Privacy-Preserving Federated Learning for Artistic Image Classification in Visual IoT Sensor Networks

Abstract

Visual Internet-of-Things (IoT) cameras and institution-controlled edge gateways increasingly collect artwork images in museums, galleries, and heritage sites. Centralizing these images can expose collection contents, exhibition layouts, and contextual information. This paper proposes FedArtSense, a privacy-preserving federated learning framework for artistic style and medium classification. FedArtSense combines discrepancy-adaptive dual-space prototype alignment, client-level differential privacy for model and prototype releases, and importance-aware shared sparsification compatible with secure aggregation. Experiments on WikiArt, ArtBench-10, and a seven-class Behance Artistic Media subset use emulated non-IID client partitions, persistent acquisition shifts, constrained uplinks, and client dropout. Under the default client-level target $(ϵ,\delta )=(6,{10}^{-5})$, FedArtSense obtains accuracies of $64.2\%$, $81.2\%$, and $75.3\%$, respectively, while reducing cumulative WikiArt uplink traffic to $11.5$ GiB. The results support FedArtSense as a privacy–utility–communication trade-off for gateway-assisted artistic image classification; retrieval, detection, aesthetic prediction, and direct battery-powered camera training are outside the evaluated scope.

1. Introduction

Networked cameras and institution-controlled edge gateways are increasingly used to digitize, monitor, and organize artworks in museums, galleries, restoration laboratories, cultural heritage sites, and public exhibition spaces. Unlike a conventional centralized image collection, a visual Internet-of-Things (IoT) deployment produces images at geographically and administratively distributed sites. This study focuses on artistic style and medium classification; collection retrieval, object detection, and aesthetic prediction are not evaluated. Transferring sensor images to a central server can reveal private collection contents, unpublished artworks, restoration progress, ownership information, exhibition arrangements, or contextual details surrounding the artwork. The resulting problem is collaborative classification without surrendering control of local observations.

Federated learning offers a natural foundation for this objective because clients exchange learning information instead of raw data [1]. Nevertheless, data locality alone does not constitute a formal privacy guarantee. Model updates can encode information about the samples and clients that produced them, motivating client-level differential privacy [2]. The problem becomes particularly difficult for artistic images because privacy noise must be applied in a learning environment that is already statistically heterogeneous. Historical collections, contemporary design portfolios, and sensor-acquired exhibition images differ in artistic movement, visual medium, subject matter, illumination, viewpoint, color response, and compression artifacts. Research on computational style recognition has established that artistic imagery differs substantially from ordinary photography [3], while the Behance Artistic Media dataset demonstrates the breadth of contemporary media and depiction domains [4]. Consequently, a global model trained by direct averaging can suffer severe client drift even before privacy perturbation is introduced.

Existing federated optimizers address parts of this problem. Proximal regularization limits local parameter deviation under non-IID data [5], control variates correct biased local updates [6], and contrastive objectives improve agreement among client representations [7]. Prototype-based federation exchanges class-level feature summaries and is well suited to semantically heterogeneous clients [8]. However, an artistic prototype can itself reveal the styles or media contained in a local collection. Protecting only model parameters while transmitting prototypes, class supports, clipping statistics, or sparse coordinate patterns without protection leaves an incomplete privacy boundary. Conversely, perturbing every transmitted quantity with a fixed noise schedule can cause unacceptable utility loss, particularly for high-dimensional visual encoders.

Communication creates a second difficulty. Visual IoT devices commonly operate through constrained or intermittent uplinks, while modern image encoders contain millions of parameters. Sparsified model perturbation can reduce both message size and the dimensional effect of privacy noise [9]. Independent client-side sparsification, however, can produce incompatible coordinate supports and disclose which parameters are locally important. This complicates secure aggregation, whose purpose is to reveal only an aggregate rather than individual client messages [10]. A practical method must therefore coordinate sparsity without using current unprotected client updates, preserve enough descent information for convergence, and account for the privacy cost of every released statistic.

This paper proposes FedArtSense, a privacy-preserving federated learning framework for artistic image classification in visual IoT sensor networks. FedArtSense first introduces dual-space prototype guidance. A feature-space margin aligns local image representations with protected global class prototypes while preserving inter-class separation, and a decision-space consistency loss aligns the classification head with prototype-induced semantic probabilities. A locally calculated representation discrepancy determines the alignment strength for each client, allowing strongly shifted sensors to receive greater guidance without over-regularizing clients that are already consistent with the global model.

FedArtSense next provides a unified client-level privacy mechanism for model updates, prototype numerators, class-support values, and clipping feedback. Update and prototype contributions are separately clipped, perturbed through distributed Gaussian noise, and released only through secure aggregation. Private quantile feedback adjusts the clipping thresholds, while a progress-aware scheduler allocates more precise updates to later refinement rounds. Privacy loss is accumulated through Rényi differential privacy, following the composition principle in [11]. The design extends adaptive clipping [12] and time-adaptive privacy spending [13] to a joint model-and-prototype transcript.

To reduce uplink cost, the server constructs a shared sparse support from previously released protected aggregates. Each coordinate receives an importance score based on persistent update magnitude, directional consistency, and staleness. Most positions exploit coordinates with strong historical contributions, while a smaller exploration subset prevents permanent exclusion. Since the mask for round t depends only on protected information released before that round, it does not expose the structure of a current private update. All participating clients transmit the same ordered support, making the sparse messages directly compatible with secure aggregation. The compression ratio is adapted using protected optimization progress and the available communication budget.

The contributions of this work are fourfold. First, it formulates distributed artistic style and medium classification as a client-level private learning problem for visual IoT sensors, explicitly considering label skew and persistent acquisition-domain shift. Second, it develops heterogeneity-aware dual-space prototype learning in which semantic references, their supports, and model updates are protected within one privacy budget. Third, it introduces privacy-safe importance-aware sparsification that coordinates client supports without accessing current unprotected updates. The analysis establishes transcript-level $(ϵ,\delta )$-differential privacy and characterizes convergence in terms of stochastic variation, client heterogeneity, clipping bias, prototype drift, retained projection energy, and privacy noise. Fourth, it evaluates the complete framework on WikiArt [14], ArtBench-10 [15], and BAM [4] under non-IID visual IoT partitions, sensor-domain shifts, bandwidth heterogeneity, and client dropout.

At the default client-level privacy target $(ϵ,\delta )=(6,{10}^{-5})$, FedArtSense obtains accuracies of $64.2\%$, $81.2\%$, and $75.3\%$ on WikiArt, ArtBench-10, and BAM, respectively. Our results exceed Fed-SMP by $4.8$, $4.4$, and $4.1$ percentage points. On WikiArt, FedArtSense reduces cumulative uplink traffic from $87.1$ GiB for dense private averaging to $11.5$ GiB and reaches $95\%$ of its final validation accuracy in 121 rounds. Our results alse further show a client-membership attack area under the curve of $0.508$, close to random guessing. The ablation, privacy-utility, sensor-shift, and edge-device results indicate that the improvement arises from the interaction of protected prototype alignment, adaptive privacy control, and coordinated sparse aggregation rather than from relaxing the stated privacy requirement.

2. Related Work

2.1. Federated Learning Under Statistical and System Heterogeneity

Federated learning enables multiple clients to optimize a shared model without transferring their raw observations to a central repository. FedAvg established the standard iterative pattern of local optimization followed by weighted server aggregation [1]. Its performance can deteriorate when client objectives differ substantially, as occurs when visual IoT sensors observe different artistic styles, media, illumination conditions, and institutional collections. FedProx limits local deviation through a proximal regularizer [5], whereas SCAFFOLD estimates control variates to correct biased client updates [6]. MOON addresses representation inconsistency using model-level contrastive learning [7]. These methods improve general non-IID optimization but do not explicitly construct privacy-protected semantic references for distributed artistic classes.

Prototype-based learning offers a compact alternative to exchanging sample-level representations. FedProto communicates class prototypes to accommodate heterogeneous client models and distributions [8]. More recent studies have expanded knowledge transfer under data and model heterogeneity. FedKTL uses a server-side pretrained generator to produce prototypical image-vector pairs while reducing client upload requirements [16]. FedType introduces proxy models and uncertainty-based asymmetric reciprocity for architecture-heterogeneous clients [17]. Recurrent early-exit models adapt inference and training depth to heterogeneous client resources [18], while FedLMT employs low-rank model training to reduce computation and communication on constrained devices [19]. These approaches primarily address architecture or hardware differences and generally assume that transmitted knowledge summaries do not require a joint client-level privacy guarantee.

Recent federated representation methods also exploit pretrained models and adaptive aggregation. FedPHA learns heterogeneous client prompts for vision–language models [20]. Theoretical analysis has shown that increasing network width can mitigate part of the optimization error induced by heterogeneous data [21]. FedAWARE instead studies client-consensus dynamics and adjusts aggregation weights to improve convergence under heterogeneity [22]. These developments demonstrate that representation sharing and adaptive optimization are complementary. FedArtSense differs by targeting images collected by visual IoT sensors and by combining client-specific dual-space prototype alignment with privacy-protected prototype aggregation. Its feature-space margin preserves artistic category separation, its decision-space loss aligns classifier semantics, and its discrepancy-dependent coefficient avoids imposing the same regularization strength on clients with different levels of drift.

VFL+ treats the feature views held by other parties as privileged training information so that each participant can perform autonomous inference after vertically federated training [23]. This low-coupling objective addresses dependence among parties that share sample identities but hold disjoint features. FedArtSense instead assumes horizontal federation: each institution holds complete images and labels for disjoint samples. Its per-round upload contains $\mathcal{O}(m_t+C(d_z+1))$ protected values after local optimization, whereas vertical methods require sample-aligned cross-party information during training. Resistance to client drift is supplied by discrepancy-scaled feature- and decision-space alignment rather than by privileged feature views. The two mechanisms are complementary in motivation but not directly comparable as numerical baselines because their data partitions, messages, and inference requirements differ.

2.2. Differential Privacy and Communication-Efficient Federation

Keeping images on local sensors does not by itself prevent model updates from revealing information about a participating collection. Differential privacy provides a formal mechanism-level guarantee against such inference [24]. Rényi differential privacy supports tighter accounting for repeated Gaussian mechanisms and subsampled training rounds [11]. Client-level private federated learning protects the presence or absence of a complete client dataset rather than a single record [2], but clipping and Gaussian perturbation can substantially reduce utility when updates are high-dimensional or heterogeneous.

Adaptive clipping estimates an update-norm quantile with a small additional privacy expenditure [12]. Time-adaptive privacy spending further shows that allocating privacy non-uniformly across training rounds can improve late-stage learning [13]. FedCEO recovers part of the semantic information disrupted by privacy noise through low-rank proximal processing of stacked client models [25]. Private heterogeneous federated optimization has also been studied without a trusted server, with error-optimal results established for convex inter-silo objectives [26]. These methods motivate adaptive privacy control, but they do not jointly calibrate private model updates, class-support values, and artistic prototypes within one transcript-level budget [27,28].

Secure aggregation prevents an honest-but-curious coordinator from inspecting individual client messages [10]. It complements differential privacy because secure aggregation hides intermediate contributions, whereas differential privacy protects released aggregates and final models. Fed-SMP combines client-level differential privacy with sparsified model perturbation to reduce both communication and perturbation dimension [9]. Exact-error compression provides another connection between distributed quantization and privacy noise [29]. Lossless gradient sparsification maps updates into a more compressible alternative space [30], while recent low-rank decomposition methods reduce communication through structured factorization [31]. FedSMU represents model changes through symbolic updates to improve communication efficiency and generalization [32]. FedSC privately exchanges representation correlation matrices for federated self-supervised learning [33].

Transmission-oriented protection addresses a different boundary. Hyperchaotic memristive encryption with DNA encoding can protect images while they are exchanged, but an authorized endpoint still receives decryptable pixels and assumes responsibility for centralized storage and analysis [34]. Reversible adversarial protection such as DP-TRAE can obscure a raw image from unauthorized models while permitting key-based recovery [35]. These mechanisms are practical when an institution accepts centralized, authorized access but wants confidentiality in transit or storage. Federated learning instead avoids raw-image transfer and produces a shared classifier; secure aggregation hides individual messages and differential privacy limits the influence of one client on the released transcript. Encryption or reversible perturbation can be layered before local storage, but they do not replace transcript-level privacy accounting.

