not by itself address model-extraction risk (; Xue et al., 2024).
3.5 Applications in surveillance, remote sensing, and smart cities
3.5.1 Surveillance and video analytics
Liu et al. (2025) survey privacy-preserving video anomaly detection broadly, and ) systematically review edge-AI-enabled video analytics in smart cities, documenting the resource and latency constraints DPFL systems must operate within. ) propose an FL-and-DP surveillance model for AI-based camera systems, and Qamar et al. (2026) present a federated approach to identifying unusual events that avoids sharing raw CCTV footage while retaining generalization across sites (Table 1). Wahida et al. (2024) illustrate how DP-style noise can be injected at the biometric feature level for face recognition, complementing gradient-level DP.
3.5.2 Remote sensing
FL applied to satellite and aerial imagery faces added heterogeneity across sensors, geography, and lighting. Moreno-Álvarez et al. (2024) review FL meeting remote sensing broadly, and Zhang X. et al. (2023) propose prototype-matching for object extraction from heterogeneous, high-resolution imagery. Zhu et al. (2023) address dishonest-majority-robust, privacy-preserving FL for remote-sensing classification, reporting accuracy that falls from 92.5% with 20% attacker participation to 81.84% with 80% participation, an 11-point drop (Table 1). ) extend FL to multi-modal remote-sensing classification, Khan et al. (2024) apply FL to privacy-enhanced image restoration, and Razmi et al. (2024) extend core DPFL mechanics to bandwidth-constrained orbital satellite-cluster networks.
3.5.3 Smart-city IoT and hybrid systems
) survey privacy preservation across IoT systems broadly; ) propose a hierarchical fog-federated framework for IoT intrusion detection; Rahman et al. (2021) present an explainable Internet-of-Health-Things framework for smart-city health monitoring; and ) combine Rényi-DP with federated GANs for smart parking, illustrating DPFL's extension beyond pure image classification. At the applied-systems level, a privacy-aware framework combining DP with HE for smart-city services retained 95.2% accuracy at ε = 1.0 with only minimal degradation (); a companion approach combining HE, dynamic DP, and compression reached 92.6% accuracy while cutting transmission volume by 40% and latency by 43% (); and a quantum-inspired aggregation scheme reported 94.7% accuracy with 43% less overhead and only 2.1% degradation relative to a non-private baseline (Sudame et al., 2025), suggesting hybrid designs recover much of the accuracy lost to noise while improving efficiency (Table 1).
3.6 Complementary and hybrid techniques
Several technique families are increasingly stacked with DPFL, rather than used in isolation (; Nguyen et al., 2026). Homomorphic encryption has evolved from CryptoNets-style inference () through FHE-optimized CNN evaluation (; Lee et al., 2023) to the DP+HE hybrids above (; ), offering stronger guarantees than DP alone but at higher cost. Face de-identification operates at the image level rather than the gradient level, via GAN-based (; Kuang et al., 2024; Kung et al., 2025) and reversible schemes (Proença, 2022; Zhang Y. et al., 2023; ); Liu et al. (2021) and Yu et al. (2021) apply DP in image feature space instead. Blockchain-backed aggregation and Byzantine-robust filtering also combine with DP budgets: one 100-client framework reported 32% lower overhead, 12% faster convergence, over 90% accuracy with 15% malicious clients, and less than 4% loss at ε = 1 (Singh et al., 2025).
4 Results: the privacy–utility trade-off
The most consistently reported quantitative result in the DP-SGD literature is CIFAR-10 classification accuracy, as a function of the privacy budget ε. This metric has been used across nearly a decade of methodological progress, which enables direct comparison. Table 1 places this centralized benchmark trajectory (upper group) alongside representative federated, applied results from smart-city, surveillance, and remote-sensing systems (lower group). These two groups use different datasets, architectures, and threat models, and are reported separately rather than merged into one ranking. Reported ε values are also not necessarily on a common scale across studies, which can differ in privacy-accounting method and in how they define neighboring datasets; Table 1 should be read as indicative rather than strictly comparable row-to-row (see Section 5).
