A Zero Trust Driven Federative Learning Algorithm for Privacy Enhancement

Abstract

The proliferation of Enterprise Networks, characterized by heterogeneous devices, distributed data sources, and increasingly sophisticated cyber threats, has exposed the limitations of traditional perimeter-based security models. Guided by the principles of Zero Trust Architecture (ZTA), this paper presents a Zero-Trust (ZT)-Driven Federated Learning Algorithm for Privacy Enhancement (ZT-FL-PE), designed to safeguard model and data confidentiality in decentralized learning environments. By integrating ZTA’s “never trust, always verify” posture with Federated Learning’s (FL) decentralized training paradigm, the proposed framework eliminates the need for centralized data aggregation and significantly reduces the attack surface. The algorithm specifically targets two prominent threats to model privacy: property inference attacks (PIAs) and membership inference attacks (MIAs). We introduce adaptive verification mechanisms and privacy-preserving update transformations that enforce continuous authentication, constrain adversarial behavior, and strengthen resilience against inference-based exploitation. Experimental results demonstrate that ZT-FL-PE substantially enhances privacy protection while maintaining high model accuracy and imposing only low-to-moderate computational overhead, making it a practical and robust solution for modern ZT Enterprise environments.

1. Introduction

The rapid evolution of enterprise networking, driven by cloud adoption, hybrid architecture, remote and hybrid work models, and the widespread use of diverse endpoint devices, has fundamentally transformed organizational IT infrastructures. No longer confined to clearly defined perimeters, modern enterprises must seamlessly integrate cloud-based services, on-premises resources, and remote access from heterogeneous user devices. Under these conditions, traditional perimeter-based security models, which implicitly trust devices located inside the network boundary, have become increasingly inadequate. Consequently, organizations are adopting Zero Trust Architecture (ZTA), a security paradigm that rejects the notion of implicit trust. Instead, ZTA is guided by the principle of “never trust, always verify.” Under this model, no user, device, or application is trusted based on network location; every request is dynamically evaluated using identity, contextual information, and policy-based decisions [1,2].

As illustrated in Figure 1, ZTA deployments comprise several logical components that may reside on-premises or in cloud environments. A central element is the Policy Decision Point (PDP), typically subdivided into the Policy Engine (PE) and the Policy Administrator (PA), which interact on the control plane, while user traffic flows through a separate data plane. The primary objective of ZTA is to strengthen access control and mitigate risks to organizational assets through continuous monitoring and adaptive defense strategies. According to the National Institute of Standards and Technology (NIST) [1,2] ZTA requires the application of dynamic policies as close to critical resources as possible, minimizing exposure of sensitive information such as credentials.

Figure 1. ZTA Core Logical Components.