A persistent difficulty is that independently selected sparse supports can expose client-specific structure or become incompatible with fixed-vector secure aggregation. FedArtSense constructs one shared importance mask from previously released protected aggregates, so current-round coordinate selection does not depend on unprotected client data. Temporal magnitude, directional consistency, and staleness jointly determine the mask, while an exploration subset prevents permanent coordinate exclusion. Unlike approaches that protect only model updates, the proposed privacy accountant composes the model mechanism, prototype mechanism, and private clipping statistics. This design provides a single client-level guarantee for the complete released transcript.

2.3. Computational Analysis of Artistic Images

Computational art analysis differs from ordinary photographic recognition because artistic images can depart from natural geometry, texture, color, and object appearance. Early large-scale work showed that learned visual features can identify photographic and artistic styles across diverse sources [3]. Residual networks were subsequently applied to artistic-style recognition on large painting collections [36]. The WikiArt task organization used by ArtGAN provides artist, genre, and style classification metadata for historical artworks [14]. BAM extends artistic analysis to contemporary creative media and supplies content, emotion, and medium attributes [4]. ArtBench-10 provides a balanced and standardized benchmark spanning ten artistic styles [15].

Recent research has broadened artistic image analysis beyond style classification. LAPIS introduces artwork images, aesthetic ratings, image attributes, and annotator attributes for personalized aesthetic assessment [37]. NADA uses vision–language and diffusion-model knowledge to detect objects in paintings with weak or zero bounding-box supervision [38]. These studies highlight the growing diversity of artwork-analysis tasks, but their conventional settings assume that the images can be collected and processed centrally.

Visual IoT deployments introduce a different constraint: cameras and institutional gateways collect artworks at distributed physical locations, and the resulting images may expose collection contents or exhibition context. Existing artistic image methods do not provide client-level privacy for distributed sensor collections, while general private federated methods do not model the unusually strong style and medium shifts found in art. FedArtSense connects these areas by treating artistic images as private sensor observations, aligning heterogeneous local representations through protected prototypes, and reducing uplink traffic through a secure-aggregation-compatible shared sparse support.

3. Preliminaries

3.1. Visual IoT Sensor Network and Learning Task

We consider a visual IoT network composed of K distributed clients, denoted by $\mathcal{K}=\{1,\dots ,K\}$. The evaluated client is an institution-controlled edge gateway or local server connected to fixed RGB documentation or surveillance cameras; visitor-owned devices, hyperspectral conservation scanners, and direct training on a battery-powered camera are outside scope. Client k stores an artistic image dataset ${\mathcal{D}}_k={\left\{({\mathbf{x}}_{k,i},y_{k,i})\right\}}_{i=1}^{n_k}$, where ${\mathbf{x}}_{k,i}\in {\mathbb{R}}^{H\times W\times 3}$ is an RGB image, $y_{k,i}\in \mathcal{Y}=\{1,\dots ,C\}$ is a style or medium label, and $n_k=\left|{\mathcal{D}}_k\right|$. Source frames may be captured at $1920\times 1080$ pixels or higher, but local preprocessing produces a $224\times 224$ model input. Frames are acquired event-wise or at intervals of 5–30 s and buffered locally; federated rounds are periodic gateway jobs rather than frame-synchronous updates. Camera-to-gateway connectivity is local Ethernet or Wi-Fi, while the modeled gateway-to-server uplinks are $0.8$, 3, and 8 Mbit/s. The total sample size is $n={\sum }_{k=1}^K{n}_k$, and the statistical weight of client k is $p_k=n_k/n$.

Raw images remain within the administrative boundary of the client that collected them. Only privacy-protected learning information can be exchanged with the coordinating edge server. This restriction is important because an artistic image may reveal private collection contents, artwork ownership, exhibition arrangements, acquisition activities, or contextual information captured around the artwork. The coordinating server is assumed to be honest in executing the prescribed protocol but curious about the information contained in client messages. External observers may also inspect the released global models. The communication channels are authenticated, while secure aggregation is used to prevent the server from observing an individual client’s unprotected contribution.

The local data are generally non-independent and non-identically distributed. Different sensors may observe distinct artistic movements, creators, exhibition themes, illumination conditions, viewpoints, and imaging devices. Let ${\mathcal{C}}_k\subseteq \mathcal{Y}$ denote the set of classes observed by client k, and let $n_{k,c}$ be the number of its images belonging to class c. The local class proportion is $q_{k,c}=n_{k,c}/n_k$, whereas the global class proportion is $q_c={\sum }_{k=1}^K{p}_k{q}_{k,c}$. Therefore, both label-distribution skew and appearance-domain shift can occur simultaneously. We write the local data distribution as $P_k(\mathbf{x},y)$ and do not assume that $P_k=P_j$ for two distinct clients k and j. The model is parameterized by $\mathit{\theta }=(\mathit{\omega },\mathit{\varphi })$, where $g_{\mathit{\omega }}$ is an image encoder and $h_{\mathit{\varphi }}$ is a classification head. For an input image $\mathbf{x}$, the prediction is $f_{\mathit{\theta }}\left(\mathbf{x}\right)=h_{\mathit{\varphi }}\left(g_{\mathit{\omega }}\left(\mathbf{x}\right)\right)$. The encoder output is normalized as $\mathbf{z}=g_{\mathit{\omega }}\left(\mathbf{x}\right)/{\parallel g_{\mathit{\omega }}\left(\mathbf{x}\right)\parallel }_2$, which makes representations produced by different clients comparable. The evaluated task is exclusively C-class artistic image classification.

3.2. Federated Optimization and Prototype Representation

Let $\mathsf{\ell }(f_{\mathit{\theta }}\left(\mathbf{x}\right),y)$ denote the supervised cross-entropy loss. The empirical risk of client k and the global federated objective are

$$F_k\left(\mathit{\theta }\right)={\displaystyle \frac{1}{n_k}}{\displaystyle \sum _{i=1}^{n_k}}\mathsf{\ell }\left(f_{\mathit{\theta }}\left({\mathbf{x}}_{k,i}\right),y_{k,i}\right),{\mathit{\theta }}^{*}=arg\underset{\mathit{\theta }}{min}F\left(\mathit{\theta }\right),F\left(\mathit{\theta }\right)={\displaystyle \sum _{k=1}^K}{p}_k{F}_k\left(\mathit{\theta }\right).$$

(1)

Training proceeds for T communication rounds. At the beginning of round t, the server holds the global parameters ${\mathit{\theta }}^t$ and selects a participating client set ${\mathcal{S}}_t\subseteq \mathcal{K}$. Each selected client initializes its local model with ${\mathit{\theta }}^t$ and performs E local epochs using learning rate $\eta$. The resulting local parameters are denoted by ${\mathit{\theta }}_k^{t,E}$, and the corresponding model update is ${\mathbf{\Delta }}_k^t={\mathit{\theta }}_k^{t,E}-{\mathit{\theta }}^t$. For selected-client normalization, the aggregation weight is $p_{k,t}=n_k/{\sum }_{j\in {\mathcal{S}}_t}{n}_j$. Conventional weighted aggregation can be expressed as

$${\mathit{\theta }}^{t+1}={\mathit{\theta }}^t+\sum _{k\in {\mathcal{S}}_t}{p}_{k,t}{\mathbf{\Delta }}_k^t.$$

(2)

Under severe statistical heterogeneity, however, minimizing each $F_k$ independently can move local representations toward incompatible optima. This phenomenon is especially pronounced when a sensor observes only a small subset of artistic styles. Consequently, the proposed method augments the task loss with prototype-guided representation alignment while retaining Equation (1) as the underlying learning problem.

For each observed class $c\in {\mathcal{C}}_k$, client k summarizes its local representation space using the class prototype

$${\mathit{\mu }}_{k,c}^t={\displaystyle \frac{{\displaystyle {\displaystyle \sum _{i=1}^{n_k}}\mathbb{I}(y_{k,i}=c){\mathbf{z}}_{k,i}^t}}{{\displaystyle n_{k,c}}}},{\mathbf{z}}_{k,i}^t={\displaystyle \frac{g_{{\omega }_k^{t,E}}\left({\mathbf{x}}_{k,i}\right)}{{∥g_{{\omega }_k^{t,E}}\left({\mathbf{x}}_{k,i}\right)∥}_2}}.$$

(3)

Here, $\mathbb{I}(·)$ is the indicator function. A prototype is not constructed when $n_{k,c}=0$. Let ${\mathcal{S}}_{t,c}=\{k\in {\mathcal{S}}_t:c\in {\mathcal{C}}_k\}$ be the clients that observe class c in round t. Before privacy protection, their weighted reference prototype would be

$${\overline{\mathit{\mu }}}_c^t={\displaystyle \frac{{\displaystyle \sum _{k\in {\mathcal{S}}_{t,c}}{n}_{k,c}{\mathit{\mu }}_{k,c}^t}}{{\displaystyle \sum _{k\in {\mathcal{S}}_{t,c}}{n}_{k,c}}}}.$$

(4)

These class-level summaries contain substantially fewer dimensions than the complete model, but they can still reveal properties of a local collection. They must therefore be incorporated into the same privacy-protected communication mechanism as the model updates. In the remainder of the paper, ${\widehat{\mathbf{\Delta }}}_k^t$ and ${\widehat{\mathit{\mu }}}_{k,c}^t$ denote a protected update and a protected prototype, respectively.

3.3. Privacy and Communication Criteria

The privacy target is defined at the client level. Two federated datasets $\mathbb{D}=\{{\mathcal{D}}_1,\dots ,{\mathcal{D}}_K\}$ and ${\mathbb{D}}^{\prime }$ are adjacent, written as $\mathbb{D}\simeq {\mathbb{D}}^{\prime }$, if one can be obtained from the other by adding or removing the complete dataset of one client. This definition protects whether an institution or sensor collection participated in training, including all artistic images associated with that participant. A randomized federated mechanism $\mathcal{M}$ satisfies $(ϵ,\delta )$-client-level differential privacy if, for every adjacent pair $\mathbb{D}\simeq {\mathbb{D}}^{\prime }$ and every measurable output set $\mathcal{O}$,

$$Pr[\mathcal{M}\left(\mathbb{D}\right)\in \mathcal{O}]\le e^{ϵ}Pr[\mathcal{M}\left({\mathbb{D}}^{\prime }\right)\in \mathcal{O}]+\delta ,$$

(5)

where $ϵ$ controls the privacy loss and $\delta$ bounds the probability of exceptional disclosure. A smaller $ϵ$ indicates stronger privacy for a fixed $\delta$.

To bound the contribution of a selected client, an update vector $\mathbf{v}$ is projected onto an ${\mathsf{\ell }}_2$ ball using $Clip(\mathbf{v},R)=\mathbf{v}min\{1,R/\parallel \mathbf{v}{\parallel }_2\}$, where $R>0$ is the clipping threshold. A Gaussian mechanism releases a clipped aggregate perturbed by zero-mean noise whose standard deviation is proportional to R. FedArtSense uses round-dependent thresholds $R_t$ and noise multipliers ${\sigma }_t$ so that privacy resources follow training sensitivity rather than being assigned uniformly.

Privacy accumulation is tracked through Rényi differential privacy. At Rényi order $\lambda >1$, let ${\rho }_t\left(\lambda \right)$ denote the privacy cost of round t. Adaptive composition gives ${\rho }_{1:T}\left(\lambda \right)={\sum }_{t=1}^T{\rho }_t\left(\lambda \right)$. For any chosen $\delta \in (0,1)$, the corresponding privacy bound is

$$ϵ=\underset{\lambda >1}{min}\left\{{\rho }_{1:T}\left(\lambda \right)+{\displaystyle \frac{log(1/\delta )}{\lambda -1}}\right\}.$$

(6)

Client subsampling is included in ${\rho }_t\left(\lambda \right)$, with participation rate $r_t=\left|{\mathcal{S}}_t\right|/K$. The complete released transcript, including the sequence of global models and global class prototypes, is accounted for within the same total privacy budget $(ϵ,\delta )$.

Communication efficiency is evaluated by the number of transmitted bits rather than only by the number of rounds. Let $d=\left|\mathit{\theta }\right|$ be the model dimension, $m_k^t$ be the number of update coordinates transmitted by client k in round t, and b be the bit width of each retained value. Encoding an index requires $\lceil {log}_{2}d\rceil$ bits. If $B_{\mathrm{proto}}$ denotes the total cost of transmitting protected prototypes and their class identifiers, the overall client-to-server communication cost is

$$B_{\mathrm{total}}={\displaystyle \sum _{t=0}^{T-1}}\sum _{k\in {\mathcal{S}}_t}{m}_k^t\left(b+⌈{log}_{2}d⌉\right)+B_{\mathrm{proto}}.$$

(7)

The compression ratio is ${\gamma }_k^t=m_k^t/d$. The methodology uses importance-aware sparsification to reduce ${\gamma }_k^t$ while preserving coordinates that contribute most strongly to global optimization. Accordingly, the learning problem is evaluated through predictive performance, robustness to heterogeneous client distributions, cumulative client-level privacy loss, and total communication cost.