Three observations follow. First, benchmark progress was not monotonic, though the earliest comparison is not strictly like-for-like: the 2016 result of , 73.0% at ε = 8) used pre-trained convolutional layers, which changes the effective privacy setup relative to training entirely under DP, and briefly outperformed some intermediate from-scratch approaches (about 71.7%), before ) pushed accuracy to 81.4% training entirely from scratch at the same budget, narrowing the gap to a non-private baseline of roughly 95% from about 22 points in 2016 to roughly 13–14 points by 2022. Second, accuracy drops further as ε tightens: ) report 67%, 70%, and 73% at ε = 2, 4, and 8 respectively on the same architecture, so cities with stricter privacy requirements should budget for a steeper accuracy cost. Third, applied smart-city and remote-sensing systems that combine DP with secure aggregation, HE, or adaptive noise now routinely report accuracies in the low-to-mid 90s even under adversarial or heterogeneous conditions (Zhu et al., 2023; Qamar et al., 2026; ; ; Sudame et al., 2025); part of this gap likely reflects easier task framing, such as binary anomaly detection rather than full multi-class classification, and not solely better privacy engineering, so direct like-for-like comparison across these tasks and threat models remains difficult.
5 Discussion
Several gaps remain specific to deploying DPFL, rather than DP or FL in isolation, for real-world image analysis in smart cities.
All of the classical DP-SGD benchmarks above come from centralized training on curated datasets, such as CIFAR-10 and ImageNet, not federated, non-IID, heterogeneous camera networks. In genuine multi-site deployments, client data distributions differ substantially by location and camera type, and the privacy–utility trade-off in these settings is comparatively under-characterized (Zhu et al., 2023; ). Non-IID data, heterogeneous client hardware, cumulative privacy-budget costs across rounds, and communication burden repeatedly block the move from benchmark demonstrations to production urban sensing (; Pandya et al., 2023; ; ; ).
As Section 3.4 notes, gradient-leakage attacks remain the empirical justification for DP but are demonstrated mainly in controlled settings. Their success rate against production-scale FL, with secure aggregation layered on top (), needs further real-world validation, including against adversarial or dishonest-majority client populations of the kind modeled by Zhu et al. (2023) and Singh et al. (2025).
The ε values that provide meaningful protection, while preserving public-safety-relevant accuracy, have not been standardized. Studies report acceptable operating points from ε ≈ 1 to ε ≈ 10, with substantially different accuracy consequences (Mohammadi et al., 2026; ). At ε = 1.0, ) retain 95.2% accuracy only because DP is paired with homomorphic encryption, not DP-SGD alone; at a comparably tight budget, ) centralized CIFAR-10 benchmark falls to 67% (Table 1), showing a single ε carries very different accuracy implications depending on dataset, architecture, and whether complementary techniques are stacked on DP-SGD. ε is also not directly comparable across studies that define neighboring datasets differently (add-or-remove-one-image vs. add-or-remove-one-client), and cumulative privacy loss across rounds further erodes the guarantee over a full deployment. This leaves practitioners with limited, and not directly comparable, guidance for surveillance-specific risk profiles.
Integrating DPFL with complementary techniques, including homomorphic inference (), face de-identification pre-processing (), and blockchain-backed Byzantine defenses (Singh et al., 2025), adds system complexity and latency that may be difficult to reconcile with real-time public-safety requirements. Even so, these same hybrid stacks currently deliver the strongest reported accuracy and efficiency figures (Table 1).
Taken together, the evidence supports cautious optimism, rather than technical maturity (Zhu et al., 2023; ; Nguyen et al., 2026; ). DPFL has progressed substantially since ) original formulation, narrowing though not closing the accuracy gap to non-private training; the best applied results now come from hybrid and adaptive designs, rather than DP-SGD alone. For smart-city surveillance and remote-sensing image analysis, DPFL offers the most well-justified response to the gradient-leakage threat documented here. However, responsible deployment requires realistic expectations about accuracy cost at any given privacy budget, and further validation on heterogeneous camera networks, cross-agency data-sharing, and adversarial client populations.
