# Privacy-Enhancing Technologies in Federated Learning for the Internet of
Healthcare Things:
A Survey
††thanks:

Fatemeh Mosaiyebzadeh1, Seyedamin Pouriyeh2, Reza M. Parizi3, Quan Z. Sheng4,
Meng Han 5,
Liang Zhao2, Giovanna Sannino 6, Daniel Macêdo Batista1  1 Department of
Computer Science, University of São Paulo, Brazil
{fatemehm<EMAIL_ADDRESS>2 Department of Information and Technology,
Kennesaw State University, Marietta, GA, USA
{spouriye<EMAIL_ADDRESS>3Decentralized Science Lab, Kennesaw State
University, Marietta, GA, USA
<EMAIL_ADDRESS>4 School of Computing, Macquarie University, Sydney,
Australia
<EMAIL_ADDRESS>5 Binjiang Institute of Zhejiang University,
Hangzhou, Zhejiang, China
<EMAIL_ADDRESS>6 Institute of High Performance Computing and Networking,
National Research Council, Naples, Italy
<EMAIL_ADDRESS>
###### Abstract

Advancements in wearable medical devices in IoT technology are shaping the
modern healthcare system. With the emergence of the Internet of Healthcare
Things (IoHT), we are witnessing how efficient healthcare services are
provided to patients and how healthcare professionals are effectively used AI-
based models to analyze the data collected from IoHT devices for the treatment
of various diseases. To avoid privacy breaches, these data must be processed
and analyzed in compliance with the legal rules and regulations such as HIPAA
and GDPR. Federated learning is a machine leaning based approach that allows
multiple entities to collaboratively train a ML model without sharing their
data. This is particularly useful in the healthcare domain where data privacy
and security are big concerns. Even though FL addresses some privacy concerns,
there is still no formal proof of privacy guarantees for IoHT data.

Privacy Enhancing Technologies (PETs) are a set of tools and techniques that
are designed to enhance the privacy and security of online communications and
data sharing. PETs provide a range of features that help protect users’
personal information and sensitive data from unauthorized access and tracking.
This paper reviews PETs in detail and comprehensively in relation to FL in the
IoHT setting and identifies several key challenges for future research.

###### Index Terms:

Privacy enhancing technologies, Internet of Healthcare Things, Federated
learning, Security, Privacy.

##  I Introduction

In recent years, we have witnessed an accelerated growth of IoT devices in
various domains such as healthcare [1], smart transportations [2], smart home
and building [3], and smart cities [4]. In the healthcare domain, IoT
technology has shown its capabilities and applications in collecting patients’
data to enable healthcare professionals to analyze the data for better and
more efficient treatment of various diseases. These devices are designed to
automatically collect, send, receive, and store data over the networks in
order to proactively detect, diagnose, monitor, and treat patients both in and
out of the healthcare systems.

Internet of Healthcare Things (IoHT) is a sub-type of the Internet of Things
(IoT) oriented to e-health by combining various smart devices such as smart
watches, wearable trackers, and other smart connected devices to record
various health measures such as heart rate, body temperature, and blood
pressure [5]. A huge amount of information collected from those variety of
IoHT devices and applications is later employed in data analytics where it is
empowered with Artificial Intelligence (AI) and Machine Learning (ML) models
to mine such information and improve the health decision making.

Traditionally, healthcare organizations use centralized ML-based models in
clouds or data centers to train the data generated by IoHT devices aiming to
take reliable decisions in the healthcare domain. However, such models usually
suffer from performance and accuracy issues due to the unavailability of
sufficient data to reside centrally on the server side for training due to
direct access restrictions/regulations (HIPAA and GDPR) on such data, where
all may lead to biased models that cannot be trustworthy [6] [7].
Additionally, even with sufficient data, the training procedure in a
centralized setting is time-consuming and expensive tasks make them out of
interest of hospitals and research centers [8].

Figure 1: Outline of the paper.

Recently, the Federated Learning (FL) concept has been discovered as a
promising way for the eHealth systems to overcome data privacy concerns in
IoHT [9]. FL is a distributed ML-based approach that maintains patients’ data
where they are generated and enables the training of ML models collaboratively
on multiple clients’ health data like hospitals or IoHT devices in a
decentralized network [10] [11]. However, recent studies have shown that
sometimes FL can not guarantee proper privacy-preserving [12].

Privacy Enhancing Technologies (PETs) are a set of tools and techniques that
are designed to enhance the privacy and security of online communications and
data sharing. PETs provide a range of features that help protect users’
personal information and sensitive data from unauthorized access and tracking.
The development of PETs can offer a reliable pathway toward data-driven
technologies such as ML-based models while preserving privacy. PETs are a
group of methods, procedures, and techniques to extract value from data, and
simultaneously reduce the privacy and security risk to private data [13]. PETs
are crucial, especially in industries like healthcare that collect and use
sensitive data extensively. In healthcare domain, collected patient data allow
researchers and healthcare professionals to distinguish disease, drug
development, and improve public health. For instance, vaccine development
research during the COVID-19 pandemic has shown the importance of information
in public health.

There are various PETs that can be utilized to improve privacy in FL. For
example, secure multi-party computation (SMPC) [14], syntactic anonymization
such as k-anonymity [15], homomorphic encryption [16], zero-knowledge proofs
[17], differential privacy [18], and blockchain techniques [19] are some of
those techniques that are aligned with FL framework and will be discussed in
this paper.

In this paper, we aim to explore the privacy concerns in FL environment from
PET perspective and discuss how PETs are integrated into FL to enhance privacy
issues.

To the best of our knowledge, there is no current research to provide a
comprehensive survey on FL for the IoHT from a PET perspective. To fill this
research gap, we comprehensively reviewed PETs and FL integration in smart
healthcare environments. This paper reviews the main topics of privacy and FL
in smart healthcare systems. Initially, we reviewed the privacy requirements
and the cause of privacy leakage and violation in FL. Then, we review the PETs
approach according to four PETs applied to FL. Finally, we summarize the PETs
applied to FL and present some open issues.

The remaining part of this paper is organized as follows. Section II
summarizes the surveys similar to ours while highlighting the differences. In
Section III, we provide the general principles of FL and the different sorts
of this technique used in smart healthcare environments. We provide the
motivations for using the privacy-preserving FL in smart healthcare in Section
V. Section VI is dedicated to a complete literature review of PETs. Section
VII presents PET’s application on FL in the smart healthcare environment.
Section VIII presents open issues related to PETs in FL and concluding remarks
are given in Section IX. Fig. 1 depicts a systematic outline of this survey
paper.

##  II Related Work

There are many review papers that cover a wide range of security and privacy
challenges in FL environment that are either dedicated in other domains or
covered security and privacy issues at the general level. In this section, we
tried to discuss the most recent and similar to our work.

In [20], the focus is to provide an overview of FL, highlighting protocols,
platforms, algorithms, market implications, and real-life use-cases, in terms
of software and hardware. The advantage related to privacy, brought by FL, is
presented in some parts of the work but this is not the main focus of the
paper. Some use-cases related to health applications are presented but there
are no comments about IoHT (In fact, authors state that IoT is not the focus
of the paper).

The authors in [21] provide a formal definition of FL and review the existing
works using FL. The works are evaluated in terms of five aspects and one of
these aspects is privacy mechanisms. Three mechanisms are considered: model
aggregation, homomorphic encryption, and differential privacy. In our survey,
we focus on privacy and consider a different approach, classifying four
techniques: anonymization, cryptography, perturbation method, and blockchain.
Similar to [20], in [21] some use-cases related to health applications are
presented but there are no comments about IoHT.

The authors in [22] review the FL method specifically in terms of both
security and privacy. Different implementations of FL are considered and
evaluated. Some of the FL threats in terms of security and privacy are similar
to those considered in our paper. Some applications are oriented to IoT but
there are no comments about IoHT.

In [23], the authors focused on the IoT domain only. Similar to [21], a formal
definition of FL is presented. Healthcare applications are considered in the
survey but the comparison and analysis of the works do not specify what
privacy attacks the works are oriented to and neither the datasets used by
them.

In another effort [24], a number of privacy-preserving mechanisms adopted for
FL frameworks are evaluated by the authors, as well as their application to
vehicle activity recognition. In this study, they examined the open-source FL
frameworks FATE and PFL. The FATE framework uses homomorphic encryption to
secure computations and input data, while PFL uses multi-party secure
computations and differential privacy to protect the processing of vertically
partitioned data and train neural networks for horizontally partitioned data.
Similar to [21] and [20], there are no comments about IoHT in the survey.

Nguyen et al. [25] represent the summary of FL in the Internet of Medical
Things (IoMT). In this study, a federated EHR management system, a federated
remote monitoring system, a federated COVID-19 detection system, and a
federated medical imaging system were discussed. Innovative FL designs for
IoMT are investigated, including secure FL, resource-aware FL, and incentive-
aware FL. Also, privacy-enhanced FL to protect security is explored, but this
is not the main focus of the paper. Similar to [24], in [25], among the
privacy-enhancing mechanisms, differential privacy method is taken into
consideration, while in our survey, we examine four different technologies
that enhance privacy.

To the best of our knowledge, this work is the first survey specifically
focused on reviewing Federated Learning applications in IoHT from the
perspective of Privacy-Enhancing Technologies. A side-by-side comparison of
recent efforts in this domain is shown in Table I.