4. Methodology

4.1. FedArtSense Overview and Prototype-Guided Local Learning

FedArtSense jointly addresses statistical heterogeneity, privacy leakage, and communication constraints in visual IoT sensor networks. Figure 1 shows a general pipeline of our proposal. Museums, galleries, and heritage sites retain camera frames and labels on institution-controlled gateways while exchanging only protected sparse model and prototype messages. The round-level pipeline combines discrepancy-adaptive dual-space learning, joint clipping and distributed noise, survivor-gated secure aggregation, and privacy-accounted server adaptation. The displayed equations summarize the local objective, protected client message, and global model update. Figure 1 and Figure 2 show the general pipeline and application scenario of our proposal.

Each communication round contains four coupled operations: prototype-guided local optimization, adaptive privacy protection, importance-aware update sparsification, and secure server aggregation. At the beginning of round t, the server broadcasts the current global model ${\mathit{\theta }}^t$ and a protected global prototype set ${\widehat{\mathcal{P}}}^t=\{{\widehat{\overline{\mathit{\mu }}}}_c^t:c\in {\mathcal{G}}_t\}$, where ${\mathcal{G}}_t\subseteq \mathcal{Y}$ contains the classes for which a global reference prototype is available. At $t=0$, ${\widehat{\mathcal{P}}}^0$ is empty, and clients perform one warm-up round using only the supervised task objective. The principal difficulty of artistic image learning in distributed sensor networks is that clients can have substantially different visual and label distributions. Directly minimizing local empirical risk can consequently produce incompatible representation spaces. FedArtSense addresses this problem by aligning each local representation with protected class-level knowledge rather than transferring raw images or sample-level features.

Before local optimization, client k uses the received encoder $g_{{\omega }^t}$ to compute an initial prototype for every locally observed class. For $c\in {\mathcal{C}}_k$, this prototype is

$$\begin{array}{cccc}\hfill {\mathit{\nu }}_{k,c}^t& ={\displaystyle \frac{{\displaystyle {\displaystyle \sum _{i=1}^{n_k}}\mathbb{I}(y_{k,i}=c){\mathbf{z}}_{k,i}^{t,0}}}{{\displaystyle {∥{\displaystyle \sum _{i=1}^{n_k}}\mathbb{I}(y_{k,i}=c){\mathbf{z}}_{k,i}^{t,0}∥}_2+\upsilon }}},\hfill & \hfill {\mathbf{z}}_{k,i}^{t,0}& ={\displaystyle \frac{g_{{\omega }^t}\left({\mathbf{x}}_{k,i}\right)}{{\parallel g_{{\omega }^t}\left({\mathbf{x}}_{k,i}\right)\parallel }_2+\upsilon }}.\hfill \end{array}$$

(8)

The initial prototypes are retained locally and are not transmitted. Let ${\mathcal{A}}_k^t={\mathcal{C}}_k\cap {\mathcal{G}}_t$ denote the set of classes shared by the local dataset and the protected global prototype set. FedArtSense measures the client-specific representation discrepancy as

$$d_k^t=\left\{\begin{array}{cc}{\displaystyle \frac{1}{|{\mathcal{A}}_k^t|}\sum _{c\in {\mathcal{A}}_k^t}\frac{1-{\left({\mathit{\nu }}_{k,c}^t\right)}^{\top }{\widehat{\overline{\mathit{\mu }}}}_c^t}{2},}\hfill & |{\mathcal{A}}_k^t|>0,\hfill \\ 0,\hfill & |{\mathcal{A}}_k^t|=0.\hfill \end{array}\right.$$

(9)

Because both vectors are ${\mathsf{\ell }}_2$-normalized, $d_k^t\in [0,1]$. A value close to zero indicates that local and global class representations are already consistent, whereas a larger value indicates stronger client drift. The discrepancy remains on the client and therefore creates no additional communication or privacy cost.

A fixed prototype regularization strength may over-constrain clients whose distributions are already close to the global model and under-correct clients with severe domain shift. FedArtSense instead introduces the heterogeneity-aware coefficient

$${\beta }_k^t={\beta }_{max}{\displaystyle \frac{d_k^t}{d_k^t+\xi }},$$

(10)

where ${\beta }_{max}>0$ is the maximum alignment strength and $\xi >0$ controls its sensitivity. During the warm-up round or when ${\mathcal{A}}_k^t$ is empty, ${\beta }_k^t=0$.

For a local mini-batch ${\mathcal{B}}_{k,e}^t$ at local step e, the supervised classification loss is

$${\mathcal{L}}_{\mathrm{task},k}^t=-{\displaystyle \frac{1}{|{\mathcal{B}}_{k,e}^t|}}\sum _{(\mathbf{x},y)\in {\mathcal{B}}_{k,e}^t}log{p}_{\mathit{\theta }}(y\mid \mathbf{x}),$$

(11)

where $p_{\mathit{\theta }}(c\mid \mathbf{x})$ is the softmax output of $f_{\mathit{\theta }}$. To align the encoder without collapsing visually distinct artistic categories, FedArtSense employs a margin-based prototype loss. Let $\mathbf{z}=g_{\omega }\left(\mathbf{x}\right)/(\parallel g_{\omega }\left(\mathbf{x}\right){\parallel }_2+\upsilon )$, let ${\left[a\right]}_{+}=max(0,a)$, and let $m>0$ be a cosine margin. For a sample whose label y belongs to ${\mathcal{G}}_t$, its feature-space alignment loss is

$$\begin{array}{cc}\hfill {\mathcal{L}}_{\mathrm{feat}}(\mathbf{x},y)& =1-{\mathbf{z}}^{\top }{\widehat{\overline{\mathit{\mu }}}}_y^t\hfill \\ \hfill & +{\displaystyle \frac{1}{|{\mathcal{G}}_t|-1}}\sum _{\begin{array}{c}c\in {\mathcal{G}}_t\\ c\ne y\end{array}}{\left[m+{\mathbf{z}}^{\top }{\widehat{\overline{\mathit{\mu }}}}_c^t-{\mathbf{z}}^{\top }{\widehat{\overline{\mathit{\mu }}}}_y^t\right]}_{+}.\hfill \end{array}$$

(12)

The first term attracts an image representation toward the protected prototype of its true class. The second requires the true-class similarity to exceed every available competing-class similarity by at least m. This construction is useful for artistic categories with similar color palettes or compositional structures, for which simple attraction may not produce sufficiently discriminative features.

Feature alignment alone does not guarantee that the local classification head interprets shared representation geometry consistently. Given temperature $\tau >0$, the protected prototypes define the reference posterior:

$$r_t(c\mid \mathbf{z})={\displaystyle \frac{exp\left({\mathbf{z}}^{\top }{\widehat{\overline{\mathit{\mu }}}}_c^t/\tau \right)}{{\displaystyle \sum _{j\in {\mathcal{G}}_t}exp\left({\mathbf{z}}^{\top }{\widehat{\overline{\mathit{\mu }}}}_j^t/\tau \right)}}},c\in {\mathcal{G}}_t.$$

(13)

The local model posterior is restricted and renormalized over the same class set as

$${\tilde{p}}_{\mathit{\theta }}(c\mid \mathbf{x})={\displaystyle \frac{p_{\mathit{\theta }}(c\mid \mathbf{x})}{{\displaystyle \sum _{j\in {\mathcal{G}}_t}{p}_{\mathit{\theta }}(j\mid \mathbf{x})}}},c\in {\mathcal{G}}_t.$$

(14)

The decision-space consistency loss is

$${\mathcal{L}}_{\mathrm{dec}}\left(\mathbf{x}\right)=\sum _{c\in {\mathcal{G}}_t}sg\left[r_t(c\mid \mathbf{z})\right]log{\displaystyle \frac{sg\left[r_t(c\mid \mathbf{z})\right]}{{\tilde{p}}_{\mathit{\theta }}(c\mid \mathbf{x})}},$$

(15)

where $sg[·]$ is the stop-gradient operator. It prevents the reference posterior from moving toward an incorrect local prediction during the same optimization step. Equations (12) and (15) form a dual-space alignment mechanism: the former preserves class geometry in the encoder space, while the latter transfers that geometry to the classifier output.

For samples whose labels do not yet have global prototypes, both alignment terms are set to zero. Averaging the valid terms within ${\mathcal{B}}_{k,e}^t$ gives ${\mathcal{L}}_{\mathrm{feat},k}^t$ and ${\mathcal{L}}_{\mathrm{dec},k}^t$. The complete local objective is

$${\mathcal{L}}_k^t\left(\mathit{\theta }\right)={\mathcal{L}}_{\mathrm{task},k}^t+{\beta }_k^t\left({\mathcal{L}}_{\mathrm{feat},k}^t+\chi {\mathcal{L}}_{\mathrm{dec},k}^t\right)+{\displaystyle \frac{{\lambda }_{\mathrm{prox}}}{2}}{∥\mathit{\theta }-{\mathit{\theta }}^t∥}_2^2,$$

(16)

where $\chi \ge 0$ balances feature-space and decision-space alignment, and ${\lambda }_{\mathrm{prox}}\ge 0$ limits excessive local deviation. Starting from ${\mathit{\theta }}_k^{t,0}={\mathit{\theta }}^t$, the client performs

$${\mathit{\theta }}_k^{t,e+1}={\mathit{\theta }}_k^{t,e}-\eta {\nabla }_{\mathit{\theta }}{\mathcal{L}}_k^t\left({\mathit{\theta }}_k^{t,e}\right),e=0,\dots ,E_k^t-1.$$

(17)

The number of local steps $E_k^t$ may vary with the available computing capacity of client k. After optimization, the client obtains ${\Delta }_k^t={\mathit{\theta }}_k^{t,E_k^t}-{\mathit{\theta }}^t$ and constructs final local prototypes using Equation (3). These outputs are processed by the privacy and communication modules before leaving the client.

4.2. Adaptive Client-Level Privacy Protection

The local model update ${\mathbf{\Delta }}_k^t$ and class prototypes ${\left\{{\mathit{\mu }}_{k,c}^t\right\}}_{c\in {\mathcal{C}}_k}$ contain information about the artistic images observed by client k. FedArtSense protects both types of information under the client-level adjacency relation defined in Section 3.3. The mechanism combines adaptive contribution clipping, distributed Gaussian perturbation, private threshold calibration, and Rényi privacy accounting. All adaptation variables used in round t are derived from previously released private statistics; consequently, their use does not introduce an unaccounted dependence on the current private dataset.

For model aggregation, the contribution of client k is weighted by $p_{k,t}$ and bounded using the round-dependent threshold $R_{\Delta }^t$:

$${\mathbf{u}}_{k,\Delta }^t=Clip\left(p_{k,t}{\mathbf{\Delta }}_k^t,R_{\Delta }^t\right)=p_{k,t}{\mathbf{\Delta }}_k^{t}min\left\{1,{\displaystyle \frac{R_{\Delta }^t}{\parallel p_{k,t}{\mathbf{\Delta }}_k^t{\parallel }_2}}\right\}.$$

(18)

It follows that ${\parallel {\mathbf{u}}_{k,\Delta }^t\parallel }_2\le R_{\Delta }^t$. A public coordinate projection ${\mathbf{P}}^t\in {\{0,1\}}^{m_t\times d}$ retains $m_t$ model coordinates selected from information released before round t. Its construction is presented in Section 4.3. Because ${\mathbf{P}}^t$ is independent of the current round’s private data and satisfies $\parallel {\mathbf{P}}^t{\mathbf{v}\parallel }_2\le {\parallel \mathbf{v}\parallel }_2$, projection does not increase sensitivity.

The prototype payload preserves the numerator and denominator required to construct a weighted global class prototype. Client k defines $q_{k,c}=n_{k,c}/n_k$ for $c\in {\mathcal{C}}_k$ and sets $q_{k,c}=0$ otherwise. Its weighted payload is

$${\mathbf{v}}_k^t=vec\left({\left\{p_{k,t}{q}_{k,c}{\mathit{\mu }}_{k,c}^t,p_{k,t}{q}_{k,c}\right\}}_{c=1}^C\right),$$

(19)

where $vec(·)$ concatenates the class-wise prototype numerators and supports. Support values are protected because an unprotected class count could disclose which artistic styles or media are present in a collection. The bounded prototype contribution is

$${\mathbf{u}}_{k,P}^t=Clip({\mathbf{v}}_k^t,R_P^t),$$

(20)

where $R_P^t>0$ is the prototype clipping threshold.