6 Conclusion
DPFL is the most mature, best-justified technical answer to the gradient-leakage risk inherent in federated image-analysis pipelines. A decade of DP-SGD refinement, plus a fast-growing set of hybrid designs pairing DP with secure aggregation, homomorphic encryption, adaptive noise, and Byzantine-robust aggregation, has meaningfully narrowed its accuracy and efficiency cost without eliminating it. The clearest path to responsible smart-city deployment is fourfold: benchmark DPFL on heterogeneous, non-IID camera data rather than curated datasets; validate gradient-leakage resistance against production-scale secure aggregation and adversarial client populations rather than small controlled batches; converge on domain-specific ε guidance balancing public-safety accuracy against re-identification risk; and evaluate hybrid privacy stacks for the latency and complexity costs they introduce, not only the accuracy they recover.
Statements
Author contributions
NP: Writing – review & editing, Writing – original draft. DM: Writing – original draft, Writing – review & editing.
Funding
The author(s) declared that financial support was not received for this work and/or its publication.
Conflict of interest
The author(s) declared that this work was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.
Generative AI statement
The author(s) declared that Generative AI was used in the creation of this manuscript. The author(s) used Claude (Anthropic), specifically Claude Sonnet 5, to assist with editing for clarity and length throughout the manuscript, and to generate Figure 1 based on the author(s)' own description of the DP-FL training round summarized in Section 2. The author(s) reviewed, fact-checked, and verified all AI-assisted text and the figure against the cited literature and take full responsibility for the accuracy of the final content.
Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.
Publisher’s note
All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.
References
1
AbadiM.ChuA.GoodfellowI.McMahanH. B.MironovI.TalwarK.et al. (2016). “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, (Vienna), 308–318. doi: 10.1145/2976749.2978318
2
AbdulrahmanS.ToutH.Ould-SlimaneH.MouradA.TalhiC. (2024). When federated learning meets privacy-preserving computation. ACM Comput. Surv.56, 1–38. doi: 10.1145/3679013
3
AdiwijayaJ.TanayaV. R.AurelliaA.ChowandaA. (2023). “Federated learning and differential privacy in AI-based surveillance systems model,” in 2023 14th international conference on information and communication technology and system (ICTS), (Surabaya), 283–288. doi: 10.1109/ICTS58770.2023.10330863
4
AdnanM.KalraS.CresswellJ. C.TaylorG. W.TizhooshH. R. (2022). Federated learning and differential privacy for medical image analysis. Sci. Rep.12:1953. doi: 10.1038/s41598-022-05539-7
5
Al BadawiA.JinC.LinJ.MunC. F.JieS. J.TanB. H. M.et al. (2020). Towards the AlexNet moment for homomorphic encryption: HCNN, the first homomorphic CNN on encrypted data with GPUs. IEEE Trans. Emerg. Top. Comput.9, 1330–1343. doi: 10.1109/TETC.2020.3014636
6
Al-HuthaifiR.LiT.HuangW.GuJ.-M.LiC. (2023). Federated learning in smart cities: privacy and security survey. Inf. Sci.632, 833–857. doi: 10.1016/j.ins.2023.03.033
7
AlqazzazA. (2025). Federated learning with homomorphic encryption: a privacy-preserving solution for smart cities. Int. J. Comput. Intell. Syst.18:304. doi: 10.1007/s44196-025-00829-0
8
AlterkawiL.DibF. K. (2025). Federated learning for smart cities: a thematic review of challenges and approaches. Future Internet17:545. doi: 10.3390/fi17120545
9
AndrewG.ThakkarO.McMahanH. B.RamaswamyS. (2021). Differentially private learning with adaptive clipping. Adv. Neural Inf. Process. Syst.34, 17455–17466. doi: 10.48550/arXiv.1905.03871
10
BadidiE.MoumaneK.El GhaziF. (2023). Opportunities, applications, and challenges of edge-AI enabled video analytics in smart cities: a systematic review. IEEE Access11, 80543–80572. doi: 10.1109/ACCESS.2023.3300658
11
BonawitzK.IvanovV.KreuterB.MarcedoneA.McMahanH. B.PatelS.et al. (2017). Practical secure aggregation for federated learning on user-held data. arXiv preprint arXiv:1611.04482.