TABLE I: Comparison to the related works References | IoHT environment | Healthcare domain | Privacy Mechanisms
---|---|---|---
|  | Anonymization | Cryptography | Perturbation | Blockchain
[20] | $\times$ | ✓ | $\times$ | $\times$ | $\times$ | $\times$
[21] | $\times$ | $\times$ | $\times$ | ✓ | ✓ | $\times$
[22] | $\times$ | $\times$ | $\times$ | ✓ | ✓ | ✓
[23] | ✓ | ✓ | $\times$ | $\times$ | ✓ | ✓
[24] | $\times$ | $\times$ | $\times$ | ✓ | ✓ | $\times$
[25] | ✓ | ✓ | $\times$ | $\times$ | ✓ | $\times$
Our work | ✓ | ✓ | ✓ | ✓ | ✓ | ✓

##  III Federated Learning for healthcare

The overall FL principle and the many FL types in the context of e-healthcare
are discussed in this section.

###  III-A Principles of FL for Smart Healthcare

Privacy breaches have become a major concern for users’ data. Therefore,
governments establish policies to prevent privacy leakage in order to preserve
users’ data privacy. Breaching these policies is expensive for companies, and
it has boosted the development of FL in 2016 by Google [26] [27]. FL or
collaborative learning trains a global machine learning model without
explicitly exchanging the local data on multiple parties. In an FL system,
clients train local machine-learning models on local datasets and exchange
some parameters like gradients or model weights with the central server to
obtain a global model.

In general, the FL process for IoHT consists of the following steps:

####  III-A1 Initialization

The aggregation server selects data generated by IoHT devices, such as Blood
Sample Reader or human motion detection to do the prediction or classification
task. Furthermore, the central server chooses a group of participants to
participate in the FL process.

####  III-A2 Updating Local Training model

The server sends an initial model to the devices to initiate the distributed
training after choosing the IoHT devices for the learning process. Each device
computes its updated model by training a local model with its own dataset that
is kept locally. Then, each device sends its updated model to central the
server in order to aggregate all of the updated models.

####  III-A3 Model Aggregation

After receiving the parameters from each IoHT device in the FL process, the
aggregation step combines all parameters to generate a global learning model.
Federated Averaging (FedAvg) algorithm is an averaging model which we can use
to calculate the global model and send it to all IoHT devices for updating the
local model.

###  III-B FL Types for Smart Healthcare

Studying the FL methods utilized in various domains shows that based on data
partitioning, FL methods can be categorized into Horizontal FL, Vertical FL,
and Federated Transfer Learning.

In horizontal FL, or sample-based federated learning, the datasets of
different healthcare clients have the same feature space and different sample
space. Since the local data are in the same feature space, local healthcare
participants can train the local model using their local data by the same AI
model such as the neural network model. Afterwards, the global model simply
can be updated by combining all the local models transmitted from local
healthcare organizations or institutions [28]. A horizontal FL example in
smart healthcare can be multiple implanted medical devices from different
hospitals as clients, that collect very similar data but have little to no
overlap of patients [29].

In vertical FL, the datasets of different healthcare organizations have
similar sample spaces and different feature spaces. This method can be used to
address the overlapping sample at distributed clients. The vertical FL usually
utilizes entity alignment techniques to collect the overlapped samples of the
hospitals. Then, the overlapped data can be applied to the local training
model integrated with encryption techniques [30]. An example of vertical FL in
IoHT applications can be the shared learning model between hospitals and
cardiologists. Both hospitals and cardiologists with various data features,
which have patients with a similar sample space, use a vertical FL for
training an AI model by utilizing historical medical records at hospitals and
cardiologist data for smart healthcare decisions [31].

Federated Transfer Learning is an integration of transfer learning into
federated learning to handle datasets that have various sample spaces and
various feature spaces. In fact, transfer learning is a way to transfer
knowledge from one particular problem to another to decrease the distribution
divergence between different domains [32]. An example of federated transfer
learning in healthcare organizations can be disease diagnosis by collaborating
countries with numerous hospitals that have various patients and various
therapeutic programs [33].

##  IV Privacy requirements for IoHT systems

For IoHT devices, privacy requirements are more stringent than for typical IoT
infrastructures. IoHT healthcare systems have some privacy requirements, such
as data protection privacy [34]. During the collection and storage of patient
data, we must continually take into account ethical privacy regulations
throughout the entire data lifecycle. For instance, Privacy policies such as
GDRP and HIPAA are laws for preserving privacy at the data level [35].
According to privacy policies, only authorized individuals can have access to
patient health data. In fact, data privacy protection is a way to preserve
personal data from unauthorized use and manipulation.

Thus, to protect the privacy of patient data, the IoHT system should be
designed to guarantee the following [36]:

  * •

Preserve the privacy of patients and the confidentiality of patient health
care data (prevention of unauthorized access to health information).

  * •

The integrity of healthcare data (prevention of unauthorized data
manipulation).

  * •

The availability of health data for authorized people.

##  V Motivation of using Privacy-Preserving FL in smart healthcare

In the next two sections, we will summarily cover the benefit FL and the
potential threats of using FL in smart healthcare.

###  V-A Benefits of FL in IoHT

Due to various characteristics of FL such as privacy-preserving, and
collaborative learning in a distributed data environment bring many advantages
to the IoHT domain that will be discussed briefly in the next subsections.

####  V-A1 Improving the privacy of user data

With increasing the number of IoHT devices and publicly available medical
datasets generated by IoHT devices, privacy concerns are also growing in the
e-healthcare systems. Collected data by IoHT devices, such as heartbeat, blood
pressure, and glucose level, is more sensitive compared to other types of
data. According to data privacy protection legislation, private patient data
is the most sensitive data and is restricted by government laws. To address
data privacy challenges in the e-healthcare domain, FL offers a decentralized
training mechanism where each client or institution can control private data
and define a privacy-preservation policy [37]. In the FL framework, the raw
health data are stored at a medical devices or local site and do not leave the
IoHT devices during the federated data training process. During model
training, only the local updates like model gradients need to be sent to the
central server, which reduces the risk of sensitive and personal data leakage
and ensures a high level of patient data privacy [38].

####  V-A2 Less biased model

Because a centralized model can only be trained using limited data from a
single hospital, the result may be biased in the predictions. Therefore,
mitigation bias recently gains a lot of attention in modern machine learning
techniques [39]. Thus, for models to be more generalizable, more data must be
used, which can be achieved through data sharing between organizations.
However, exchanging patients’ electronic health data between hospitals is
against their data security and privacy because healthcare data is sensitive
[40]. Under these circumstances, to address the bias issue, federated learning
has emerged as an option for building a collaborative learning model for
healthcare data and producing models that yield unbiased results. The trained
model is less biased and smarter as different datasets from various sources
are integrated into the learning process [41].

####  V-A3 Improving the scalability

In the centralized model, uploading all of the healthcare data to the server
leads to a waste of computing resources, breaches privacy, and puts more
pressure on the wireless communication network, which declines the network’s
scalability. However, FL’s distributed nature enables the scalability of IoHT
networks [42]. In fact, FL has the ability to use the computational resources
located at multiple IoHT devices across different hospitals located in
different geographic regions in a parallel manner. For instance, when new
hospitals or healthcare institutions participate, they add more computational
resources in the federated learning process. Therefore, these more
computational resources allow federated learning to enhance performance.
Moreover, the FL architecture avoids sending the massive amounts of IoHT data
gathered to the cloud, which can result in significant network bandwidth
saving and drastically reduce communication costs [43] [44].

###  V-B Privacy Leakage and Potential Threats in Federated Learning

Although FL provides a privacy-aware framework to train a global model without
sharing data and allows clients to use the framework using their local
dataset, recent works have shown that FL can face privacy breaches and
information leakage.

The FL frameworks restrict sharing data on local devices with third-party or
central servers. Nonetheless, it is possible to reveal sensitive information
through the back-tracing of gradients and update the communication models
through the training process [45][46]. For example, Zhu et al. [47] introduces
a deep leakage from Gradient (DLG), which shows malicious attackers can steal
the training data in a few iterations. In their study, they showed how private
training data can be easily leaked because of sharing the gradients.
Similarly, Aono et al. [48] reported that accessing a small portion of
original gradients may cause leakage in local training data. Although FL
models on decentralized data sources have shown promising results with respect
to preserving data privacy. But, it is still vulnerable to several types of
attacks such as poisoning attacks [49], inference attacks [50], and backdoor
attacks [51].

In a poisoning attack, which occurs during the training time, an attacker
tries to manipulate the training data sample by injecting designed samples to
compromise the whole learning process [52]. In Poisoning attacks including
data poisoning attack [53] and model poisoning attack [54] the ultimate goal
of attackers is to change the behavior of the target model. A data poisoning
attack aims to mislead the global model by manipulating the local training
data. The attacker flips the labels of training data and adds noise in order
to degrade the quality of models [55]. Fig. 2 shows how an attacker changes
the trained model by flipping the data labels. In the model poisoning attack,
the attacker attempts to manipulate local model updates before sending the
models to the server. This method includes various techniques to manipulate
the FL local training procedure, such as direct gradient manipulation and
changing the learning rule [56].

Figure 2: An illustration of the poisoning attacks against FL

In an inference attack, the attacker aims to exchange gradients during the FL
training process, which can result in serious information leakage about the
features of clients’ training data. The inference attack includes inferring
class representatives [57], inferring membership [58], inferring data
properties [59], and inferring samples/labels [60]. In the inference of class
representatives, the adversary creates samples that are not in the original
training dataset. Attackers use these false samples to learn sensitive
information about the training dataset [61]. The inference of memberships
tries to determine whether a given data sample has been used for model
training [62]. In the property inference attack, the attacker aims to infer
the property information of the training dataset [63]. In the inferring
samples, the attacker recreates labels from the gradients and recovers the
original training samples that are used during training [64]. Fig 3 shows an
example of inference attacks.