Thresholds that are unnecessarily large increase noise, whereas thresholds that are too small introduce clipping bias. FedArtSense calibrates $R_{\Delta }^t$ and $R_P^t$ toward a target unclipped fraction $q^{*}\in (0,1)$. Each participating client computes

$$\begin{array}{cc}\hfill a_{k,\Delta }^t& =\mathbb{I}\left(\parallel p_{k,t}{\mathbf{\Delta }}_k^t{\parallel }_2\le R_{\Delta }^t\right),\hfill \\ \hfill a_{k,P}^t& =\mathbb{I}\left(\parallel {\mathbf{v}}_k^t{\parallel }_2\le R_P^t\right).\hfill \end{array}$$

(21)

These binary values are securely aggregated and perturbed before release. Let $M_t=\left|{\mathcal{S}}_t\right|$ and let ${\zeta }_{\Delta }^t$ and ${\zeta }_P^t$ be Gaussian random variables generated through distributed noise shares. The released unclipped-fraction estimates are

$$\begin{array}{cc}\hfill {\tilde{q}}_{\Delta }^t& ={clip}_{[0,1]}\left({\displaystyle \frac{{\sum }_{k\in {\mathcal{S}}_t}{a}_{k,\Delta }^t+{\zeta }_{\Delta }^t}{M_t}}\right),\hfill \\ \hfill {\tilde{q}}_P^t& ={clip}_{[0,1]}\left({\displaystyle \frac{{\sum }_{k\in {\mathcal{S}}_t}{a}_{k,P}^t+{\zeta }_P^t}{M_t}}\right).\hfill \end{array}$$

(22)

With adaptation rate ${\kappa }_R>0$, the thresholds used in the next round are updated in the logarithmic domain:

$$\begin{array}{cc}\hfill R_{\Delta }^{t+1}& ={clip}_{[R_{\Delta }^{min},R_{\Delta }^{max}]}\left[R_{\Delta }^{t}exp\left({\kappa }_R(q^{*}-{\tilde{q}}_{\Delta }^t)\right)\right],\hfill \\ \hfill R_P^{t+1}& ={clip}_{[R_P^{min},R_P^{max}]}\left[R_P^{t}exp\left({\kappa }_R(q^{*}-{\tilde{q}}_P^t)\right)\right].\hfill \end{array}$$

(23)

Thus, a low observed unclipped fraction increases the threshold, while a high fraction tightens the sensitivity bound.

FedArtSense adopts distributed Gaussian perturbation so that the server observes only noisy sums through secure aggregation. Let $M_{min}$ be the minimum number of clients required to complete a round. Each participating client generates independent noise shares

$$\begin{array}{cc}\hfill {\mathbf{z}}_{k,\Delta }^t& \sim \mathcal{N}\left(\mathbf{0},{\displaystyle \frac{{\left({\sigma }_{\Delta }^t{R}_{\Delta }^t\right)}^2}{M_{min}}}{\mathbf{I}}_{m_t}\right),\hfill \\ \hfill {\mathbf{z}}_{k,P}^t& \sim \mathcal{N}\left(\mathbf{0},{\displaystyle \frac{{\left({\sigma }_P^t{R}_P^t\right)}^2}{M_{min}}}{\mathbf{I}}_{C(d_z+1)}\right),\hfill \end{array}$$

(24)

where $d_z$ is the feature dimension and ${\sigma }_{\Delta }^t$ and ${\sigma }_P^t$ are round-dependent noise multipliers. Protected contributions supplied to secure aggregation are

$$\begin{array}{cc}\hfill {\widehat{\mathbf{\Delta }}}_k^t& ={\mathbf{P}}^t{\mathbf{u}}_{k,\Delta }^t+{\mathbf{z}}_{k,\Delta }^t,\hfill \\ \hfill {\widehat{\mathbf{v}}}_k^t& ={\mathbf{u}}_{k,P}^t+{\mathbf{z}}_{k,P}^t.\hfill \end{array}$$

(25)

If at least $M_{min}$ clients complete the protocol, aggregate noise covariance is no smaller than ${\left({\sigma }_{\Delta }^t{R}_{\Delta }^t\right)}^2{\mathbf{I}}_{m_t}$ for the model and ${\left({\sigma }_P^t{R}_P^t\right)}^2{\mathbf{I}}_{C(d_z+1)}$ for the prototype payload. A round is aborted without releasing an aggregate when fewer than $M_{min}$ noise shares are available.

A fixed noise multiplier assigns equal privacy expenditure to early unstable rounds and late refinement rounds. FedArtSense instead adjusts per-round expenditure using a convergence signal calculated from previously released private global models. For $t\ge 1$, the public progress score is

$$g_t={\displaystyle \frac{\parallel {\mathit{\theta }}^t-{\mathit{\theta }}^{t-1}{\parallel }_2}{{\parallel {\mathit{\theta }}^{t-1}\parallel }_2+\upsilon }},{\overline{g}}_t=\varrho {\overline{g}}_{t-1}+(1-\varrho )g_t,$$

(26)

where $\upsilon >0$ prevents division by zero and $\varrho \in [0,1)$. Let ${\rho }_{\mathrm{rem}}^t\left(\lambda \right)$ be the remaining Rényi privacy budget at order $\lambda$. The target expenditure is

$${\rho }_{\mathrm{tar}}^t\left(\lambda \right)=min\left\{{\rho }_{max}\left(\lambda \right),{\displaystyle \frac{{\rho }_{\mathrm{rem}}^t\left(\lambda \right)}{T-t}}{clip}_{[a_{min},a_{max}]}\left({\displaystyle \frac{{\overline{g}}_t+\upsilon }{g_t+\upsilon }}\right)\right\}.$$

(27)

Smaller late-stage model movement therefore receives a larger Rényi allocation and a smaller noise multiplier, while the privacy filter prevents cumulative expenditure from exceeding the prescribed total budget.

The target cost is divided among the model update, prototype payload, and two clipping-statistic mechanisms using shares ${\pi }_{\Delta }$, ${\pi }_P$, and ${\pi }_q$, where ${\pi }_{\Delta }+{\pi }_P+2{\pi }_q=1$. Let ${\mathcal{A}}_{\mathrm{SGM}}(\lambda ,r_t,\sigma )$ denote the Rényi cost of a client-subsampled Gaussian mechanism. The multipliers are the smallest values satisfying

$$\begin{array}{cc}\hfill {\mathcal{A}}_{\mathrm{SGM}}(\lambda ,r_t,{\sigma }_{\Delta }^t)& \le {\pi }_{\Delta }{\rho }_{\mathrm{tar}}^t\left(\lambda \right),\hfill \\ \hfill {\mathcal{A}}_{\mathrm{SGM}}(\lambda ,r_t,{\sigma }_P^t)& \le {\pi }_P{\rho }_{\mathrm{tar}}^t\left(\lambda \right),\hfill \\ \hfill {\mathcal{A}}_{\mathrm{SGM}}(\lambda ,r_t,{\sigma }_q^t)& \le {\pi }_q{\rho }_{\mathrm{tar}}^t\left(\lambda \right).\hfill \end{array}$$

(28)

The multiplier ${\sigma }_q^t$ controls each noisy clipping indicator. In practice, these inequalities are solved over a fixed grid of Rényi orders. At order $\lambda >1$, the privacy cost of round t is bounded by

$$\begin{array}{cc}\hfill {\rho }_t\left(\lambda \right)& ={\mathcal{A}}_{\mathrm{SGM}}(\lambda ,r_t,{\sigma }_{\Delta }^t)+{\mathcal{A}}_{\mathrm{SGM}}(\lambda ,r_t,{\sigma }_P^t)\hfill \\ \hfill & +2{\mathcal{A}}_{\mathrm{SGM}}(\lambda ,r_t,{\sigma }_q^t).\hfill \end{array}$$

(29)

Adaptive composition remains valid because the thresholds, projection matrices, and multipliers for round t depend only on previously released differentially private outputs. After T rounds, all released global models, protected prototypes, clipping statistics, and deterministic post-processing operations satisfy $(ϵ,\delta )$-client-level differential privacy with

$$ϵ=\underset{\lambda >1}{min}\left\{{\displaystyle \sum _{t=0}^{T-1}}{\rho }_t\left(\lambda \right)+{\displaystyle \frac{log(1/\delta )}{\lambda -1}}\right\}.$$

(30)

This bound covers the complete training transcript rather than only the final global model.

The subsampled-Gaussian Rényi kernel follows the analytical bound of Wang et al. [39]. The public implementation will expose the per-round sampling rate and noise multipliers and include constant-schedule regression tests against the Opacus RDP accountant [40]. The shares $({\pi }_{\Delta },{\pi }_P,{\pi }_q)=(0.72,0.18,0.05)$ are a fixed heuristic rather than a dataset-specific optimum: $90\%$ of each round’s Rényi allocation is assigned to the model and prototype vectors, and the remaining $10\%$ is divided between the two clipping indicators.

Client-level differential privacy applies jointly to the temporal sequence of models, noisy class supports, and protected prototypes, including an adversary with auxiliary information. It limits the additional evidence attributable to one client’s participation, but it does not conceal population-level facts shared by many clients. A long prototype sequence can therefore reveal that a style or medium is common across the federation even when no individual collection is identifiable. The support threshold $s_{min}$ and temporal smoothing suppress unstable low-support releases, but prototype-specific attribute inference is not separately evaluated; the attack AUC measures client membership from model statistics.

4.3. Importance-Aware Sparsification and Secure Aggregation

Transmitting a dense model update is expensive for visual IoT clients with limited uplink bandwidth. Independent top-m sparsification can reduce this cost, but its coordinate indices may reveal client-specific gradient structure and prevent efficient secure aggregation because clients transmit different supports. FedArtSense instead constructs a shared sparse projection from previously released private global updates. The projection is fixed before the current local datasets are accessed, so every participating client transmits the same coordinate positions and selection incurs no additional privacy loss.

Let ${\widehat{\mathbf{g}}}_{\Delta }^{t-1}\in {\mathbb{R}}^{m_{t-1}}$ denote the protected sparse aggregate released in round $t-1$. The server lifts this vector to the original parameter space using

$${\overline{\mathbf{\Delta }}}^{t-1}={\left({\mathbf{P}}^{t-1}\right)}^{\top }{\widehat{\mathbf{g}}}_{\Delta }^{t-1}\in {\mathbb{R}}^d.$$

(31)

Coordinates not selected in round $t-1$ are zero after lifting. Because ${\widehat{\mathbf{g}}}_{\Delta }^{t-1}$ has already been protected, any score computed from ${\overline{\mathbf{\Delta }}}^{t-1}$ is post-processing.

FedArtSense evaluates coordinate importance using persistent update magnitude and directional consistency. The server maintains an exponential moving average ${\mathbf{a}}^t\in {\mathbb{R}}^d$ of normalized magnitudes:

$$a_j^t={\beta }_a{a}_j^{t-1}+(1-{\beta }_a){\displaystyle \frac{|{\overline{\Delta }}_j^{t-1}|}{{\parallel {\overline{\mathbf{\Delta }}}^{t-1}\parallel }_1+\upsilon }},j=1,\dots ,d,$$

(32)

where ${\beta }_a\in [0,1)$ controls temporal smoothing. A global update momentum is

$$m_j^t={\beta }_m{m}_j^{t-1}+(1-{\beta }_m){\overline{\Delta }}_j^{t-1},$$

(33)

where ${\beta }_m\in [0,1)$. For a coordinate selected in the preceding round, directional consistency is

$$c_j^t={\displaystyle \frac{1}{2}}\left[1+sign\left({\overline{\Delta }}_j^{t-1}\right)sign\left(m_j^{t-1}\right)\right].$$

(34)

Thus, $c_j^t=1$ when the most recent protected update agrees with its historical momentum, $c_j^t=0$ when their directions conflict, and $c_j^t=1/2$ when either value is zero. For an unselected coordinate, $c_j^t$ is retained from its most recent observation.