12
BuZ.WangY.-X.ZhaS.KarypisG. (2023). Automatic clipping: differentially private deep learning made easier and stronger. Adv. Neural Inf. Process. Syst.36, 41727–41764. doi: 10.52202/075280-1808
13
BüyüktaşB.SumbulG.DemirB. (2025). A multi-modal federated learning framework for remote sensing image classification. arXiv preprint arXiv:2503.10262. doi: 10.1109/TGRS.2025.3603859
14
ChancalvibenN. B.OviyaS.AnanthiS.SubhaR. (2025). “Privacy-aware federated learning framework for secure and efficient smart city services,” in 2025 9th international conference on electronics, communication and aerospace technology (ICECA), (Coimbatore), 367–374. doi: 10.1109/ICECA66444.2025.11382871
15
DeS.BerradaL.HayesJ.SmithS. L.BalleB. (2022). Unlocking high-accuracy differentially private image classification through scale. arXiv preprint arXiv:2204.13650.
16
DuM.YangP.LiuY.TianW.XiongZ.HanZ. (2025). RDP-FedGAN: a Rényi-differential privacy empowered federated learning GAN in smart parking. IEEE Trans. Veh. Technol.74, 100–109. doi: 10.1109/TVT.2024.3462108
17
DufauxF.EbrahimiT. (2008). Scrambling for privacy protection in video surveillance systems. IEEE Trans. Circuits Syst. Video Technol.18, 1168–1174. doi: 10.1109/TCSVT.2008.928225
18
DworkC.RothA. (2014). The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci.9, 211–407. doi: 10.1561/0400000042
19
FuJ.HongY.LingX.WangL.RanX.SunZ.et al. (2026). Differentially private federated learning: a systematic review. ACM Comput. Surv.58, 1–38. doi: 10.1145/3801079
20
GanjuK.WangQ.YangW.GunterC. A.BorisovN. (2018). “Property inference attacks on fully connected neural networks using permutation invariant representations,” in Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, (Toronto, Canada), 619–633. doi: 10.1145/3243734.3243834
21
GeipingJ.BauermeisterH.DrögeH.MöllerM. (2020). Inverting gradients—how easy is it to break privacy in federated learning?Adv. Neural Inf. Process. Syst.33, 16937–16947. doi: 10.48550/arXiv.2003.14053
22
Gilad-BachrachR.DowlinN.LaineK.LauterK.NaehrigM.WernsingJ. (2016). “CryptoNets: applying neural networks to encrypted data with high throughput and accuracy,” in Proceedings of the 33rd international conference on machine learning, (New York, NY).