Figure 3: An illustration of the Inference attacks against FL

In a backdoor attack, the goal of the attacker is to destroy the global FL
model and then replace the actual global FL model with the attacker’s model
[65]. This attack can be also classified as a type of model poisoning attack,
but it is more harmful than poisoning attacks [51]. In fact, the attacker
compromises the devices of one or several participants and trains a model
using backdoor data, then submits the resulting model. After federated
averaging, the global model is replaced by the backdoored model as shown in
Fig. 4. In the backdoor, an adversary can be hidden and has no impact on the
accuracy or functionality of the global model like accuracy. As a result, the
accuracy of the validation dataset makes it difficult to distinguish the
backdoor attack [66][67].

Figure 4: An illustration of the Backdoor attacks against FL

##  VI Privacy enhancing technologies

Privacy Enhancing Technologies (PETs) are a set of tools and techniques that
aim to protect individuals’ privacy. PETs are designed to enable companies to
embed privacy-by-design principles into their data governance practices to
minimize the amount of personal data they collect, use and share while
maximizing data security and privacy. In this context, our objective is to
explore how PETs can be utilized to enhance privacy-preserving in FL to
improve patient data privacy in IoHT devices and e-healthcare. Four wide
categories of PETs are used to improve privacy protection, including (1)
anonymization technique [68], (2) cryptographic technique [69], (3)
perturbation technique [70], and (4) blockchain technique [71].

###  VI-A Anonymization Techniques

Anonymization techniques are broadly used for privacy enhancing by changing
the state of a data set and removing the identifier from dataset information
in a way so that the dataset is usable and protects the privacy of
individual’s personal information [72]. Anonymity technology can better avoid
the leakage of sensitive patient data and provide more secure environment for
smart healthcare systems. There are several anonymization technologies that
are appropriate for big medical data, which are based on three categories of
widely used anonymity protection techniques: k-anonymity, l-diversity, and
t-closeness models [73].

The idea of k-anonymity is to anonymize the quasi-identifier in the dataset
that can be used by attackers to identify sensitive information about
individuals. After selecting the quasi-identifiers, k-anonymity applies for
each sample in the dataset, which can guarantee that each sample in the
dataset cannot be re-identified from at least $k$-1 samples [74]. l-diversity
is an extension of the k-anonymity mechanism to enhance privacy against
against homogeneity attacks and background knowledge attacks on k-anonymity
[75]. l-diversity ensures that there are at least $l$ “well-performing” values
for the sensitive attributes and protects against attribute disclosure [76].
Finally, t-closeness is proposed to reduce attacks against k-anonymity and
l-diversity approaches and solve the attribute disclosure problem [77].

###  VI-B Cryptographic Techniques

Cryptographic techniques have been used to avoid privacy disclosure of
individual’s private data in federated learning [78]. These methods consist of
homomorphic encryption, secure multi-party computation, and zero-knowledge
proofs.

Homomorphic encryption is a form of encryption for privacy-enhancing in FL to
prevent information leakage during the parameter exchanging process among
clients. In this method, parameters are encoded before adding or multiplying
operations [79]. There are two main widely used homomorphic encryption
methods: fully homomorphic encryption and partially homomorphic encryption.
Fully homomorphic encryption supports both additive and multiplicative
operations on ciphertext, while partially homomorphic encryption only supports
either additive or multiplicative operations on the ciphertext. Compared with
partially homomorphic encryption, fully homomorphic encryption provides
stronger encryption, and both can be applied to horizontal and vertical
federated learning [80].

Secure multi-party computation (SMC) [81] is a sub-field of cryptographic
schemes to protect private information. SMC can be used to solve the problem
of collaborative computing between all parties such that no party learns
anything about other participants’ data [82]. The application of SMC allows
multiple participants to concentrate on safely calculating a function for
various participant without the requirement of trusted third-parties and
revealing input. However, due to the additional encryption and decryption
operations, SMC suffers from computational overhead and high communication
costs [83].

Zero-knowledge proofs (ZKP) [84] is a cryptographic system to achieve both
input privacy and verifiability in federated learning [85]. A zero-knowledge
proof involves a prover to make sure with another entity called a verifier
that distinguishes the validity of a given statement. ZKP can be an
appropriate method for verification of sensitive healthcare data among
collaborators because it allows sharing data securely and privately between
multiple participants [86].

###  VI-C Perturbation Techniques

A perturbation method is to protect private data and model privacy by adding
random noise to the original data or training data during the training
process. The differential privacy technique is a widely used perturbation
method implemented in the FL frameworks in medical applications. It is one of
the PETs methods and guarantees privacy [87] using probability statistical
models to mask sensitive private data in a dataset [88] and protect healthcare
data against inference attack on FL frameworks. By adding noise to the model
parameters or data, data can be deferentially private [89][90], and the
parties cannot realize whether an individual record participates in the
learning process or not.

Differential privacy techniques include two categories: global differential
and local differential privacy techniques. In the global differential privacy
(GDP) setting, there is a trusted curator that applies carefully random noise
to the real values returned for a particular query [91]. Different from GDP, a
local differential privacy (LDP) technique does not need a trusted third-
party. In fact, LDP allows users to locally perturb the input data, and it
often produces too noisy data, as noise is applied to achieve individual
record privacy [92]. As an advantage, the differential privacy technique by
adding random noise makes data sets more secure because an attacker cannot
distinguish which information is true. Therefore, more noises that are added
to the sensitive data have a direct relationship to how the data is hard for
an attacker to recognize true information about individuals in the dataset
[93].

TABLE II: Summary of anonymization techniques applied in FL for the smart healthcare environment. Ref. | Aim | Dataset | Dataset Available | Open-Source | Privacy Attack | Privacy-Enhancing Method
---|---|---|---|---|---|---
[94] | Maximize data utility | MIMIC III | ✓ | $\times$ | Inference attack | syntactic anonymization
| & |  |  |  |  |
| model performance |  |  |  |  |
[95] | Applying data privacy | Pima Indians | ✓ | $\times$ | Poisoning attack | k-anonymity
| engineering without | diabetes |  |  |  |
| reducing the accuracy | & |  |  |  |
|  | Cleveland |  |  |  |
|  | heart disease |  |  |  |
[96] | Preserving private data | MNIST | ✓ | $\times$ | - | Non-negative matrix
| with high accuracy | HARUS |  |  |  | factorization
[97] | Avoiding an attack from | eICU | ✓ | $\times$ | Inference attack | Anonymous random
| an untrustable central |  |  |  |  | hybridization
| analyzer in FL |  |  |  |  |
| & |  |  |  |  |
| obtain similar performance |  |  |  |  |
| compared with a centralized |  |  |  |  |
| model |  |  |  |  |

###  VI-D Blockchain Techniques

Blockchain is beneficial in many non-financial industries such as healthcare
due to its cryptographic security, immutability, and accountability [98].
Researchers have recently started implementing blockchain technology to
decentralize traditional data management systems. For instance, blockchain-
based data management prevents security breaches and assure GDPR compliance
[99]. Therefore, blockchain-based PETs solutions can be used in Medical IoT to
safeguard individuals’ rights over their personal data [100]. Accordingly,
Blockchain is a promising technique to improve the security and scalability of
the FL system. This technique has provided a high level of security in the
domain of healthcare by integrating blockchain into a federated learning to
maintain the trained parameters [101]. The blockchain-based system is
effective for decentralized federated learning training without the need for
any central server which can mitigate risks of single-point failures [102]. To
provide IoHT data provenance, blockchain has shown great promise, and also
provides permission control of the participants to enhance the security and
privacy of parameters in federated learning. Blockchain has gained popularity
for managing the trust and provenance of trustworthy federated nodes, their
datasets, the accuracy of the models, and the immutability of the global model
[103]. A blockchain method consists of public (permissionless), private and
consortium (permissioned). A public blockchain system allows any client to
participate in the decentralized process without the need for authorized
permission. In a private and consortium system, only the client with
authorized permission can be involved in the block validation and confirmation
process.

##  VII PETs in Federated Learning

In this section, we discuss the security and privacy issues in FL from PETs
perspective. The PETs used in FL can be classified in several categories
detailed as follows.

###  VII-A Anonymization Methods

Several research has been published in the literature that integrates
anonymization techniques and FL [104] [105] [106], and some of these studies
attempt to evaluate the incorporation of FL and anonymization methods in a
smart healthcare environment [107]. For instance, in [94], the authors
proposed a syntactic anonymity approach to guarantee privacy in federated
learning. They used the anonymization based on ($k$, $k^{n}$)-anonymization
algorithm. This approach contains two steps. In the first step, the
anonymization method is applied to the original private data, which includes
relational and a transactional attributes, at the local site and then feeds
this anonymized data to a global model. The second step is a global
anonymization mapping process, which can be used for the prediction process in
the FL global model. They evaluated the proposed method using Medical
Information Mart for Intensive Care (MIMIC
III)111https://registry.opendata.aws/mimiciii/ dataset gathered from one
million patients. The results demonstrated that this approach enhances the
level of privacy compared to the differential privacy method in FL.