Pure magnitude selection can repeatedly choose a small parameter subset and permanently exclude coordinates that become useful later. The server therefore associates coordinate j with a staleness counter $h_j^t$. Let ${\mathcal{M}}_{t-1}$ be the preceding support. The counter evolves as

$$h_j^t=\left\{\begin{array}{cc}0,\hfill & j\in {\mathcal{M}}_{t-1},\hfill \\ min(h_j^{t-1}+1,h_{max}),\hfill & j\notin {\mathcal{M}}_{t-1},\hfill \end{array}\right.$$

(35)

where $h_{max}$ limits the effect of long exclusion. The complete importance score is

$$I_j^t=a_j^t(1+{\kappa }_c{c}_j^t)+{\kappa }_h{\displaystyle \frac{h_j^t}{h_{max}}},$$

(36)

where ${\kappa }_c\ge 0$ rewards directionally consistent coordinates and ${\kappa }_h\ge 0$ promotes stale coordinates.

The number of retained coordinates is adapted to optimization progress and the available communication budget. Let $B_{\mathrm{round}}^t$ be the maximum uplink bits available in round t, let b be value precision, and let $B_P^t$ be protected-prototype transmission cost. A budget-feasible upper bound is

$$m_{\mathrm{bud}}^t=⌊{\displaystyle \frac{B_{\mathrm{round}}^t-B_P^t}{M_t(b+\lceil {log}_{2}d\rceil )}}⌋.$$

(37)

The desired compression ratio is derived from the public progress score:

$${\gamma }_t={clip}_{[{\gamma }_{min},{\gamma }_{max}]}\left[{\gamma }_0{\left({\displaystyle \frac{g_t+\upsilon }{{\overline{g}}_t+\upsilon }}\right)}^{{\kappa }_{\gamma }}\right],m_t=min\{\lceil {\gamma }_{t}d\rceil ,m_{\mathrm{bud}}^t\}.$$

(38)

More coordinates are retained when the protected global model changes rapidly, while stronger compression is applied as optimization stabilizes. Setting ${\gamma }_{min}={\gamma }_{max}$ yields a fixed-bandwidth evaluation.

A fraction ${\gamma }_{\exp }\in [0,1)$ of the support is reserved for exploration, with $m_{\exp }^t=\lceil {\gamma }_{\exp }{m}_t\rceil$. FedArtSense first chooses coordinates with the largest staleness values and then fills the remaining positions using importance:

$$\begin{array}{cc}\hfill {\mathcal{M}}_t^{\exp }& =Top({\left\{h_j^t\right\}}_{j=1}^d,m_{\exp }^t),\hfill \\ \hfill {\mathcal{M}}_t^{\mathrm{imp}}& =Top(\{I_j^t:j\notin {\mathcal{M}}_t^{\exp }\},m_t-m_{\exp }^t),\hfill \\ \hfill {\mathcal{M}}_t& ={\mathcal{M}}_t^{\exp }\cup {\mathcal{M}}_t^{\mathrm{imp}}.\hfill \end{array}$$

(39)

Here, $Top(·,m)$ returns the indices of the m largest values, with ties resolved using a public round seed. Projection matrix ${\mathbf{P}}^t$ contains one row for each index in ${\mathcal{M}}_t$. Thus, ${\mathbf{P}}^t\mathbf{v}$ extracts selected coordinates and ${\left({\mathbf{P}}^t\right)}^{\top }$ restores them to their original positions with zeros elsewhere.

The server broadcasts ${\mathcal{M}}_t$ together with ${\mathit{\theta }}^t$, ${\widehat{\mathcal{P}}}^t$, $R_{\Delta }^t$, $R_P^t$, and the noise multipliers. Because all clients use the same ordered support, secure aggregation processes a fixed-length vector without observing client-specific coordinate indices. Equation (37) conservatively includes an index for every value so that comparisons remain valid for baselines with uncoordinated supports. An implementation that caches the shared support transmits only $m_t$ ordered values per client.

For protocol-level accounting, FedArtSense uses the four-phase, double-masking protocol of Bonawitz et al. [10]. Pairwise secrets use 32-byte Curve25519 public keys, authenticated share transport uses a 12-byte nonce and 16-byte tag, and the two 32-byte mask seeds are Shamir-shared with threshold $M_{min}$. Protected values are encoded in a 32-bit fixed-point ring. Mutually cancelling pairwise masks and one self-mask are expanded from the exchanged seeds, so full mask vectors are not transmitted. Dropout-recovery shares remove masks associated with unavailable clients without exposing a surviving client’s message; fewer than $M_{min}$ survivors causes the round to abort.

For $M_t$ selected clients, the bidirectional control-plane model is

$$B_{\mathrm{ctrl}}\left(M_t\right)=64+64(M_t-1)+2\times 92(M_t-1)+32M_t\mathrm{bytes}/\mathrm{client}.$$

(40)

The terms respectively represent the key upload, peer-key broadcast, encrypted share upload/download, and worst-case unmasking packet. The uplink-only part is $B_{\mathrm{ctrl}}^{\uparrow }\left(M_t\right)=64+92(M_t-1)+32M_t$. Three server-mediated control exchanges add approximately $3\mathrm{RTT}+8B_{\mathrm{ctrl}}/R$ seconds at link rate R. The masked model/prototype vector itself is already included in the payload accounting of Equation (7).

The protected sparse model aggregate is

$${\widehat{\mathbf{g}}}_{\Delta }^t=SecAgg\left({\left\{{\widehat{\Delta }}_k^t\right\}}_{k\in {\mathcal{S}}_t}\right)=\sum _{k\in {\mathcal{S}}_t}{\widehat{\Delta }}_k^t.$$

(41)

After lifting, the server updates the model using learning rate ${\eta }_s$:

$${\mathit{\theta }}^{t+1}={\mathit{\theta }}^t+{\eta }_s{\left({\mathbf{P}}^t\right)}^{\top }{\widehat{\mathbf{g}}}_{\Delta }^t.$$

(42)

When ${\gamma }_t=1$, clipping is inactive, noise is absent, and ${\eta }_s=1$, this reduces to Equation (2). Under compression, parameters outside ${\mathcal{M}}_t$ retain their previous values until selected later.

The prototype vectors are aggregated independently:

$${\widehat{\mathbf{g}}}_P^t=SecAgg\left({\left\{{\widehat{\mathbf{v}}}_k^t\right\}}_{k\in {\mathcal{S}}_t}\right)=\sum _{k\in {\mathcal{S}}_t}{\widehat{\mathbf{v}}}_k^t.$$

(43)

The server decomposes ${\widehat{\mathbf{g}}}_P^t$ into noisy numerator ${\widehat{\mathbf{a}}}_c^t\in {\mathbb{R}}^{d_z}$ and noisy support ${\widehat{s}}_c^t$ for each class. A candidate protected prototype is computed only when ${\widehat{s}}_c^t\ge s_{min}$:

$${\tilde{\mathit{\mu }}}_c^{t+1}={\displaystyle \frac{{\widehat{\mathbf{a}}}_c^t/max({\widehat{s}}_c^t,s_{min})}{{∥{\widehat{\mathbf{a}}}_c^t/max({\widehat{s}}_c^t,s_{min})∥}_2+\upsilon }}.$$

(44)

The candidate is combined with the preceding protected prototype using a support-dependent coefficient:

$$\begin{array}{cc}\hfill {\alpha }_c^t& ={clip}_{[{\alpha }_{min},{\alpha }_{max}]}\left({\displaystyle \frac{max({\widehat{s}}_c^t,0)}{max({\widehat{s}}_c^t,0)+{\tau }_s}}\right),\hfill \\ \hfill {\widehat{\overline{\mathit{\mu }}}}_c^{t+1}& ={\displaystyle \frac{(1-{\alpha }_c^t){\widehat{\overline{\mathit{\mu }}}}_c^t+{\alpha }_c^t{\tilde{\mathit{\mu }}}_c^{t+1}}{{∥(1-{\alpha }_c^t){\widehat{\overline{\mathit{\mu }}}}_c^t+{\alpha }_c^t{\tilde{\mathit{\mu }}}_c^{t+1}∥}_2+\upsilon }}.\hfill \end{array}$$

(45)

If a class does not reach $s_{min}$, its previous prototype is retained; if none exists, the class remains outside ${\mathcal{G}}_{t+1}$. All quantities used to choose ${\mathcal{M}}_{t+1}$ or form ${\widehat{\mathcal{P}}}^{t+1}$ are functions of protected aggregates. Importance scoring, support selection, normalization, and temporal smoothing therefore preserve the client-level guarantee in Equation (30).

4.4. End-to-End Training Procedure and Theoretical Analysis

The complete procedure integrates the preceding components into one privacy-accounted process. The server maintains ${\mathit{\theta }}^t$, ${\widehat{\mathcal{P}}}^t$, clipping thresholds, cumulative Rényi cost, coordinate-importance statistics, and staleness counters. A selected client maintains only its local artistic images and temporary optimization variables. Algorithm 1 summarizes training.

Algorithm 1 FedArtSense Training in a Visual IoT Sensor Network

Input: Clients $\mathcal{K}$, rounds T, local epochs E, model ${\mathit{\theta }}^0$, target $(ϵ,\delta )$, minimum survivors $M_{min}$, and nominal ratio ${\gamma }_0$. Output: Protected global model ${\mathit{\theta }}^T$ and prototype set ${\widehat{\mathcal{P}}}^T$. Initialize ${\widehat{\mathcal{P}}}^0\leftarrow ⌀$, clipping thresholds, importance statistics, staleness counters, and ${\rho }_{\mathrm{cum}}\left(\lambda \right)\leftarrow 0$. for $t=0,\dots ,T-1$ do    Select ${\mathcal{S}}_t$ and set $r_t=\left|{\mathcal{S}}_t\right|/K$.    Construct ${\mathbf{P}}^t$ from a public seed at $t=0$ or from protected importance and staleness statistics otherwise.    Allocate ${\rho }_{\mathrm{tar}}^t\left(\lambda \right)$ and determine ${\sigma }_{\Delta }^t$, ${\sigma }_P^t$, and ${\sigma }_q^t$.    Broadcast ${\mathit{\theta }}^t$, ${\widehat{\mathcal{P}}}^t$, ${\mathbf{P}}^t$, clipping thresholds, and noise multipliers.    for each $k\in {\mathcal{S}}_t$ in parallel do      Compute $d_k^t$ and ${\beta }_k^t$; perform $E_k^t$ local updates using Equation (17).      Compute ${\Delta }_k^t$ and ${\left\{{\mathit{\mu }}_{k,c}^t\right\}}_{c\in {\mathcal{C}}_k}$; clip and protect all contributions.    end for    if at least $M_{min}$ clients complete then      Securely aggregate messages; update ${\mathit{\theta }}^{t+1}$, ${\widehat{\mathcal{P}}}^{t+1}$, thresholds, and ${\rho }_{\mathrm{cum}}\left(\lambda \right)$.    else      Abort without releasing an aggregate or increasing the accountant.    end if end for Convert ${\rho }_{\mathrm{cum}}\left(\lambda \right)$ to $(ϵ,\delta )$ and return ${\mathit{\theta }}^T$ and ${\widehat{\mathcal{P}}}^T$.

The initialization of ${\mathcal{M}}_0$ is independent of private client data. After warm-up, all sparse supports are constructed from protected aggregates. A failed round releases no model, prototype, clipping statistic, or importance value and therefore consumes no additional privacy budget. When the privacy filter determines that another release would exceed the target, training terminates at the latest valid model.