23
GongH.JiangL.LiuX.WangY.GastroO.WangL.et al. (2023). Gradient leakage attacks in federated learning. Artif. Intell. Rev.56, 1337–1374. doi: 10.1007/s10462-023-10550-z
24
HeZ.WangL.CaiZ. (2024). Clustered federated learning with adaptive local differential privacy on heterogeneous IoT data. IEEE Internet Things. J.11, 137–146. doi: 10.1109/JIOT.2023.3299947
25
HukkelåsH.LindsethF. (2023). “DeepPrivacy2: towards realistic full-body anonymization,” in Proceedings of the IEEE/CVF winter conference on applications of computer vision (WACV) 1329–1338, (Waikoloa, HI), doi: 10.1109/WACV56688.2023.00138
26
IslamM. M.AbdullahW. M.SahaB. N. (2025). Privacy-preserving hierarchical fog federated learning (PP-HFFL) for IoT intrusion detection. Sensors.25:7296. doi: 10.3390/s25237296
27
JiangJ.KantarciB.OktugS.SoyataT. (2020). Federated learning in smart city sensing: challenges and opportunities. Sensors.20:6230. doi: 10.3390/s20216230
28
KaissisG.MakowskiM. R.RückertD.BrarenR. F. (2021). End-to-end privacy preserving deep learning on multi-institutional medical imaging. Nat. Mach. Intell.3, 473–484. doi: 10.1038/s42256-021-00337-8
29
KapoorA.KumarD. (2026). Enhancing smart cities with federated learning: a framework for secure, scalable, and intelligent urban sensing systems. IEEE Internet Things Mag.9, 96–103. doi: 10.1109/MIOT.2025.3581347
30
KaurR.RodriguesT.KadirN.KashefR. (2025). A survey on privacy preservation techniques in IoT systems. Sensors.25:6967. doi: 10.3390/s25226967
31
KhanM. J.RathS.ZaibM. H. (2024). “Privacy-enhanced image restoration in remote sensing via federated learning,” in 2024 12th international symposium on digital forensics and security (ISDFS), (San Antonio, TX), 1–6. doi: 10.1109/ISDFS60797.2024.10527332
32
KuangZ.GuoH.CaoT.FangH.ZhengW.-S. (2024). “Facial identity anonymization via intrinsic and extrinsic attention distraction,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR) 12406–12415, (Seattle, WA). doi: 10.1109/CVPR52733.2024.01179
33
KungH. W.VarankaT.SahaS.SimT.SebeN. (2025). “Face anonymization made simple,” in Proceedings of the IEEE/CVF winter conference on applications of computer vision (WACV) (Tucson, AZ), 1040–1050. doi: 10.1109/WACV61041.2025.00110
34
LeeJ.LeeE.LeeJ.-W.KimY.KimY.-S.NoJ.-S. (2023). Precise approximation of convolutional neural networks for homomorphically encrypted data. IEEE Access11, 62062–62076. doi: 10.1109/ACCESS.2023.3287564
35
LiuB.DingM.XueH.ZhuT.YeD.SongL.et al. (2021). DP-Image: differential privacy for image data in feature space. arXiv [preprint]. arXiv:2103.07073.
36
LiuY.LiuS.ZhuX.LiJ.YangH.TengL.et al. (2025). Privacy-preserving video anomaly detection: a survey. arXiv [preprint]. arXiv:2411.14565.
37
McMahanH. B.MooreE.RamageD.HampsonS.Agüera y ArcasB. (2017). “Communication-efficient learning of deep networks from decentralized data,” in Proceedings of the 20th international conference on artificial intelligence and statistics, (Fort Lauderdale, FL), 1273–1282.