TABLE III: Summary of Cryptographic algorithms applied in FL for the smart healthcare environment Ref. | Aim | Dataset | Dataset Available | Open-Source | Privacy Attack | Privacy-Enhancing Method
---|---|---|---|---|---|---
[108] | Preserving privacy in | HAM10000 | ✓ | $\times$ | Inference attack | Homomorphic encryption
| skin cancer detection |  |  |  |  | &
| with reliable accuracy |  |  |  |  | secure multi-party computation
[109] | Securing FL environ- | UP-FALL | ✓ | $\times$ | Inference attack | xMK-CKKS multi-key
| ment on IoHT devices |  |  |  |  | homomorphic encryption
[110] | Enhancing patient’s | 3D brain MRI | ✓ | $\times$ | Membership | fully homomorphic
| data privacy |  |  |  | inference attack | encryption (FHE)
[111] | Protect medical data | eICU | ✓ | $\times$ | Reverse | Secure multi-party computation
| privacy on IoHT devices |  |  |  | engineering |
|  |  |  |  | attack |
[112] | Privacy-enhanced | Daily and Sports | ✓ | $\times$ | Global aggregation | Zero-knowledge proofs
| decentralized | Activities |  |  | & |
| applications |  |  |  | poisoning attack |

Similarly, Grama et al. [95] presented an adaptive privacy-preserving FL
method for healthcare data. In order to enhance privacy, they used the
k-anonymity method on top of the FL that can protect data by anonymization. In
fact, anonymization by applying the data protection method can cause
information loss. But, the proposed k-anonymity method in this paper decreases
losing data. Similar to [94], the authors evaluated the performance of the
proposed approach based on two health datasets to predict diabetes mellitus
onset222https://www.kaggle.com/datasets/uciml/pima-indians-diabetes-database
and heart failure
diseases333https://archive.ics.uci.edu/ml/datasets/heart+disease. Their
results showed that the k-anonymity method using $k$=4 can improve the
protection of the healthcare data, if it is applied to a dataset that contains
an adequate number of samples.

In [96], the author presented a federated PF-NMF framework. This FL framework
contains multiple local privacy filters (PF), which are used to remove
sensitive data to minimize the risk of privacy leakage. In the training phase,
PF acts as an encoder. The framework includes a decoder in the testing phase
and feeds the test data into the autoencoder. The author evaluated the
proposed approach on the MNIST
444https://www.tensorflow.org/datasets/catalog/mnist and HARUS dataset (human
static and dynamic activities gathered by wearable
devices)555http://archive.ics.uci.edu/ml/datasets/Human+Activity+Recognition
+Using+Smartphones. The results showed that federated PF-NMF achieves better
accuracy and enhances the privacy of sensitive data.

In another work[97], the authors proposed a new method called federated
machine learning with anonymous random hybridization (FeARH) to eliminate the
privacy problems in an untrustworthy central analyzer. The hybridization
algorithm adds the randomization into the parameter sets shared with other
parties. With a hybrid algorithm, the medical data, which is replaced by a
randomized parameters, do not need to be shared with other institutions. They
evaluated the proposed approach on eICU dataset666https://eicu-crd.mit.edu/
and the results showed that FeARH achieves similar performance compared with
FL and centralizes the machine learning method. Similar to [96], in [97] the
authors use anonymized data in the training phase. Table II summarizes the
representative existing anonymization techniques applied for FL in smart
healthcare.

###  VII-B Cryptographic Algorithms

Cryptographic methods are widely used in several FL methods to preserve data
privacy when exchanging intermediate parameters during the FL training process
[113] [114] [115]. For example, similar to [97] which covers smart healthcare
domain, Zhang et al. [108] presented the FL mechanism in the Internet of
Healthcare Things (IoHT). They applied the cryptographic masking scheme based
on homomorphic encryption and the secure multi-party computation to protect
private medical data against reconstruction attacks or model inversion
attacks. To evaluate the efficiency of the proposed FL model and validity of
the privacy-enhancing masking scheme, the authors used real skin cancer
datasets777https://dataverse.harvard.edu/dataset.xhtml?persistentId=doi:10.7910/
DVN/DBW86T. The result showed that the proposed model improves the privacy
protection of the medical data and achieves reliable accuracy in skin cancer
detection.

Ma et al. [109] proposed a novel privacy-enhancing FL on a smart healthcare
scenario for elderly-fall detection, the authors used UP-FALL Detection
dataset888http://sites.google.com/up.edu.mx/har-up/. Similar to [108], they
applied homomorphic encryption scheme to FL in order to prevent privacy
leakage and achieve secure encryption and decryption in the FL system. The
proposed xMK-CKKS multi-key homomorphic encryption scheme utilizes an
aggregated public key to encrypt the model updates before sharing them with a
server for aggregation. The model decryption occurs after clients share
information of their secret keys. The result showed that the proposed FL
scheme using multi-key homomorphic encryption is effective in communication,
computational cost, and energy consumption, while ensuring the implementation
of secure FL on IoHT devices.

In [110], the authors combined FL and fully homomorphic encryption (FHE) to
define a novel secure FL framework for biomedical data analysis. They used the
CKKS homomorphic encryption scheme based on ciphertext packing and rescaling,
similarly to the authors in [109]. The authors evaluated the performance of
the proposed FL model using a large-scale 3D brain MRI
dataset999https://dataverse.harvard.edu/dataset.xhtml?persistentId=doi:10.7910/
DVN/2RKAQP to predict brain age in a secure environment. The result showed
that the integration of a FL framework and encryption scheme does not reduce
the efficiency of FL, also increases the privacy of the patient’s private
data.

In [111], the authors provided a secure and scalable FL framework to implement
AI across hospital sites, collaborators, and edge devices. Similarly to [108],
to address privacy challenges, they integrated the proposed FL framework with
a secure multi-party computation algorithm to avoid data leakage and reverse
engineering attacks via model updates. They evaluated the performance of the
SMPC method in FL using the Philips ICU dataset. The results demonstrated that
the developed FL framework with a SMPC algorithm can be used in a large
ecosystem of the Internet of Healthcare Things (IoHT) and healthcare hospital
sites. Moreover, the proposed framework significantly protects medical data
privacy.

Heiss et al. [112] proposed a model for blockchain-based FL that leverages
verifiable off-chain computations (VOC) using zero-knowledge proofs (ZKP). The
architecture enables the computational correctness of local learning processes
verifiable on blockchain and provides globally verifiable management of global
learning parameters. They evaluated the performance of the architecture
through an in-home health monitoring system where sensitive data serve as
inputs to the FL system. The author used Daily and Sports Activities
dataset101010https://archive.ics.uci.edu/ml/datasets/daily+and+sports+activities
and the results showed that verifiable off-chain computations (VOC) using
zero-knowledge proofs (ZKP) enhances privacy in decentralized applications.
Similar to [111] and [108], in [112], the authors integrated zero-knowledge
proofs (ZKP) with FL in order to enhance privacy in IoHT ecosystem. Table III
summarizes the cryptographic methods applied for FL in smart healthcare.

###  VII-C Perturbation Methods

Similar to [109], in [116], the authors proposed a bandwidth-efficient FL
framework in IoHT environment. The framework ensures privacy for FL based on
Differential Privacy (DP). They discovered that exchanging the model update
from a huge amount of IoHT devices needs a significant bandwidth. Therefore,
they proposed the FL-SIGN-DP scheme to reduce communication costs and enhance
privacy. Participants in FL-SIGN-DP only transmit the updated model’s sign to
the aggregation server. They used the electronic health records of roughly a
million patients to assess the performance of the proposed scheme with regard
to the in-hospital mortality rate. The proposed scheme is compared with
centralized learning, FL-SIGN without using standard FL, differential privacy,
and differential privacy with standard FL. The results showed that the FL-
SIGN-DP consumes less bandwidth and can guarantee privacy protection.

Islam et al. [117] proposed a FL model to analyze patients’ genomic data and
identify the risk of heart failure. To enhance the privacy-preserving of the
patient private data sharing among collaborating healthcare organizations in
FL framework, they applied differential privacy mechanisms through feature
selection based on statistical methods to increase scalability and accuracy in
a federated setting where data are vertically partitioned. They evaluated the
performance of the proposed FL framework using the IQVIA dataset and BC-TCGA
dataset111111https://www.kaggle.com/datasets/saurabhshahane/gene-expression-
profiles-of-breast-cancerfor predicting the causes of certain heart failure
and the BC-TCGA dataset for cancer prediction to compare their proposed FL
method. The result demonstrated that their proposed model obtains better
accuracy with the highest privacy for the IQVIA and BC-TCGA datasets in a
federated training setting.

TABLE IV: Summary of Perturbation method applied in FL for the smart healthcare environment Ref. | Aim | Dataset | Dataset Available | Open-Source | Privacy Attack | Privacy-Enhancing Method
---|---|---|---|---|---|---
[116] | Enhancing privacy | Two real-world | $\times$ | ✓ | Inference attack | Differential privacy
| & | Electronic |  |  |  |
| bandwidth efficiency | Health Records |  |  |  |
[117] | Preserving privacy and predicting | BC-TCGA | ✓ | $\times$ | - | Differential privacy
| risk of heart failure |  |  |  |  |
[118] | Avoiding medical data leakage | Dataset of a | $\times$ | $\times$ | Adversarial attack | Differential privacy
| during data exchange | tumor hospitals |  |  |  |
[119] | privacy-preserving IoHT | ADReSS | ✓ | $\times$ | Man-in-the-middle | Differential privacy
| Alzheimer’s disease detection |  |  |  | attack |
[120] | Preserving privacy and improving | DarkCOVID | ✓ | $\times$ | - | Differential privacy
| COVID19 detection | ChestCOVID |  |  |  |

The authors in [118] proposed federated adversarial learning (FAL) on
biomedical named entity recognition (BioNER). The differential privacy
technology is also used to protect the security and privacy of the data, which
adds Gaussian noise during the local training and model aggregation process to
enhance privacy. More specifically, only the noised parameters with
differential privacy are transferred among the server and the client.
Therefore, the data leakage possibility has decreased on the local client’s
side. The dataset collected from 5 departments of a tumor hospital is used to
examine the performance of the proposed scheme. The Result showed that the
proposed FAL framework can connect data parties and prevent data leakage
during data exchange inside medical institutions.