Optimization assumptions. Let ${\mathcal{J}}_k^t\left(\mathit{\theta }\right)$ denote the expected local objective in Equation (16) without the proximal term, and define

$${\mathcal{J}}^t\left(\mathit{\theta }\right)={\displaystyle \sum _{k=1}^K}{p}_k{\mathcal{J}}_k^t\left(\mathit{\theta }\right).$$

(46)

The proximal term is excluded because it is centered at ${\mathit{\theta }}^t$ and is used only to constrain local drift. Every ${\mathcal{J}}_k^t$ is assumed to be L-smooth and lower bounded by ${\mathcal{J}}_{inf}$. For a stochastic mini-batch gradient ${\mathbf{g}}_k^t$, its conditional variance satisfies

$$\mathbb{E}\left[{∥{\mathbf{g}}_k^t-\nabla {\mathcal{J}}_k^t\left(\mathit{\theta }\right)∥}_2^2\right]\le {\sigma }_g^2.$$

(47)

Client heterogeneity is bounded by ${\zeta }^2$:

$${\displaystyle \sum _{k=1}^K}{p}_k{∥\nabla {\mathcal{J}}_k^t\left(\mathit{\theta }\right)-\nabla {\mathcal{J}}^t\left(\mathit{\theta }\right)∥}_2^2\le {\zeta }^2.$$

(48)

The temporal change of the protected prototype set makes ${\mathcal{J}}^t$ round-dependent. Define prototype drift as

$$D_P^t={\left(\sum _{c\in {\mathcal{G}}_t\cap {\mathcal{G}}_{t+1}}{∥{\widehat{\overline{\mathit{\mu }}}}_c^{t+1}-{\widehat{\overline{\mathit{\mu }}}}_c^t∥}_2^2\right)}^{1/2}.$$

(49)

We assume the induced gradient variation is bounded by

$${∥\nabla {\mathcal{J}}^{t+1}\left(\mathit{\theta }\right)-\nabla {\mathcal{J}}^t\left(\mathit{\theta }\right)∥}_2\le L_P{D}_P^t.$$

(50)

The shared projection is assumed to retain a nonzero fraction of global descent energy. For some $\omega \in (0,1]$,

$${∥{\mathbf{P}}^t\nabla {\mathcal{J}}^t\left({\mathit{\theta }}^t\right)∥}_2^2\ge \omega {∥\nabla {\mathcal{J}}^t\left({\mathit{\theta }}^t\right)∥}_2^2.$$

(51)

This condition does not require every coordinate to be selected in every round. The staleness component prevents indefinite exclusion and increases the effective $\omega$ over successive windows. The dense case gives $\omega =1$.

Clipping introduces bias when a client contribution exceeds $R_{\Delta }^t$. Let

$$b_t={∥\mathbb{E}\left[\sum _{k\in {\mathcal{S}}_t}{\mathbf{u}}_{k,\Delta }^t-\sum _{k\in {\mathcal{S}}_t}{p}_{k,t}{\Delta }_k^t\right]∥}_2.$$

(52)

The expected squared norm of aggregated model noise is bounded by

$$V_{\mathrm{DP}}^t={\displaystyle \frac{M_t}{M_{min}}}{m}_t{\left({\sigma }_{\Delta }^t{R}_{\Delta }^t\right)}^2.$$

(53)

Convergence result. Let ${\eta }_{\mathrm{eff}}={\eta }_s\eta E$ be the effective round-level step size when every selected client performs E local epochs. Suppose ${\eta }_{\mathrm{eff}}\le \omega /\left(4L\right)$ and the preceding assumptions hold. Then constants $C_1,C_2,C_3>0$, independent of T, exist such that

$$\begin{array}{cc}\hfill {\displaystyle \frac{1}{T}}{\displaystyle \sum _{t=0}^{T-1}}\mathbb{E}\left[{∥\nabla {\mathcal{J}}^t\left({\mathit{\theta }}^t\right)∥}_2^2\right]& \le {\displaystyle \frac{2({\mathcal{J}}^0\left({\mathit{\theta }}^0\right)-{\mathcal{J}}_{inf})}{\omega {\eta }_{\mathrm{eff}}T}}\hfill \\ \hfill & +{\displaystyle \frac{C_{1}L{\eta }_{\mathrm{eff}}}{\omega }}\left({\displaystyle \frac{{\sigma }_g^2}{\overline{M}}}+E^2{\zeta }^2\right)\hfill \\ \hfill & +{\displaystyle \frac{C_2}{\omega T}}{\displaystyle \sum _{t=0}^{T-1}}\left[b_t^2+L_P^2{\left(D_P^t\right)}^2\right]\hfill \\ \hfill & +{\displaystyle \frac{C_{3}L{\eta }_s^2}{\omega {\eta }_{\mathrm{eff}}T}}{\displaystyle \sum _{t=0}^{T-1}}{V}_{\mathrm{DP}}^t,\hfill \end{array}$$

(54)

where $\overline{M}$ is the harmonic mean of the numbers of clients completing valid rounds.

The first term decreases as $\mathcal{O}(1/T)$. The second represents stochastic-gradient variance and non-IID client drift. Prototype-guided alignment and proximal regularization reduce the practical magnitude of ${\zeta }^2$, although the bound does not assume that heterogeneity vanishes. The third captures clipping bias and temporal variation in protected prototypes. Temporal smoothing directly limits $D_P^t$. The final term quantifies the cost of differential-privacy noise and exposes its dependence on $m_t$, $R_{\Delta }^t$, and ${\sigma }_{\Delta }^t$. Sparsification can therefore reduce communication and injected noise energy, provided that selected coordinates preserve sufficient descent energy.

The result follows by applying the smoothness inequality to Equation (42), decomposing the protected aggregate into its expected descent direction, client-sampling error, clipping bias, and Gaussian perturbation, and summing the one-round inequalities. Equation (51) lower-bounds retained descent by $\omega \parallel \nabla {\mathcal{J}}^t\left({\mathit{\theta }}^t\right){\parallel }_2^2$. Young’s inequality separates clipping and prototype-drift cross terms, while independence and zero mean remove the first-order Gaussian term. A constant step size therefore converges to a stationary neighborhood determined by heterogeneity, clipping, prototype perturbation, and privacy noise.

Computational and communication complexity. Let ${\mathcal{C}}_f$ denote the cost of one forward–backward pass. Client k requires $\mathcal{O}\left(E_k^t{n}_k{\mathcal{C}}_f\right)$ operations for local learning and $\mathcal{O}\left(n_k{d}_z\right)$ to construct final prototypes. Clipping and projection require $\mathcal{O}\left(d\right)$ operations but do not require transmitting a dense vector. Client memory is $\mathcal{O}(d+C{d}_z)$. The uplink message contains $m_t$ protected model values and $C(d_z+1)$ protected prototype and support values, giving $\mathcal{O}(m_t+C{d}_z)$ values rather than $\mathcal{O}\left(d\right)$. At the server, importance and staleness updates cost $\mathcal{O}\left(d\right)$ per round; top-coordinate selection can be implemented in expected $\mathcal{O}\left(d\right)$ time or $\mathcal{O}(dlog{m}_t)$ time with a bounded heap. Secure aggregation requires $\mathcal{O}\left(M_t(m_t+C{d}_z)\right)$ vector arithmetic per round and $\mathcal{O}\left(M_t^2\right)$ small control messages for the complete pairwise graph; Equation (40) gives the concrete $M_t=10$ accounting used for analytical reporting.

5. Experiments

5.1. Experimental Setup

We evaluate FedArtSense on three existing artistic image collections that differ in historical coverage, class balance, visual medium, and scale. WikiArt provides historical artworks with artist, genre, and style annotations; we use its 27-class style labels. The processed version is available at https://huggingface.co/datasets/huggan/wikiart (accessed on 20 May 2026), and task construction follows the refined WikiArt benchmark [14]. ArtBench-10 is a standardized, class-balanced collection containing ten artistic styles; it is available at https://github.com/liaopeiyuan/artbench (accessed on 20 May 2026) [15]. BAM contains contemporary artworks annotated with content, emotion, and artistic-medium attributes [4]. For BAM, we retain images with one dominant label among 3D computer graphics, comics, oil painting, pen-and-ink, pencil sketch, vector art, and watercolor, then sample $14,000$ images per category to create a balanced seven-class subset of $98,000$ images.

Table 1. Statistics of the artistic image datasets. WikiArt and ArtBench-10 use style classification; the filtered BAM subset uses medium classification.

Dataset	Task	Classes	Total Images	Training	Validation	Testing
WikiArt	Style classification	27	81,444	57,010	8145	16,289
ArtBench-10	Style classification	10	60,000	45,000	5000	10,000
BAM subset	Medium classification	7	98,000	68,600	9800	19,600

reports the resulting splits.

The original ArtBench-10 test set is retained, while 5000 images from its original training set are reserved for validation. WikiArt and BAM use stratified $70\%/10\%/20\%$ train, validation, and test splits. Images belonging to the same source record are restricted to one split. The centralized validation sets are used only for hyperparameter selection; no validation image participates in federated optimization. All final metrics are calculated on held-out test sets.

To simulate visual IoT deployments, the training split of each dataset is distributed among $K=50$ clients. Client label proportions are sampled from a symmetric Dirichlet distribution with concentration $\alpha$. A smaller $\alpha$ produces stronger label skew; the default is $\alpha =0.3$, while $\alpha \in \{0.1,0.3,0.5,1.0\}$ is used in heterogeneity analysis. Resampling continues until every client receives at least 100 images and two labels. The centralized test set remains unchanged.

Each client is also assigned a fixed acquisition profile to approximate images collected by different cameras. The profile combines brightness scaling in $[0.75,1.25]$, contrast scaling in $[0.8,1.2]$, Gaussian blur with standard deviation in $[0,1.2]$, and JPEG quality in $[55,100]$. Parameters are sampled once and then held constant per client, producing persistent sensor-domain shift without changing class labels. Training images are resized to $256\times 256$ pixels, randomly cropped to $224\times 224$, and horizontally flipped with probability $0.5$. Validation and test images use deterministic resizing and center cropping.

Table 2. Deployment assumptions used for the edge-feasibility analysis.

Item	Assumption
Visual source	Fixed RGB documentation/surveillance camera connected to an institutional gateway
Excluded sources	Visitor-owned phones, hyperspectral scanners, and direct on-camera training
Source/model resolution	$1920\times 1080$ or higher source frame; $256\times 256$ resize and $224\times 224$ crop
Acquisition schedule	Event-triggered or one frame every 5–30 s; local buffering before training
Local execution	Periodic gateway-assisted training; 200 rounds are not synchronized to camera frames
Connectivity	Camera–gateway Ethernet/Wi-Fi; gateway uplink tiers of $0.8/3/8$ Mbit/s

separates the deployment interpretation from the benchmark preprocessing. The public datasets do not contain continuous museum-camera streams; the listed acquisition frequency and source resolution define the visual IoT scenario used to interpret compute and communication feasibility.

Figure 3 illustrates one ArtBench-10 allocation at $\alpha =0.3$. Although ten representative clients are shown for readability, the same process is applied to all 50 clients. Each client is dominated by a different artistic style, and the dominant share exceeds one half for most clients, illustrating strong label skew.

All methods use an ImageNet-pretrained ResNet-18 encoder with a 512-dimensional representation and a dataset-specific linear head [41]. The same initialization is shared among methods within each repetition. Local models use stochastic gradient descent with momentum $0.9$, batch size 32, weight decay $5\times {10}^{-4}$, and an initial learning rate of $0.01$ followed by cosine decay. The server learning rate is ${\eta }_s=1$. Unless stated otherwise, ten clients participate in each of $T=200$ rounds, giving $r_t=0.2$, and each selected client performs $E=3$ local epochs.

To represent heterogeneous edge resources, clients are divided into low-, medium-, and high-capacity groups containing $30\%$, $50\%$, and $20\%$ of clients. They perform one, three, and five local epochs, respectively, in the device-heterogeneity experiment, with nominal uplink rates of $0.8$, 3, and 8 Mbit/s. Client selection remains uniform. Training is simulated in PyTorch v2.12.1 using four NVIDIA A100 GPUs; communication latency and transmitted bytes are calculated from the assigned profiles. Peak client memory and inference latency are additionally profiled on an NVIDIA Jetson Orin Nano. The Bonawitz control plane is analytically simulated from the packet model in Equation (40); its latency is not a measurement from a deployed cryptographic stack.

Table 3. Default optimization, prototype, privacy, and sparsification hyperparameters.

Component	Hyperparameter	Default Value
Federated optimization	Clients/clients per round/rounds	$50/10/200$
	Local epochs/batch size	$3/32$
	Client learning rate/server learning rate	$0.01/1.0$
	SGD momentum/weight decay	$0.9/5\times {10}^{-4}$
Prototype alignment	${\beta }_{max}$/$\xi$/$\chi$	$0.5/0.1/0.5$
	Cosine margin m/temperature $\tau$	$0.2/0.1$
	Proximal coefficient ${\lambda }_{\mathrm{prox}}$	${10}^{-3}$
	Prototype smoothing $[{\alpha }_{min},{\alpha }_{max}]$	$[0.1,0.8]$
Privacy protection	Default $(ϵ,\delta )$	$(6,{10}^{-5})$
	Minimum surviving clients $M_{min}$	8
	Target unclipped fraction $q^{*}$	$0.8$
	Threshold adaptation rate ${\kappa }_R$	$0.15$
	Privacy shares $({\pi }_{\Delta },{\pi }_P,{\pi }_q)$	$(0.72,0.18,0.05)$ (fixed heuristic)
Sparse aggregation	${\gamma }_0$/$[{\gamma }_{min},{\gamma }_{max}]$	$0.10/[0.05,0.20]$
	Exploration fraction ${\gamma }_{\exp }$	$0.10$
	Magnitude/update momentum	$0.9/0.9$
	Consistency/staleness weight	$0.5/0.05$

lists the default FedArtSense configuration. Prototype parameters are selected using the ArtBench-10 validation set and fixed for the other datasets. The default client-level target is $(ϵ,\delta )=(6,{10}^{-5})$, and additional experiments use $ϵ\in \{2,4,6,8\}$. The accountant evaluates $\lambda \in \{1.25,1.5,2,3,4,8,16,32,64\}$. A round is released only when at least $M_{min}=8$ clients complete secure aggregation.