38
MelisL.SongC.De CristofaroE.ShmatikovV. (2019). “Exploiting unintended feature leakage in collaborative learning,” in 2019 IEEE symposium on security and privacy, (San Francisco, CA), 691–706. doi: 10.1109/SP.2019.00029
39
MohammadiM.VejdanihemmatM.LotfiniaM.RusuM.TruhnD.MaierA.et al. (2026). Differential privacy for medical deep learning: methods, tradeoffs, and deployment implications. npj Digit. Med.9:25. doi: 10.1038/s41746-025-02280-z
40
Moreno-ÁlvarezS.PaolettiM. E.Sanchez-FernandezA. J.Rico-GallegoJ. A.HanL.HautJ. M. (2024). Federated learning meets remote sensing. Expert Syst. Appl.255:124583. doi: 10.1016/j.eswa.2024.124583
41
NguyenT. A. T.NguyenP.ChupaevA. V. (2026). Big data analytics based on linked learning for smart city applications that protect privacy. Soft Meas. Comput.4, 180–188. doi: 10.36871/26189976.2026.04-4.020
42
PandyaS.SrivastavaG.JhaveriR.BabuM.BhattacharyaS.MaddikuntaP. K. R.et al. (2023). Federated learning for smart cities: a comprehensive survey. Sustain. Energy Technol. Assess.55:102987. doi: 10.1016/j.seta.2022.102987
43
ProençaH. (2022). The UU-Net: reversible face de-identification for visual surveillance video footage. IEEE Trans. Circuits Syst. Video Technol.32, 496–509. doi: 10.1109/TCSVT.2021.3066054
44
QamarT.BawanyN. Z.MughalM. H. (2026). Identification of unusual events for smart city surveillance—a federated approach. IEEE Access14, 693–713. doi: 10.1109/ACCESS.2025.3648440
45
RahmanM. A.HossainM. S.ShowailA. J.AlrajehN. A.AlhamidM. F. (2021). A secure, private, and explainable IoHT framework to support sustainable health monitoring in a smart city. Sustain. Cities Soc.72:103083. doi: 10.1016/j.scs.2021.103083
46
RazmiN.MatthiesenB.DekorsyA.PopovskiP. (2024). On-board federated learning for satellite clusters with inter-satellite links. IEEE Trans. Commun.72, 3408–3424. doi: 10.1109/TCOMM.2024.3356429
47
SasseT.WanC.GanesanD.GuhaS. (2022). SmoothNets: optimizing CNN architecture design for differentially private deep learning. arXiv [preprint]. arXiv:2205.04095.
48
ShenX.LiuY.ZhangZ. (2022). Performance-enhanced federated learning with differential privacy for internet of things. IEEE Internet Things J.9, 24079–24094. doi: 10.1109/JIOT.2022.3189361
49
ShokriR.StronatiM.SongC.ShmatikovV. (2017). “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy, (San Jose, CA), 3–18. doi: 10.1109/SP.2017.41
50
SinghA.KaurP.ManchandaK.SinghJ.GaragA. (2025). “A resilient federated learning framework for privacy-preserving smart cities,” in 2025 2nd international conference on integration of computational intelligent system (ICICIS), (Pune), 1–9. doi: 10.1109/ICICIS65613.2025.11371162
51
SudameB.BhagyashreeK.NayakR.AppalakondaV.SapraP.ShelkeA. (2025). “Federated learning optimization using quantum-inspired models for privacy-preserving edge computing in smart cities,” in 2025 2nd international conference on intelligent algorithms for computational intelligence systems (IACIS), (Virtual/Hybrid Mode), 1–6. doi: 10.1109/IACIS65746.2025.11211115
52
TariqM. A.KhanS.MazharT.ShahzadT.AroojS.OuahadaK.KhanM. A.HamamH. (2026). Federated deep learning in intelligent urban ecosystems: a systematic review of advancements and applications in smart cities, homes, buildings, and healthcare systems. Comput. Model. Eng. Sci.146:8. doi: 10.32604/cmes.2026.078672
53
WahidaF.ChamikaraM. A. P.KhalilI.AtiquzzamanM. (2024). An adversarial machine learning based approach for privacy preserving face recognition in distributed smart city surveillance. Comput. Netw.254:110798. doi: 10.1016/j.comnet.2024.110798
54
WajidM. A.WajidM. S.ZafarA. (2025). Digital twin technology for multimodal-based smart mobility using hybrid Co-ABC optimization based deep CNN. Cluster Comput.28:194. doi: 10.1007/s10586-024-04903-8