Similarly to [116], in [119], the authors proposed a cost-effective and
privacy-preserving FL framework which is IoHT Alzheimer’s disease detection
scheme. They presented an FL based privacy-preserving smart healthcare system,
namely ADDetector, to detect Alzheimer’s disease. Moreover, they implemented a
differential privacy (DP) mechanism on the user data to avoid patient’s data
leakage during transferring data to the client and enhance the privacy level
against the attacker. An ADReSS Challenge dataset from INTERSPEECH
2020121212https://luzs.gitlab.io/adress/ is used to evaluate the performance
of the ADDetector FL-based scheme. The proposed FL-based framework and DP-
based mechanism use the audio from smart devices to detect low-cost
Alzheimer’s disease. The experimental results showed that the ADDETECTOR FL-
based framework achieves better accuracy and low average time overhead with a
high level of privacy and security protection.

Dinh et al. [120] proposed an FL framework, called FedGAN, to facilitate
COVID-19 detection by enhancing privacy among medical institutions in edge
cloud computing. The aim of the framework is to create realistic COVID-19
X-ray data and detect it automatically without the need for sharing COVID-19
image with parties. Additionally, they integrated a differential privacy at
each hospital site to increase and guarantee the data privacy in federated
COVID-19 data training. To apply the differential privacy, they used both
differentially private stochastic gradient descent and a gradient perturbation
technique; they also added the Gaussian noises to the gradient during the
training. Additionally, they use the FedGAN blockchain-based system for safe
COVID-19 data analysis. To evaluate the performance of proposed FedGAN model,
they used two popular COVID-19 X-ray data sets for simulations, including a
DarkCOVID131313https://github.com/ieee8023/COVID-chestxray-dataset and a
ChestCOVID141414https://github.com/ieee8023/covid-chestxray-dataset dataset.
The result demonstrated that FedGAN framework enhances the performance of
COVID-19 detection and provides high level of privacy. Table IV presents a
summary of the perturbation methods applied for FL in smart healthcare.

TABLE V: Summary of Blockchain method applied in FL for the smart healthcare environment Ref. | Aim | Dataset | Dataset Available | Open-Source | Privacy Attack | Privacy-Enhancing Method
---|---|---|---|---|---|---
[121] | IoMT privacy-preserving | - | $\times$ | $\times$ | Backdoors | Blockchain
| & |  |  |  | & |
| predict the COVID-19 |  |  |  | Inference attack |
[122] | Preserving data privacy | - | $\times$ | $\times$ | - | Blockchain
| & |  |  |  |  |
| predicting COVID-19 |  |  |  |  |
[123] | Fraud-detection for | ECG heartbeat | $\times$ | $\times$ | Fraud attack | Blockchain
| IoHT | E-Heart videos |  |  |  |
|  | Blood pressure |  |  |  |
[124] | Privacy preserving for | Healthcare data | $\times$ | $\times$ | Replay attack | Blockchain
| IoHT in cloud |  |  |  |  |
[125] | Preserving the patient’s | CC-19 | ✓ | ✓ | - | Blockchain
| privacy and detection |  |  |  |  |
| COVID-19 CT scan |  |  |  |  |

###  VII-D Blockchain Methods

Blockchain methods have been widely used in many FL methods to provide privacy
and security in IoHT (smart healthcare systems).

For smart healthcare systems, the authors of [121] proposed an infrastructure
called FedMedChain, which is based on secure FL and blockchain to predict the
COVID-19 for IoMT scenarios, similarly to [120] which proposes an privacy-
preserving FL-based scheme for analysis of COVID-19 data in a secure
environment. The proposed system can improve public communication and address
the challenges of big data silos and data security. Furthermore, information
security and privacy analyses showed that the proposed infrastructure is
robust against privacy breaches and can improve information security.

Similarly to [121], to solve privacy concerns, the authors in [122] presented
a model based on the FL and blockchain, which is used to predict COVID-19
symptoms, how it spreads, and speed up using the medical data in research and
treatment. In addition, the combination of FL and blockchain could be useful
for real time environment and for organizations that do not want share
sensitive data with third parties because of privacy concerns. After analyzing
the combination of blockchain and FL solution, the authors noted that the
proposed solution securely protects the data access and would help to build a
robust model.

Similarly to [121], Lakhan et al. [123] proposed a privacy-preserving FL for
IoMT system. It is a mathematical model called FL-BETS, which is a FL-based
privacy enhancing and malware detection-enable blockchain IoMT system for
different healthcare workloads. The aim of this study is to preserve privacy
and fraud of data in the local fog nodes and remote clouds network with
minimum energy consumption and delay. The performance evaluation of the FL-
BETS framework, compared to other existing machine learning and blockchain
methods in malware analysis shows the best performance in fraud analysis, data
validation, energy and delay constraints for healthcare applications. Also,
the model decreases energy consumption by 41% and delay by 28%.

Similar to [121] and [123], in [124], the authors proposed the model by
integrating Blockchain and FL-enabled approaches to provide a secure
architecture for privacy preservation in smart healthcare systems. In this
model, blockchain-based IoT cloud apps enhance security and privacy by
combining FL and blockchain technologies. The proposed model has provided
secure data sharing for the IoHT environment with privacy preservation.
Organizations can use federated-based blockchain cloud architecture without
collaborating sensitive and private healthcare system data in the cloud.

Kumar et al. [125] developed an FL blockchain-based approach to train the
global model for detection of COVID-19 patients based on Computed tomography
(CT) slices while preserving the privacy of patients’ private data and the
organization, similarly to [121]. The proposed model evaluated real-life
COVID-19 patients’ data151515https://paperswithcode.com/dataset/cc-19 that
were collected from various hospitals with different types of CT scanners and
publicly available to the research community. The results showed that the
blockchain-based FL smartly detects COVID-19 patients using computed
tomography (CT) scans among various hospitals while preserving sensitive data
privacy. Table V summarizes the blockchain methods applied for FL in smart
healthcare.

##  VIII Key challenges for future research

While PETs in FL have many advantages and have been growing rapidly in recent
years, some challenges cannot be ignored. Existing frameworks are still at an
early stage and need improving methods to enhance data privacy.

####  VIII-1 Computation cost

One of the main challenges of FL is represented by privacy-enhancing to
prevent data leakage. FL needs multiple iterations to achieve the final global
model. Therefore, the number of training iterations has a direct impact on
increasing the cost of the training model. As shown in [111], multi-party
computation is a way to protect data privacy in FL. Performing experiments
with a different number of workers does not impact the computation cost,
however, increasing the number of training rounds significantly boosts the
computation cost. Therefore, the trade-off between privacy risk and
computation time has been a promising topic for researchers.

####  VIII-2 Privacy and security

In Section VII-D, some studies show that integration of the blockchain method
and FL is a way to enhance privacy in IoHT. However, there is an open issue
that may lead to privacy leakage. In the FL, only the central server has
information about the sources of the local model updates, and the addresses of
the clients are private. However, addresses in blockchain are public, and
using blockchain in FL gives the ability to other clients to communicate with
each other and obtain the training model based on the public information from
the blockchain. Therefore, the risk of data leakage among clients cannot be
ignored.

####  VIII-3 Linkage attacks

The k-anonymity technique is a way to preserve the anonymity of individuals.
The key idea is how to modify the attributes of the dataset in a way that each
instance has at least $k$-1 other entities with identical quasi-identifiers.
Therefore, an identifiable record would link to multiple records in the
anonymous dataset. However, k-anonymity cannot avoid privacy leakage against
linkage attacks where a sensitive attribute is shared among a group of
individuals with the same quasi-identifier.

##  IX Conclusions

This survey has reviewed nineteen representative works that apply federated
learning (FL) in the Internet of Healthcare Things (IoHT) domain in terms of
privacy aspects, including attacks and privacy-enhancing technologies (PETs).
The datasets used by these works have also been summarized, which are helpful
for researchers aiming to reproduce these works. Some open research issues on
the topic still exist, such as the trade-off between privacy risk and
computational time, the risk of data leakage among colluding clients, and the
sharing of sensitive attributes. Along with the current research efforts, we
encourage more insights into the problems of this area and more efforts in
addressing the open research issues identified in this paper.

## Acknowledgments

This research is part of the INCT of the Future Internet for Smart Cities
funded by CNPq proc. 465446/2014-0, Coordenação de Aperfeiçoamento de Pessoal
de Nível Superior – Brasil (CAPES) – Finance Code 001, FAPESP proc. 14/50937-1
and proc. 15/24485-9.