A practical tuning order reduces the apparent parameter count. First, deployment policy fixes $(ϵ,\delta )$, $M_{min}$, and the communication budget. Second, Equation (37) determines a feasible ${\gamma }_0$; Figure 4 indicates that overly small ratios discard descent energy, whereas dense updates add traffic and privacy noise. Third, $q^{*}=0.8$ and ${\kappa }_R\in [0.1,0.2]$ are stable defaults when the desired clipped-client rate is near $20\%$, as reflected in

Table 4. Ablation of adaptive clipping and progress-aware privacy allocation on WikiArt. Fixed clipping with uniform allocation defines normalized noise energy $1.00$.

Clipping	Allocation	Accuracy (%)	Macro-F1 (%)	Clipped Clients (%)	Noise Energy	Final $\mathit{ϵ}$
Fixed	Uniform	$60.5\pm 0.7$	$56.9\pm 0.8$	$24.8\pm 1.3$	$1.00$	$5.99$
Adaptive	Uniform	$62.1\pm 0.6$	$58.4\pm 0.7$	$19.6\pm 1.1$	$0.82$	$5.99$
Fixed	Progress-aware	$61.7\pm 0.6$	$58.1\pm 0.7$	$24.3\pm 1.2$	$0.87$	$5.98$
Adaptive	Progress-aware	$\mathbf{64.2}\pm \mathbf{0.5}$	$\mathbf{60.7}\pm \mathbf{0.5}$	$20.1\pm 1.0$	$\mathbf{0.69}$	$5.98$

. Finally, tune ${\beta }_{max}$ and $\xi$ from observed representation discrepancy, then $\chi$, m, and $\tau$ on a validation set; ${\lambda }_{\mathrm{prox}}$ is increased only when local drift remains large. The component effects in

Table 5. Component-wise ablation under client-level $(6,{10}^{-5})$-differential privacy. Each row removes one component; results are mean ± standard deviation over five repetitions.

Variant	WikiArt Accuracy (%)	WikiArt Macro-F1 (%)	ArtBench Accuracy (%)	ArtBench Macro-F1 (%)
FedArtSense	$\mathbf{64.2}\pm \mathbf{0.5}$	$\mathbf{60.7}\pm \mathbf{0.5}$	$\mathbf{81.2}\pm \mathbf{0.3}$	$\mathbf{80.7}\pm \mathbf{0.4}$
Without prototype guidance	$59.8\pm 0.6$	$56.0\pm 0.7$	$77.0\pm 0.5$	$76.4\pm 0.5$
Without decision-space alignment	$62.7\pm 0.5$	$59.1\pm 0.6$	$79.9\pm 0.4$	$79.4\pm 0.4$
Without heterogeneity-aware alignment	$62.9\pm 0.5$	$59.4\pm 0.6$	$80.1\pm 0.4$	$79.6\pm 0.4$
Without adaptive privacy control	$60.5\pm 0.7$	$56.9\pm 0.8$	$77.8\pm 0.5$	$77.2\pm 0.6$
Without importance scoring	$61.6\pm 0.6$	$58.0\pm 0.7$	$78.9\pm 0.5$	$78.3\pm 0.5$
${\gamma }_{\exp }=0$	$63.3\pm 0.5$	$59.8\pm 0.5$	$80.6\pm 0.4$	$80.1\pm 0.4$
Without prototype smoothing	$62.8\pm 0.6$	$59.2\pm 0.6$	$80.0\pm 0.4$	$79.5\pm 0.5$

provide the priority order: prototype guidance and adaptive privacy are more sensitive than smoothing or exploration.

The exploration fraction has a limited two-point sensitivity result in Table 5. Setting ${\gamma }_{\exp }=0$ reduces WikiArt accuracy from $64.2\%$ to $63.3\%$ and ArtBench-10 accuracy from $81.2\%$ to $80.6\%$; the default $0.10$ prevents long-term coordinate starvation. Values in $[0.05,0.20]$ are recommended when bandwidth permits, while larger values increasingly replace historically important coordinates. A broader sweep is not used to support the reported claims.

The adaptive variables remain bounded throughout training. Figure 5 shows their trajectories for a representative WikiArt run with $ϵ=6$ and $\alpha =0.3$. The model-update threshold decreases after warm-up, the multiplier decreases as more precision is allocated to refinement, and the sparse ratio retains more coordinates early before approaching its lower operating range.

The primary predictive metrics are top-1 accuracy and macro-F1. Privacy is reported using final client-level $ϵ$ at $\delta ={10}^{-5}$. Communication is cumulative client-to-server traffic, and convergence is the number of rounds needed to reach $95\%$ of a method’s final validation accuracy. Privacy leakage is examined using client-level membership-inference attack AUC. Every experiment is repeated with five partition and initialization seeds; tables report mean and standard deviation, and statistical comparisons use paired two-sided tests.

5.2. Comparison with Federated Learning Baselines

We compare FedArtSense with four non-private methods and three client-level private methods. FedAvg performs weighted averaging [1]; FedProx adds a proximal constraint [5]; SCAFFOLD uses control variates [6]; and MOON introduces model-level contrastive regularization [7]. DP-FedAvg and DP-FedProx apply client clipping and Gaussian perturbation using the same accountant and privacy target as FedArtSense [2]. Fed-SMP uses top-m sparsified model perturbation under client-level privacy [9]. All methods use the same initialization, client partitions, participation sequences, transformations, local optimizer, and 200-round limit. Non-private baselines exchange dense 32-bit updates; SCAFFOLD also communicates its control variate. Private methods are evaluated at $(ϵ,\delta )=(6,{10}^{-5})$.

Table 6. Test accuracy and macro-F1 under the default non-IID partition. Private methods satisfy client-level $(6,{10}^{-5})$-differential privacy. Results are mean ± standard deviation over five repetitions; bold indicates the best private result.

Method	DP	WikiArt		ArtBench-10		BAM Subset
		Accuracy (%)	Macro-F1 (%)	Accuracy (%)	Macro-F1 (%)	Accuracy (%)	Macro-F1 (%)
FedAvg	No	$61.8\pm 0.6$	$58.4\pm 0.7$	$79.1\pm 0.4$	$78.7\pm 0.5$	$73.5\pm 0.5$	$71.6\pm 0.6$
FedProx	No	$63.2\pm 0.5$	$60.0\pm 0.6$	$80.3\pm 0.4$	$79.9\pm 0.4$	$74.7\pm 0.4$	$72.8\pm 0.5$
SCAFFOLD	No	$64.0\pm 0.5$	$60.8\pm 0.5$	$80.7\pm 0.3$	$80.3\pm 0.4$	$75.1\pm 0.4$	$73.4\pm 0.4$
MOON	No	$65.1\pm 0.4$	$62.1\pm 0.5$	$81.6\pm 0.3$	$81.2\pm 0.3$	$75.9\pm 0.3$	$74.3\pm 0.4$
DP-FedAvg	Yes	$54.6\pm 0.8$	$50.8\pm 0.9$	$72.4\pm 0.6$	$71.8\pm 0.6$	$67.9\pm 0.7$	$65.5\pm 0.8$
DP-FedProx	Yes	$56.1\pm 0.7$	$52.4\pm 0.8$	$73.8\pm 0.5$	$73.1\pm 0.6$	$69.0\pm 0.6$	$66.7\pm 0.7$
Fed-SMP	Yes	$59.4\pm 0.6$	$55.7\pm 0.7$	$76.8\pm 0.5$	$76.1\pm 0.5$	$71.2\pm 0.5$	$68.9\pm 0.6$
FedArtSense	Yes	$\mathbf{64.2}\pm \mathbf{0.5}$	$\mathbf{60.7}\pm \mathbf{0.5}$	$\mathbf{81.2}\pm \mathbf{0.3}$	$\mathbf{80.7}\pm \mathbf{0.4}$	$\mathbf{75.3}\pm \mathbf{0.4}$	$\mathbf{73.1}\pm \mathbf{0.4}$

presents test accuracy and macro-F1. FedArtSense achieves the best result among private methods on every dataset. Relative to Fed-SMP, it improves accuracy by $4.8$, $4.4$, and $4.1$ percentage points on WikiArt, ArtBench-10, and BAM, respectively, with macro-F1 improvements of $5.0$, $4.6$, and $4.2$ points.

Despite client-level differential privacy, FedArtSense exceeds non-private FedAvg on all datasets and approaches non-private MOON, with accuracy differences of $0.9$, $0.4$, and $0.6$ points. This does not imply that privacy perturbation improves an identical optimizer; dual-space prototype guidance and heterogeneity-aware alignment compensate for part of the utility loss that conventional private averaging experiences on strongly non-IID artistic images.

The WikiArt convergence curves in Figure 6 show that the advantage develops throughout training. DP-FedAvg and DP-FedProx oscillate after round 80 because fixed clipping and noise do not follow the declining scale of client updates. Fed-SMP reduces perturbation dimension, but its sparse updates do not explicitly address representation drift. FedArtSense reaches $60\%$ accuracy near round 94 and improves to $64.2\%$.

Table 7. Privacy and efficiency on WikiArt. Attack AUC measures client-level membership inference; $0.5$ represents random guessing. Rounds to $95\%$ are relative to each method’s final validation accuracy.

Method	Final $\mathit{ϵ}$	Attack AUC	Uplink (GiB)	Rounds to $95\%$
FedAvg	–	$0.712\pm 0.014$	$87.1$	$149\pm 6$
FedProx	–	$0.694\pm 0.013$	$87.1$	$137\pm 5$
SCAFFOLD	–	$0.701\pm 0.012$	$174.2$	$118\pm 5$
MOON	–	$0.681\pm 0.011$	$87.1$	$124\pm 4$
DP-FedAvg	$6.00$	$0.531\pm 0.009$	$87.1$	$172\pm 7$
DP-FedProx	$6.00$	$0.524\pm 0.008$	$87.1$	$158\pm 6$
Fed-SMP	$6.00$	$0.519\pm 0.007$	$15.2$	$146\pm 5$
FedArtSense	$5.98$	$\mathbf{0.508}\pm \mathbf{0.006}$	$\mathbf{11.5}$	$\mathbf{121}\pm \mathbf{4}$

compares privacy leakage, communication, and convergence on WikiArt. Communication uses actual shared-support encoding, in which the sparse coordinate order is broadcast once per round. FedArtSense reduces uplink traffic by $86.8\%$ relative to dense FedAvg and $24.3\%$ relative to Fed-SMP. Its prototype payload contributes $0.18$ GiB and is included.

The client-level attack trains a binary classifier from model-loss statistics, prediction entropy, and confidence changes measured on complete client collections. Non-private methods yield AUC values between $0.681$ and $0.712$, showing that keeping images local is insufficient to prevent participation inference. Private methods reduce the attack close to random guessing. FedArtSense obtains $0.508$, while its accountant reports $ϵ=5.98$, slightly below target because the implementation searches discrete noise-multiplier and Rényi-order grids.

The $11.5$ GiB value in Table 7 includes sparse model values, shared-support encoding, and protected prototypes, but excludes secure-aggregation control packets. With $M_t=10$ and $M_{min}=8$, Equation (40) gives $2.55$ KiB of bidirectional control traffic per client per released round, of which $1.18$ KiB is uplink. Across 200 released rounds, this adds $2.31$ MiB to cumulative uplink and $4.99$ MiB bidirectionally; including control uplink changes $11.5$ GiB to $11.502$ GiB.

Table 8. Analytical Bonawitz secure-aggregation control overhead for ten selected clients and an 8-of-10 recovery threshold. Transfer time uses $2.55$ KiB/client; total latency adds three server-mediated round trips.

Tier	Rate (Mbit/s)	RTT Assumption (ms)	Transfer (s)	Control Latency (s)
Low	$0.8$	250	$0.026$	$0.776$
Medium	3	100	$0.007$	$0.307$
High	8	40	$0.003$	$0.123$

reports the corresponding analytical latency under the three network tiers.