55
WangR.LaiJ.LiX.HeD.KhanM. K. (2023). RPIFL: reliable and privacy-preserving federated learning for the Internet of Things. J. Netw. Comput. Appl.221:103768. doi: 10.1016/j.jnca.2023.103768
56
WeiK.LiJ.DingM.MaC.YangH. H.FarokhiF.et al. (2020). Federated learning with differential privacy: algorithms and performance analysis. IEEE Trans. Inf. Forensics Secur.15, 3454–3469. doi: 10.1109/TIFS.2020.2988575
57
XueR.XueK.ZhuB.LuoX.ZhangT.SunQ.et al. (2024). Differentially private federated learning with an adaptive noise mechanism. IEEE Trans. Inf. Forensics Secur.19, 74–87. doi: 10.1109/TIFS.2023.3318944
58
YinH.MallyaA.VahdatA.AlvarezJ. M.KautzJ.MolchanovP. (2021). “See through gradients: image batch recovery via GradInversion,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), (Virtual), 16337–16346. doi: 10.1109/CVPR46437.2021.01607
59
YuJ.XueH.LiuB.WangY.ZhuS.DingM. (2021). GAN-based differential private image privacy protection framework for the Internet of Multimedia Things. Sensors.21:58. doi: 10.3390/s21010058
60
ZhangX.ZhangB.YuW.KangX. (2023). Federated deep learning with prototype matching for object extraction from very-high-resolution remote sensing images. IEEE Trans. Geosci. Remote Sens.61, 1–16. doi: 10.1109/TGRS.2023.3244136
61
ZhangY.JiaR.PeiH.WangW.LiB.SongD. (2020). “The secret revealer: generative model-inversion attacks against deep neural networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), (Seattle, WA), 253–261. doi: 10.1109/CVPR42600.2020.00033
62
ZhangY.WangT.ZhaoR.WenW.ZhuY. (2023). RAPP: reversible privacy preservation for various face attributes. IEEE Trans. Inf. Forensics Secur.18, 3074–3087. doi: 10.1109/TIFS.2023.3274359
63
ZhaoB.MopuriK. R.BilenH. (2020). iDLG: improved deep leakage from gradients. arXiv [preprint]. arXiv:2001.02610.
64
ZhuJ.BlaschkoM. B. (2021). “R-GAP: recursive gradient attack on privacy,” in International conference on learning representations, (Virtual), 1–17. doi: 10.48550/arXiv.2010.07733
65
ZhuJ.WuJ.BashirA. K.PanQ.WuY. (2023). Privacy-preserving federated learning of remote sensing image classification with dishonest majority. IEEE J. Sel. Top. Appl. Earth Obs. Remote. Sens.16, 4685–4698. doi: 10.1109/JSTARS.2023.3276781
66
ZhuL.HanS. (2019). Deep leakage from gradients. Adv. Neural Inf. Process. Syst.32, 14774–14784. doi: 10.48550/arXiv.1906.08935
Summary
Keywords
differential privacy, DP-SGD, federated learning, gradient leakage, image classification, privacy–utility trade-off, smart-city surveillance
Citation
Pandya N and Mistry D (2026) Differentially private federated learning for image analysis in smart-city surveillance. Front. Imaging 5:1966936. doi: 10.3389/fimag.2026.1966936
Received
13 August 2026
Revised
24 August 2026
Accepted
28 August 2026
Published
10 September 2026
Volume
5 - 2026
Edited by
Mahesh Goyani, Government Engineering College Modasa, India
Reviewed by
Mohd Anas Wajid, Institute for Obesity Research, Monterrey Institute of Technology and Higher Education, Mexico
L. Jai Vinita, VIT University Chennai, India
Updates
Copyright
© 2026 Pandya and Mistry.
This is an open-access article distributed under the terms of the Creative Commons Attribution License (CC BY). The use, distribution or reproduction in other forums is permitted, provided the original author(s) and the copyright owner(s) are credited and that the original publication in this journal is cited, in accordance with accepted academic practice. No use, distribution or reproduction is permitted which does not comply with these terms.
*Correspondence: Namrata Pandya, namratapandya@gcet.ac.in
Disclaimer
All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article or claim that may be made by its manufacturer is not guaranteed or endorsed by the publisher.