## References

  * [1] N. Mani, A. Singh, and S. L. Nimmagadda, “An iot guided healthcare monitoring system for managing real-time notifications by fog computing services,” _Procedia Computer Science_ , vol. 167, pp. 850–859, 2020.
  * [2] J. Cheng, W. Wu, J. Cao, and K. Li, “Fuzzy group-based intersection control via vehicular networks for smart transportations,” _IEEE Transactions on Industrial Informatics_ , vol. 13, no. 2, pp. 751–758, 2016.
  * [3] B. L. R. Stojkoska and K. V. Trivodaliev, “A review of internet of things for smart home: Challenges and solutions,” _Journal of cleaner production_ , vol. 140, pp. 1454–1464, 2017.
  * [4] Z. Chen, C. Sivaparthipan, and B. Muthu, “Iot based smart and intelligent smart city energy optimization,” _Sustainable Energy Technologies and Assessments_ , vol. 49, p. 101724, 2022.
  * [5] G. Aceto, V. Persico, and A. Pescapé, “Industry 4.0 and health: Internet of things, big data, and cloud computing for healthcare 4.0,” _Journal of Industrial Information Integration_ , vol. 18, p. 100129, 2020.
  * [6] J.-F. Rajotte, S. Mukherjee, C. Robinson, A. Ortiz, C. West, J. M. L. Ferres, and R. T. Ng, “Reducing bias and increasing utility by federated generative modeling of medical images using a centralized adversary,” in _Proceedings of the Conference on Information Technology for Social Good_ , 2021, pp. 79–84.
  * [7] E. Vayena, A. Blasimme, and I. G. Cohen, “Machine learning in medicine: addressing ethical challenges,” _PLoS medicine_ , vol. 15, no. 11, p. e1002689, 2018.
  * [8] M. Joshi, A. Pal, and M. Sankarasubbu, “Federated learning for healthcare domain-pipeline, applications and challenges,” _ACM Transactions on Computing for Healthcare_ , 2022.
  * [9] O. Aouedi, A. Sacco, K. Piamrat, and G. Marchetto, “Handling privacy-sensitive medical data with federated learning: Challenges and future directions,” _IEEE Journal of Biomedical and Health Informatics_ , 2022.
  * [10] Q. Yang, Y. Liu, T. Chen, and Y. Tong, “Federated machine learning: Concept and applications,” _ACM TIST_ , vol. 10, no. 2, pp. 1–19, 2019.
  * [11] R. S. Antunes, C. André da Costa, A. Küderle, I. A. Yari, and B. Eskofier, “Federated learning for healthcare: Systematic review and architecture proposal,” _ACM TIST_ , vol. 13, no. 4, pp. 1–23, 2022.
  * [12] M. Asad, A. Moustafa, and C. Yu, “A critical evaluation of privacy and security threats in federated learning,” _Sensors_ , vol. 20, no. 24, p. 7182, 2020.
  * [13] G. Danezis, “An introduction to privacy enhancing technologies,” in _Internet Society Geneva’s Monthly Conferences Cycle, Geneva, Switzerland_ , 2004.
  * [14] Z. Abou El Houda, A. S. Hafid, and L. Khoukhi, “Mitfed: A privacy preserving collaborative network attack mitigation framework based on federated learning using sdn and blockchain,” _IEEE Transactions on Network Science and Engineering_ , 2023.
  * [15] B. Yu, W. Mao, Y. Lv, C. Zhang, and Y. Xie, “A survey on federated learning in data mining,” _Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery_ , vol. 12, no. 1, p. e1443, 2022.
  * [16] Z. Xue, P. Zhou, Z. Xu, X. Wang, Y. Xie, X. Ding, and S. Wen, “A resource-constrained and privacy-preserving edge-computing-enabled clinical decision system: A federated reinforcement learning approach,” _IEEE Internet of Things Journal_ , vol. 8, no. 11, pp. 9122–9138, 2021.
  * [17] M. Hao, D. Ye, S. Wang, B. Tan, and R. Yu, “Urllc resource slicing and scheduling for trustworthy 6g vehicular services: A federated reinforcement learning approach,” _Physical Communication_ , vol. 49, p. 101470, 2021.
  * [18] L. Zhang, B. Shen, A. Barnawi, S. Xi, N. Kumar, and Y. Wu, “Feddpgan: federated differentially private generative adversarial networks framework for the detection of covid-19 pneumonia,” _Information Systems Frontiers_ , vol. 23, no. 6, pp. 1403–1415, 2021.
  * [19] G. M. Garrido, J. Sedlmeir, Ö. Uludağ, I. S. Alaoui, A. Luckow, and F. Matthes, “Revealing the landscape of privacy-enhancing technologies in the context of data markets for the iot: A systematic literature review,” _Journal of Network and Computer Applications_ , p. 103465, 2022.
  * [20] M. Aledhari, R. Razzak, R. M. Parizi, and F. Saeed, “Federated Learning: A Survey on Enabling Technologies, Protocols, and Applications,” _IEEE Access_ , vol. 8, pp. 140 699–140 725, 2020.
  * [21] C. Zhang, Y. Xie, H. Bai, B. Yu, W. Li, and Y. Gao, “A survey on federated learning,” _Knowledge-Based Systems_ , vol. 216, p. 106775, 2021.
  * [22] V. Mothukuri, R. M. Parizi, S. Pouriyeh, Y. Huang, A. Dehghantanha, and G. Srivastava, “A Survey on Security and Privacy of Federated Learning,” _Future Generation Computer Systems_ , vol. 115, pp. 619–640, 2021.
  * [23] D. C. Nguyen, M. Ding, P. N. Pathirana, A. Seneviratne, J. Li, and H. Vincent Poor, “Federated Learning for Internet of Things: A Comprehensive Survey,” _IEEE COMST_ , vol. 23, no. 3, pp. 1622–1658, 2021\.
  * [24] E. Novikova, D. Fomichov, I. Kholod, and E. Filippov, “Analysis of privacy-enhancing technologies in open-source federated learning frameworks for driver activity recognition,” _Sensors_ , vol. 22, no. 8, p. 2983, 2022\.
  * [25] D. C. Nguyen, Q.-V. Pham, P. N. Pathirana, M. Ding, A. Seneviratne, Z. Lin, O. Dobre, and W.-J. Hwang, “Federated Learning for Smart Healthcare: A Survey,” _ACM Comput. Surv._ , vol. 55, no. 3, feb 2022.
  * [26] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in _Artificial intelligence and statistics_. PMLR, 2017, pp. 1273–1282.
  * [27] J. Konečnỳ, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,” _arXiv preprint arXiv:1610.05492_ , 2016.
  * [28] P. M. Mammen, “Federated learning: opportunities and challenges,” _arXiv preprint arXiv:2101.05428_ , 2021.
  * [29] B. Pfitzner, N. Steckhan, and B. Arnrich, “Federated learning in a medical context: a systematic literature review,” _ACM TOIT_ , vol. 21, no. 2, pp. 1–31, 2021.
  * [30] T. Zhang and S. Mao, “An introduction to the federated learning standard,” _GetMobile: Mobile Computing and Communications_ , vol. 25, no. 3, pp. 18–22, 2022.
  * [31] C.-R. Shyu, K. T. Putra, H.-C. Chen, Y.-Y. Tsai, K. T. Hossain, W. Jiang, and Z.-Y. Shae, “A systematic review of federated learning in the healthcare area: From the perspective of data properties and applications,” _Applied Sciences_ , vol. 11, no. 23, p. 11191, 2021.
  * [32] Y. Chen, X. Qin, J. Wang, C. Yu, and W. Gao, “Fedhealth: A federated transfer learning framework for wearable healthcare,” _IEEE Intelligent Systems_ , vol. 35, no. 4, pp. 83–93, 2020.
  * [33] D. C. Nguyen, Q.-V. Pham, P. N. Pathirana, M. Ding, A. Seneviratne, Z. Lin, O. Dobre, and W.-J. Hwang, “Federated learning for smart healthcare: A survey,” _ACM Computing Surveys (CSUR)_ , vol. 55, no. 3, pp. 1–37, 2022\.
  * [34] H. Huang, J. Zhou, W. Li, J. Zhang, X. Zhang, and G. Hou, “Wearable indoor localisation approach in internet of things,” _IET Networks_ , vol. 5, no. 5, pp. 122–126, 2016.
  * [35] G. Mooney, “Is hipaa compliant with the gdpr?” 2018.
  * [36] R. C. Barrows Jr and P. D. Clayton, “Privacy, confidentiality, and electronic medical records,” _Journal of the American medical informatics association_ , vol. 3, no. 2, pp. 139–148, 1996.
  * [37] D. Ng, X. Lan, M. M.-S. Yao, W. P. Chan, and M. Feng, “Federated learning: a collaborative effort to achieve better medical imaging models for individual sites that have small labelled datasets,” _Quantitative Imaging in Medicine and Surgery_ , vol. 11, no. 2, p. 852, 2021.
  * [38] Y. Zhao, J. Zhao, L. Jiang, R. Tan, D. Niyato, Z. Li, L. Lyu, and Y. Liu, “Privacy-preserving blockchain-based federated learning for iot devices,” _IEEE Internet of Things Journal_ , vol. 8, no. 3, pp. 1817–1829, 2020.
  * [39] O. A. Wahab, A. Mourad, H. Otrok, and T. Taleb, “Federated machine learning: Survey, multi-level classification, desirable criteria and future directions in communication and networking systems,” _IEEE Communications Surveys & Tutorials_, vol. 23, no. 2, pp. 1342–1397, 2021.
  * [40] M. J. Sheller, B. Edwards, G. A. Reina, J. Martin, S. Pati, A. Kotrotsou, M. Milchenko, W. Xu, D. Marcus, R. R. Colen _et al._ , “Federated learning in medicine: facilitating multi-institutional collaborations without sharing patient data,” _Scientific reports_ , vol. 10, no. 1, pp. 1–12, 2020\.
  * [41] N. Rieke, J. Hancox, W. Li, F. Milletari, H. R. Roth, S. Albarqouni, S. Bakas, M. N. Galtier, B. A. Landman, K. Maier-Hein _et al._ , “The future of digital health with federated learning,” _NPJ digital medicine_ , vol. 3, no. 1, pp. 1–7, 2020.