Figure 7 examines the privacy–utility trade-off on ArtBench-10. Accuracy increases with $ϵ$ because a larger budget permits weaker perturbation. Relative to Fed-SMP, FedArtSense improves accuracy by $5.4$ points at $ϵ=2$ and $3.9$ points at $ϵ=8$, indicating that prototype alignment and adaptive coordinate selection are particularly useful under strong perturbation.

Paired comparisons across five repetitions show that FedArtSense significantly outperforms Fed-SMP in accuracy on all three datasets, with $p<0.01$ in each case. Agreement among predictive performance, convergence speed, communication volume, and attack AUC indicates that improvement is not obtained by relaxing privacy or increasing communication. Figure 7 also clarifies that the default $ϵ=6$ is a moderate, not high-assurance, client-level guarantee. Reducing the budget to $ϵ=2$ lowers ArtBench-10 accuracy from $81.2\%$ to $76.8\%$, a $4.4$-point decrease. Budgets below 2, including $ϵ\le 1$, are not evaluated and are not covered by the deployment claim.

5.3. Ablation and Sensitivity Analysis

We conduct component-wise ablations to determine whether the performance gain arises from one mechanism or from the interaction among representation alignment, adaptive privacy, and communication-aware aggregation. Each ablation removes one component while retaining the same partitions, privacy target, communication rounds, and optimizer. Table 5 reports results on WikiArt and ArtBench-10.

Removing prototype guidance sets ${\beta }_k^t=0$ and produces the largest decrease, reducing WikiArt accuracy to $59.8\%$. Retaining feature alignment but setting $\chi =0$ lowers accuracy by $1.5$ points, showing that consistency between prototype geometry and the classification head contributes beyond feature attraction. Replacing ${\beta }_k^t$ with constant ${\beta }_{max}$ also reduces performance because well-aligned clients become over-regularized. Replacing adaptive privacy with a fixed threshold and uniform expenditure loses $3.7$ points. A public random support of the same size loses $2.6$ points, showing that the gain does not arise from sparsity alone.

The effect of prototype guidance becomes more pronounced as client distributions become more heterogeneous. Figure 8 compares the complete method with its principal representation ablations and Fed-SMP over four Dirichlet concentrations. At $\alpha =0.1$, removing prototype guidance reduces accuracy by $5.9$ points, compared with $2.5$ points at $\alpha =1.0$.

To separate adaptive privacy operations, Table 4 compares fixed and adaptive clipping with uniform and progress-aware allocation. All variants satisfy approximately the same final budget. The clipped-client rate is the proportion of client updates whose weighted norm exceeds $R_{\Delta }^t$. Normalized noise energy is calculated from ${\sum }_t{V}_{\mathrm{DP}}^t$ and divided by the fixed-clipping, uniform-allocation value.

Adaptive clipping alone reduces noise energy to $0.82$ because its threshold follows the declining update scale. Progress-aware allocation alone reduces energy to $0.87$ by preserving privacy resources for late refinement. Their combination yields the lowest noise energy and highest accuracy. The combined clipped-client rate remains close to the intended $1-q^{*}=20\%$, confirming that private quantile feedback tracks its target.

We next hold the sparse ratio constant by setting ${\gamma }_{min}={\gamma }_{max}={\gamma }_0$. Figure 4 reports WikiArt accuracy and cumulative traffic. Extremely aggressive compression at ${\gamma }_0=0.02$ loses important descent coordinates. Increasing the ratio to $0.10$ improves accuracy; beyond this point, extra coordinates increase communication and the norm of Gaussian perturbation, causing a gradual decrease under the fixed privacy budget.

The best fixed ratio is ${\gamma }_0=0.10$, which is used as the center of the adaptive interval. The adaptive policy communicates more than the fixed-$0.10$ variant because it retains extra coordinates during early high-progress rounds, but it reaches $95\%$ of final accuracy 18 rounds earlier.

5.4. Robustness and Edge-Deployment Evaluation

Visual IoT sensors can introduce persistent appearance changes absent from curated benchmarks. We evaluate four acquisition-shift levels. No shift uses deterministic resizing and cropping. Mild shift uses brightness and contrast factors in $[0.9,1.1]$, blur up to $0.4$, and JPEG quality in $[75,100]$. Moderate shift is the default profile in Section 5.1. Severe shift expands brightness to $[0.6,1.4]$, contrast to $[0.65,1.35]$, maximum blur standard deviation to $2.0$, and JPEG quality to $[35,85]$. Each client retains one profile.

Table 9. Test accuracy under increasing client-specific sensor shift. All methods satisfy client-level $(6,{10}^{-5})$-differential privacy.

Method	WikiArt Accuracy (%)				BAM Accuracy (%)
	None	Mild	Moderate	Severe	None	Mild	Moderate	Severe
DP-FedAvg	$56.8\pm 0.7$	$55.8\pm 0.7$	$54.6\pm 0.8$	$51.2\pm 0.9$	$69.4\pm 0.6$	$68.8\pm 0.6$	$67.9\pm 0.7$	$64.3\pm 0.8$
DP-FedProx	$58.2\pm 0.6$	$57.4\pm 0.7$	$56.1\pm 0.7$	$52.9\pm 0.8$	$70.3\pm 0.5$	$69.8\pm 0.6$	$69.0\pm 0.6$	$65.7\pm 0.7$
Fed-SMP	$61.1\pm 0.6$	$60.4\pm 0.6$	$59.4\pm 0.6$	$55.8\pm 0.8$	$72.6\pm 0.5$	$72.0\pm 0.5$	$71.2\pm 0.5$	$67.9\pm 0.7$
FedArtSense	$\mathbf{65.7}\pm \mathbf{0.4}$	$\mathbf{65.0}\pm \mathbf{0.5}$	$\mathbf{64.2}\pm \mathbf{0.5}$	$\mathbf{61.6}\pm \mathbf{0.6}$	$\mathbf{76.6}\pm \mathbf{0.4}$	$\mathbf{76.0}\pm \mathbf{0.4}$	$\mathbf{75.3}\pm \mathbf{0.4}$	$\mathbf{72.5}\pm \mathbf{0.5}$

reports accuracy on WikiArt and BAM.

Acquisition shift reduces every method’s performance, but FedArtSense remains most accurate at each severity. Under severe shift, it exceeds Fed-SMP by $5.8$ points on WikiArt and $4.6$ on BAM. Its decrease from no shift to severe shift is $4.1$ points on both datasets, compared with $5.6$ and $5.1$ for DP-FedAvg. Protected prototypes provide a semantic reference less sensitive to client-specific brightness, compression, and blur than direct parameter averaging.

We simulate independent client dropout after local training but before secure aggregation. The server attempts 200 rounds, and an attempted round is released only if at least $M_{min}=8$ of ten selected clients remain. Aborted rounds reveal no aggregate and consume no privacy budget. Figure 9 shows WikiArt accuracy as dropout increases. FedArtSense remains above $60\%$ at dropout probability $0.2$, whereas Fed-SMP and DP-FedAvg decrease to $54.5\%$ and $49.7\%$.

The advantage under dropout has two sources. Temporally smoothed prototypes preserve class information from earlier valid rounds when a later contribution is unavailable, and importance scores use the most recent released aggregate rather than attempted rounds. At dropout probability $0.3$, only $78.4\pm 4.1$ attempted rounds satisfy the release threshold, so the remaining decrease primarily reflects fewer optimization steps.

We profile client execution on an NVIDIA Jetson Orin Nano using batch size 32 and one local epoch over 500 WikiArt images.

Table 10. Edge-device profile on an NVIDIA Jetson Orin Nano. Uplink includes sparse indices when required and protected prototypes for FedArtSense. Energy is normalized to DP-FedAvg.

Method	Local Epoch (s)	Peak Memory (GiB)	Relative Energy	Uplink/Client (MiB)	Inference (ms)
DP-FedAvg	$144.8\pm 1.9$	$2.71$	$1.00$	$46.8$	$18.6\pm 0.3$
DP-FedProx	$148.2\pm 2.0$	$2.74$	$1.02$	$46.8$	$18.6\pm 0.3$
Fed-SMP	$152.6\pm 2.1$	$2.78$	$1.05$	$8.2$	$18.6\pm 0.3$
FedArtSense	$161.9\pm 2.2$	$2.93$	$1.11$	$\mathbf{6.2}$	$18.7\pm 0.3$

reports training time, peak memory, relative energy, and average uplink payload. Inference latency is measured for one $224\times 224$ image after ten warm-up iterations and averaged over 1000 runs.

Prototype extraction and dual-space alignment increase local-epoch time by $11.8\%$ and peak memory by $0.22$ GiB relative to DP-FedAvg. This overhead is offset by an $86.8\%$ reduction in average uplink payload. FedArtSense also sends $24.4\%$ fewer bytes than Fed-SMP because its coordinate support is shared. The $0.1$ ms inference difference lies within measurement variation, showing that training does not increase deployment-time model complexity.

Table 10 supports gateway-class deployment, not direct training on a battery-powered camera. MobileNetV3 and EfficientNet provide architecture families designed for resource-constrained inference and training [42,43], but lightweight backbones and quantization-aware training are not evaluated here. FedArtSense is architecturally compatible with them because its model payload scales with parameter dimension d and its prototype payload with representation dimension $d_z$; their accuracy, clipping, and privacy schedules require separate calibration. The reported $161.9$ s local epoch and $2.93$ GiB peak memory therefore define the ResNet-18 gateway profile rather than a battery-sensor requirement.

Figure 10 translates only the masked model/prototype payloads into transmission latency for the bandwidth tiers in Section 5.1; Table 8 separately reports the Bonawitz control plane. At $0.8$ Mbit/s, a dense DP-FedAvg update requires approximately 468 s, compared with 82 s for Fed-SMP and 62 s for FedArtSense. The additional FedArtSense control latency is $0.776$ s under the low-tier RTT assumption.

These results indicate suitability for bandwidth-constrained, gateway-assisted visual IoT deployments when moderate additional local computation is available. The main deployment limitation is that secure aggregation requires at least $M_{min}$ surviving clients. Networks with frequent correlated outages would require a smaller release threshold with recalibrated noise or a larger initially selected set.

5.5. Limitations and Practical Scope

The evaluation is limited to style and medium classification on curated public datasets with simulated client partitions and acquisition transformations. Table 2 defines the intended camera–gateway scenario, and Table 10 shows that the current ResNet-18 training profile is unsuitable for many battery-powered or thermally constrained sensors. Lightweight backbones, quantization-aware training, live museum streams, retrieval, aesthetic prediction, and detection remain unevaluated.

The default $ϵ=6$ setting is moderate. Figure 7 reports stronger protection at $ϵ=2$, but no result is available for $ϵ<2$. Differential privacy protects one client’s participation in the complete transcript; it does not hide aggregate semantic information shared by many institutions. Consequently, the protected prototype sequence may reveal federation-level prevalence of styles or media, and a dedicated prototype-attribute inference evaluation remains open.

Encrypted image exchange and reversible perturbation provide complementary content protection. End-to-end encryption can be preferable when an institution accepts an authorized central analyst and needs confidentiality in transit, but it scales with image volume and exposes plaintext at the authorized endpoint [34]. Reversible perturbation can protect locally stored or intercepted frames independently of the federated transcript, but adversarial distortion may alter local features and prototype geometry, while recovery keys add another trust boundary [35]. Applying such a transform before local training can provide defense in depth, but it does not reduce the stated $(ϵ,\delta )$ budget unless the combined mechanism is analyzed, and its effect on dual-space alignment requires separate validation.

6. Conclusions

This paper presented FedArtSense for privacy-preserving artistic style and medium classification across distributed visual IoT gateways. It combines discrepancy-adaptive dual-space prototype alignment, adaptive client-level differential privacy, shared importance-aware sparsification, and Bonawitz-style secure aggregation. On WikiArt, ArtBench-10, and BAM, the method obtains $64.2\%$, $81.2\%$, and $75.3\%$ accuracy under the default $(ϵ,\delta )=(6,{10}^{-5})$ target. The WikiArt cumulative masked-payload uplink is $11.5$ GiB, and the analytically accounted secure-aggregation control uplink adds $2.31$ MiB over 200 released rounds. The conclusions are restricted to classification, gateway-class ResNet-18 execution, and the evaluated privacy range $ϵ\in \{2,4,6,8\}$. Future work will study $ϵ<2$, lightweight and quantized backbones, prototype-specific inference, live sensor streams, correlated failures, and non-classification art tasks.