  * [42] W. Y. B. Lim, N. C. Luong, D. T. Hoang, Y. Jiao, Y.-C. Liang, Q. Yang, D. Niyato, and C. Miao, “Federated learning in mobile edge networks: A comprehensive survey,” _IEEE COMST_ , vol. 22, no. 3, pp. 2031–2063, 2020\.
  * [43] L. U. Khan, W. Saad, Z. Han, E. Hossain, and C. S. Hong, “Federated learning for internet of things: Recent advances, taxonomy, and open challenges,” _IEEE COMST_ , 2021.
  * [44] L. U. Khan, S. R. Pandey, N. H. Tran, W. Saad, Z. Han, M. N. Nguyen, and C. S. Hong, “Federated learning for edge networks: Resource optimization and incentive mechanism,” _IEEE COMMAG_ , vol. 58, no. 10, pp. 88–93, 2020.
  * [45] L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in _IEEE Symposium on Security and Privacy_ , 2019, pp. 691–706.
  * [46] A. Bhowmick, J. Duchi, J. Freudiger, G. Kapoor, and R. Rogers, “Protection against reconstruction and its applications in private federated learning,” _arXiv preprint arXiv:1812.00984_ , 2018.
  * [47] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” _Advances in neural information processing systems_ , vol. 32, 2019.
  * [48] Y. Aono, T. Hayashi, L. Wang, S. Moriai _et al._ , “Privacy-preserving deep learning via additively homomorphic encryption,” _IEEE Transactions on Information Forensics and Security_ , vol. 13, no. 5, pp. 1333–1345, 2017.
  * [49] A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 634–643.
  * [50] Z. Ying, Y. Zhang, and X. Liu, “Privacy-preserving in defending against membership inference attacks,” in _Proceedings of the 2020 Workshop on Privacy-Preserving Machine Learning in Practice_ , 2020, pp. 61–63.
  * [51] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in _International Conference on Artificial Intelligence and Statistics_. PMLR, 2020, pp. 2938–2948.
  * [52] X. Zhou, M. Xu, Y. Wu, and N. Zheng, “Deep model poisoning attack on federated learning,” _Future Internet_ , vol. 13, no. 3, p. 73, 2021.
  * [53] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in _European Symposium on Research in Computer Security_. Springer, 2020, pp. 480–501.
  * [54] D. Cao, S. Chang, Z. Lin, G. Liu, and D. Sun, “Understanding distributed poisoning attack in federated learning,” in _IEEE 25th ICPADS_ , 2019, pp. 233–239.
  * [55] L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,” _arXiv preprint arXiv:2003.02133_ , 2020.
  * [56] M. S. Jere, T. Farnan, and F. Koushanfar, “A taxonomy of attacks on federated learning,” _IEEE Security & Privacy_, vol. 19, no. 2, pp. 20–28, 2020\.
  * [57] J. Sun, A. Li, B. Wang, H. Yang, H. Li, and Y. Chen, “Soteria: Provable defense against privacy leakage in federated learning from representation perspective,” in _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , 2021, pp. 9311–9319.
  * [58] J. Zhang, J. Zhang, J. Chen, and S. Yu, “Gan enhanced membership inference: A passive local attack in federated learning,” in _ICC 2020-2020 IEEE International Conference on Communications (ICC)_. IEEE, 2020, pp. 1–6.
  * [59] Z. Wang, Y. Huang, M. Song, L. Wu, F. Xue, and K. Ren, “Poisoning-assisted property inference attack against federated learning,” _IEEE Transactions on Dependable and Secure Computing_ , 2022.
  * [60] Q. Duan, S. Hu, R. Deng, and Z. Lu, “Combined federated and split learning in edge computing for ubiquitous intelligence in internet of things: State-of-the-art and future directions,” _Sensors_ , vol. 22, no. 16, p. 5983, 2022.
  * [61] B. Hitaj, G. Ateniese, and F. Perez-Cruz, “Deep models under the gan: information leakage from collaborative deep learning,” in _Proceedings of the 2017 ACM SIGSAC conference on computer and communications security_ , 2017, pp. 603–618.
  * [62] Z. Wang, M. Song, Z. Zhang, Y. Song, Q. Wang, and H. Qi, “Beyond inferring class representatives: User-level privacy leakage from federated learning,” in _IEEE INFOCOM 2019-IEEE conference on computer communications_. IEEE, 2019, pp. 2512–2520.
  * [63] M. Shen, H. Wang, B. Zhang, L. Zhu, K. Xu, Q. Li, and X. Du, “Exploiting unintended property leakage in blockchain-assisted federated learning for intelligent edge computing,” _IEEE Internet of Things Journal_ , vol. 8, no. 4, pp. 2265–2275, 2020.
  * [64] W. Wei, L. Liu, M. Loper, K.-H. Chow, M. E. Gursoy, S. Truex, and Y. Wu, “A framework for evaluating client privacy leakages in federated learning,” in _European Symposium on Research in Computer Security_. Springer, 2020, pp. 545–566.
  * [65] H. Zeng, T. Zhou, X. Wu, and Z. Cai, “Never too late: Tracing and mitigating backdoor attacks in federated learning,” in _2022 41st International Symposium on Reliable Distributed Systems (SRDS)_. IEEE, 2022, pp. 69–81.
  * [66] Z. Yin, Y. Yuan, P. Guo, and P. Zhou, “Backdoor attacks on federated learning with lottery ticket hypothesis,” _arXiv preprint arXiv:2109.10512_ , 2021\.
  * [67] Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?” _arXiv preprint arXiv:1911.07963_ , 2019.
  * [68] S. Fischer-Hübner, _IT-security and privacy: design and use of privacy-enhancing security mechanisms_. Springer, 2001.
  * [69] A. Abbas and S. U. Khan, “A review on the state-of-the-art privacy-preserving approaches in the e-health clouds,” _IEEE journal of Biomedical and health informatics_ , vol. 18, no. 4, pp. 1431–1441, 2014.
  * [70] J. Parra-Arnau, D. Rebollo-Monedero, and J. Forné, “Privacy-enhancing technologies and metrics in personalized information systems,” in _Advanced research in data privacy_. Springer, 2014, pp. 423–442.
  * [71] H. Liu, R. G. Crespo, and O. S. Martínez, “Enhancing privacy and data security across healthcare applications using blockchain and distributed ledger concepts,” in _Healthcare_ , vol. 8, no. 3. MDPI, 2020, p. 243.
  * [72] G. Dhiman, S. Juneja, H. Mohafez, I. El-Bayoumy, L. K. Sharma, M. Hadizadeh, M. A. Islam, W. Viriyasitavat, and M. U. Khandaker, “Federated learning approach to protect healthcare data over big data scenario,” _Sustainability_ , vol. 14, no. 5, p. 2500, 2022.
  * [73] P. Samarati and L. Sweeney, “Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression,” SRI International, Tech. Rep., 1998.
  * [74] O. Choudhury, A. Gkoulalas-Divanis, T. Salonidis, I. Sylla, Y. Park, G. Hsu, and A. Das, “Anonymizing data for privacy-preserving federated learning,” _arXiv preprint arXiv:2002.09096_ , 2020.
  * [75] A. Machanavajjhala, D. Kifer, J. Gehrke, and M. Venkitasubramaniam, “l-diversity: Privacy beyond k-anonymity,” _ACM TKDD_ , vol. 1, no. 1, pp. 3–es, 2007.
  * [76] Y. Sei, H. Okumura, T. Takenouchi, and A. Ohsuga, “Anonymization of sensitive quasi-identifiers for l-diversity and t-closeness,” _IEEE Transactions on Dependable and Secure Computing_ , vol. 16, no. 4, pp. 580–593, 2017.
  * [77] J. Domingo-Ferrer and J. Soria-Comas, “From t-closeness to differential privacy and vice versa in data anonymization,” _Knowledge-Based Systems_ , vol. 74, pp. 151–158, 2015.
  * [78] A. Blanco-Justicia, J. Domingo-Ferrer, S. Martínez, D. Sánchez, A. Flanagan, and K. E. Tan, “Achieving security and privacy in federated learning systems: Survey, research challenges and future directions,” _Engineering Applications of Artificial Intelligence_ , vol. 106, p. 104468, 2021.
  * [79] L. Li, Y. Fan, M. Tse, and K.-Y. Lin, “A review of applications in federated learning,” _Computers & Industrial Engineering_, vol. 149, p. 106854, 2020\.
  * [80] J. Liu, J. Huang, Y. Zhou, X. Li, S. Ji, H. Xiong, and D. Dou, “From distributed machine learning to federated learning: A survey,” _Knowledge and Information Systems_ , pp. 1–33, 2022.
  * [81] A. C. Yao, “Protocols for secure computations,” in _23rd Annual Symposium on Foundations of Computer Science_. IEEE, 1982, pp. 160–164.
  * [82] X. Yin, Y. Zhu, and J. Hu, “A comprehensive survey of privacy-preserving federated learning: A taxonomy, review, and future directions,” _ACM Computing Surveys (CSUR)_ , vol. 54, no. 6, pp. 1–36, 2021.
  * [83] X. Ma, L. Liao, Z. Li, R. X. Lai, and M. Zhang, “Applying federated learning in software-defined networks: A survey,” _Symmetry_ , vol. 14, no. 2, p. 195, 2022.
  * [84] S. Goldwasser, S. Micali, and C. Rackoff, “The knowledge complexity of interactive proof systems,” _SIAM Journal on computing_ , vol. 18, no. 1, pp. 186–208, 1989.
  * [85] X. Guo, Z. Liu, J. Li, J. Gao, B. Hou, C. Dong, and T. Baker, “V eri fl: Communication-efficient and fast verifiable aggregation for federated learning,” _IEEE Transactions on Information Forensics and Security_ , vol. 16, pp. 1736–1751, 2020.
  * [86] W. Liu, X. Wang, and W. Peng, “Secure remote multi-factor authentication scheme based on chaotic map zero-knowledge proof for crowdsourcing internet of things,” _IEEE Access_ , vol. 8, pp. 8754–8767, 2019.
  * [87] Q. Li, Z. Wu, Z. Wen, and B. He, “Privacy-preserving gradient boosting decision trees,” in _Proceedings of the AAAI Conference on Artificial Intelligence_ , vol. 34, no. 01, 2020, pp. 784–791.
  * [88] S. Jordan, C. Fontaine, and R. Hendricks-Sturrup, “Selecting privacy-enhancing technologies for managing health data use,” _Frontiers in Public Health_ , vol. 10, 2022.
  * [89] X. Xiao, G. Wang, and J. Gehrke, “Differential privacy via wavelet transforms,” _IEEE Transactions on knowledge and data engineering_ , vol. 23, no. 8, pp. 1200–1214, 2010.
  * [90] S. Song, K. Chaudhuri, and A. D. Sarwate, “Stochastic gradient descent with differentially private updates,” in _IEEE Global Conference on Signal and Information Processing_ , 2013, pp. 245–248.
  * [91] T.-H. H. Chan, M. Li, E. Shi, and W. Xu, “Differentially private continual monitoring of heavy hitters from distributed streams,” in _International Symposium on Privacy Enhancing Technologies Symposium_. Springer, 2012, pp. 140–159.
  * [92] G. Cormode, S. Jha, T. Kulkarni, N. Li, D. Srivastava, and T. Wang, “Privacy at scale: Local differential privacy in practice,” in _Proceedings of the 2018 International Conference on Management of Data_ , 2018, pp. 1655–1658.
  * [93] N. Kaaniche, M. Laurent, and S. Belguith, “Privacy enhancing technologies for solving the privacy-personalization paradox: Taxonomy and survey,” _Journal of Network and Computer Applications_ , vol. 171, p. 102807, 2020\.
  * [94] O. Choudhury, A. Gkoulalas-Divanis, T. Salonidis, I. Sylla, Y. Park, G. Hsu, and A. Das, “A syntactic approach for privacy-preserving federated learning,” in _ECAI 2020_. IOS Press, 2020, pp. 1762–1769.
  * [95] M. Grama, M. Musat, L. Muñoz-González, J. Passerat-Palmbach, D. Rueckert, and A. Alansary, “Robust aggregation for adaptive privacy preserving federated learning in healthcare,” _arXiv preprint arXiv:2009.08294_ , 2020.
  * [96] Z. Alsulaimawi, “A non-negative matrix factorization framework for privacy-preserving and federated learning,” in _IEEE 22nd International Workshop on Multimedia Signal Processing_ , 2020, pp. 1–6.
  * [97] J. Cui, H. Zhu, H. Deng, Z. Chen, and D. Liu, “Fearh: Federated machine learning with anonymous random hybridization on electronic medical records,” _Journal of Biomedical Informatics_ , vol. 117, p. 103735, 2021.
  * [98] I. T. Javed, F. Alharbi, T. Margaria, N. Crespi, and K. N. Qureshi, “Petchain: a blockchain-based privacy enhancing technology,” _IEEE Access_ , vol. 9, pp. 41 129–41 143, 2021.
  * [99] N. B. Truong, K. Sun, G. M. Lee, and Y. Guo, “Gdpr-compliant personal data management: A blockchain-based solution,” _IEEE Transactions on Information Forensics and Security_ , vol. 15, pp. 1746–1761, 2019.
  * [100] B. Alamri, I. T. Javed, and T. Margaria, “Preserving patients’ privacy in medical iot using blockchain,” in _Edge Computing–EDGE 2020: 4th International Conference, Held as Part of the Services Conference Federation, SCF 2020, Honolulu, HI, USA, September 18-20, 2020, Proceedings 4_. Springer, 2020, pp. 103–110.
  * [101] Y. Lu, X. Huang, K. Zhang, S. Maharjan, and Y. Zhang, “Blockchain and federated learning for 5g beyond,” _IEEE Network_ , vol. 35, no. 1, pp. 219–225, 2020.
  * [102] D. C. Nguyen, M. Ding, Q.-V. Pham, P. N. Pathirana, L. B. Le, A. Seneviratne, J. Li, D. Niyato, and H. V. Poor, “Federated learning meets blockchain in edge computing: Opportunities and challenges,” _IEEE Internet of Things Journal_ , vol. 8, no. 16, pp. 12 806–12 825, 2021.
  * [103] R. Hu, Z. Yan, W. Ding, and L. T. Yang, “A survey on data provenance in iot,” _World Wide Web_ , vol. 23, no. 2, pp. 1441–1463, 2020.
  * [104] T. Orekondy, S. J. Oh, Y. Zhang, B. Schiele, and M. Fritz, “Gradient-leaks: Understanding and controlling deanonymization in federated learning,” _arXiv preprint arXiv:1805.05838_ , 2018.
  * [105] W. Hao, N. Mehta, K. J. Liang, P. Cheng, M. El-Khamy, and L. Carin, “Waffle: Weight anonymized factorization for federated learning,” _IEEE Access_ , vol. 10, pp. 49 207–49 218, 2022.
  * [106] M. Song, Z. Wang, Z. Zhang, Y. Song, Q. Wang, J. Ren, and H. Qi, “Analyzing user-level privacy attack against federated learning,” _IEEE JSAC_ , vol. 38, no. 10, pp. 2430–2444, 2020.
  * [107] F. Marulli, L. Verde, S. Marrone, R. Barone, and M. S. De Biase, “Evaluating efficiency and effectiveness of federated learning approaches in knowledge extraction tasks,” in _International Joint Conference on Neural Networks_. IEEE, 2021, pp. 1–6.
  * [108] L. Zhang, J. Xu, P. Vijayakumar, P. K. Sharma, and U. Ghosh, “Homomorphic encryption-based privacy-preserving federated learning in iot-enabled healthcare system,” _IEEE Transactions on Network Science and Engineering_ , 2022.
  * [109] J. Ma, S.-A. Naas, S. Sigg, and X. Lyu, “Privacy-preserving federated learning based on multi-key homomorphic encryption,” _International Journal of Intelligent Systems_ , 2022.
  * [110] D. Stripelis, H. Saleem, T. Ghai, N. Dhinagar, U. Gupta, C. Anastasiou, G. Ver Steeg, S. Ravi, M. Naveed, P. M. Thompson _et al._ , “Secure neuroimaging analysis using federated learning with homomorphic encryption,” in _17th International Symposium on Medical Information Processing and Analysis_ , vol. 12088. SPIE, 2021, pp. 351–359.
  * [111] A. S. Rachakonda, B. S. Moorthy, C. A. Jain, D. A. Bukharev, E. A. Bucur, F. F. Manni, G. T. M. Quiterio, H. L. Joosten, and I. N. I. Mendez, “Privacy enhancing and scalable federated learning to accelerate ai implementation in cross-silo and iomt environments,” _IEEE Journal of Biomedical and Health Informatics_ , 2022.
  * [112] J. Heiss, E. Grünewald, N. Haimerl, S. Schulte, and S. Tai, “Advancing blockchain-based federated learning through verifiable off-chain computations,” _arXiv preprint arXiv:2206.11641_ , 2022.
  * [113] F. Wibawa, F. O. Catak, M. Kuzlu, S. Sarp, and U. Cali, “Homomorphic encryption and federated learning based privacy-preserving cnn training: Covid-19 detection use-case,” in _Proceedings of the 2022 European Interdisciplinary Cybersecurity Conference_ , 2022, pp. 85–90.
  * [114] Y. Bai and M. Fan, “A method to improve the privacy and security for federated learning,” in _IEEE 6th ICCCS_ , 2021, pp. 704–708.
  * [115] F. Wibawa, F. O. Catak, S. Sarp, and M. Kuzlu, “Bfv-based homomorphic encryption for privacy-preserving cnn models,” _Cryptography_ , vol. 6, no. 3, p. 34, 2022.
  * [116] R. Kerkouche, G. Acs, C. Castelluccia, and P. Genevès, “Privacy-preserving and bandwidth-efficient federated learning: An application to in-hospital mortality prediction,” in _Proceedings of the Conference on Health, Inference, and Learning_ , 2021, pp. 25–35.
  * [117] T. U. Islam, R. Ghasemi, and N. Mohammed, “Privacy-preserving federated learning model for healthcare data,” in _IEEE 12th CCWC_ , 2022, pp. 0281–0287.
  * [118] H. Zhao, S. Yuan, N. Xie, J. Leng, and G. Wang, “A federated adversarial learning method for biomedical named entity recognition,” in _IEEE BIBM_ , 2021, pp. 2962–2969.
  * [119] J. Li, Y. Meng, L. Ma, S. Du, H. Zhu, Q. Pei, and X. Shen, “A federated learning based privacy-preserving smart healthcare system,” _IEEE Transactions on Industrial Informatics_ , vol. 18, no. 3, 2021.
  * [120] D. C. Nguyen, M. Ding, P. N. Pathirana, A. Seneviratne, and A. Y. Zomaya, “Federated learning for covid-19 detection with generative adversarial networks in edge cloud computing,” _IEEE Internet of Things Journal_ , 2021\.
  * [121] O. Samuel, A. Omojo, A. Onuja, Y. Sunday, P. Tiwari, D. Gupta, G. Hafeez, A. Yahaya, O. Fatoba, and S. Shamshirband, “Iomt: A covid-19 healthcare system driven by federated learning and blockchain,” _IEEE Journal of Biomedical and Health Informatics_ , 2022.
  * [122] S. Aich, N. K. Sinai, S. Kumar, M. Ali, Y. R. Choi, M.-I. Joo, and H.-C. Kim, “Protecting personal healthcare record using blockchain & federated learning technologies,” in _24th ICACT_. IEEE, 2022, pp. 109–112.
  * [123] A. Lakhan, M. A. Mohammed, J. Nedoma, R. Martinek, P. Tiwari, A. Vidyarthi, A. Alkhayyat, and W. Wang, “Federated-learning based privacy preservation and fraud-enabled blockchain iomt system for healthcare,” _IEEE Journal of Biomedical and Health Informatics_ , 2022.
  * [124] S. Singh, S. Rathore, O. Alfarraj, A. Tolba, and B. Yoon, “A framework for privacy-preservation of iot healthcare data using federated learning and blockchain technology,” _Future Generation Computer Systems_ , vol. 129, pp. 380–388, 2022.
  * [125] R. Kumar, A. A. Khan, J. Kumar, N. A. Golilarz, S. Zhang, Y. Ting, C. Zheng, W. Wang _et al._ , “Blockchain-federated-learning and deep learning models for covid-19 detection using ct imaging,” _IEEE Sensors Journal_ , vol. 21, no. 14, pp. 16 301–16 314, 2021.