Policy decisions rely on numerous inputs, e.g., user attributes, role assignments, historical behaviours, and external threat intelligence—all of which are maintained in policy repositories to support real-time, contextual decision-making. However, strict data-sharing restrictions often result in fragmented data silos, hindering the use of centralized artificial intelligence (AI) tools. FL addresses this challenge by enabling model training across multiple entities without requiring raw data sharing; instead, only model updates or parameters are exchanged. In the context of cloud-native deployments, hybrid workforces, and highly dynamic endpoint environments, ZTA offers a compelling approach for securing resources independently of network topology [3]. At the core of ZTA lies the concept of fine-grained, context-aware access control: a logically centralized PDP evaluates each access request based on identity, device posture, behavioural patterns, and external risk indicators. Meanwhile, a separate data plane ensures isolation of user traffic. This separation of control and data flow, combined with continuous verification, strengthens resilience against compromise and lateral movement [4]. However, enforcing dynamic, context-sensitive policies across large, heterogeneous enterprises is operationally demanding. Continuous policy updates, real-time device and user monitoring, and adaptive decision-making impose a significant administrative burden. Manual policy management does not scale, is error-prone, and cannot readily accommodate rapid contextual changes (e.g., device health, behavioural anomalies, or real-time threat alerts). These challenges highlight the need for automated, intelligent policy evaluation—an area where AI emerges as a natural enabler. Yet traditional centralized AI methods, which aggregate raw data to a central server, conflict with ZTA’s principles. ZT deployments intentionally restrict data movement; raw data often resides in isolated silos (on-premises, in the cloud, and on remote devices), and legal or contractual constraints may prohibit cross-boundary data transfers. This complicates the use of centralized machine learning for policy generation, anomaly detection, or risk scoring. FL offers a viable solution by enabling distributed training without raw data exchange. Under FL, participants compute local updates (e.g., gradients or parameter deltas) which are aggregated centrally, preserving data confidentiality while enabling global model training [5]. Furthermore, FL has gained traction in privacy-sensitive domains such as healthcare, finance, and enterprise security environments where data locality, regulatory compliance, and confidentiality are paramount. Yet FL is not inherently secure. A growing body of research demonstrates that FL systems are vulnerable to several privacy-compromising inference attacks, including Membership Inference Attacks (MIA), Property Inference Attacks (PIA), and model inversion attacks, which exploit shared model updates to infer private information about local datasets [5]. For example, even without access to raw data, membership inference attacks can determine whether a specific record was used during training, compromising privacy at the sample level [6]. Property inference attacks can reveal sensitive attributes or aggregate statistics of participants’ data (e.g., demographic distributions), which may never be intended for disclosure [3]. These vulnerabilities pose significant challenges for deploying FL in high-security zero-trust environments, where confidentiality and strict privacy guarantees are essential.

Accordingly, despite the complementary strengths of ZTA and FL, a key challenge would be in designing an FL-based AI mechanism that enhances ZTA while remaining robust against inference-based privacy attacks. Thus, this paper addresses this challenge by introducing a Zero-Trust–Driven Federated Learning Privacy Enhancement Algorithm (ZT-FL-PE). Our approach integrates federated learning into ZTA environments while incorporating privacy-preserving mechanisms such as secure aggregation and update transformations. The proposed system enables enterprises to leverage AI-powered policy enforcement and access control decisions without compromising data privacy or violating zero-trust principles.

In this regard, the contributions of this paper are as follows:

• Feasibility demonstration: We show that FL-based AI techniques can be realistically deployed within ZTA environments, enabling intelligent and dynamic policy enforcement while preserving data locality and regulatory constraints.
• An architectural framework: It presents a comprehensive architecture that aligns ZTA components such as PDP, control, and data planes, identity, and credential management with FL workflows, enhancing secure cross-domain collaboration.
• Privacy Enhancement Algorithm. We propose a ZT-PL-PE algorithm that incorporates privacy-preserving update transformations and secure aggregation mechanisms to mitigate membership and property inference attacks in ZT deployments.
• Empirical evaluation: We demonstrate, through experiments on representative datasets and adversarial models, that FL-PE significantly reduces susceptibility to inference attacks with minimal degradation to model performance and moderate computational overhead.

The rest of the paper is organised as follows: Section 2 reviews related work, followed by a discussion of membership-related attacks in Section 3. Section 4 details the proposed ZT-FL-PE algorithm and architecture, including its mathematical formalisation and theoretical analysis, while Section 5 provides the performance evaluation and discussion. Section 6 concludes the paper.

2. Related Work

As previously alluded to in the introductory section, the gradual shift from perimeter-based security to ZT was formally catalysed by NIST Special Publication 800-207 [1], which established ZTA as a model in which trust is never implicit and must be continually evaluated. Rose et al. [2] elaborated on its core logical components, emphasizing the separation of the PDP from the data plane. Subsequent research has focused on applying ZTA principles to specific domains. Chandramouli [3] proposed models for access control in cloud-native, multi-cloud environments, while Huber & Kandah [6] extended ZTA to IoT ecosystems with a “Zero Trust+” framework. Recent work explores integrating AI to automate ZTA processes. Chokkanathan et al. [7] and S N et al. [8] discuss AI-driven ZTA for enhancing cybersecurity resilience in cloud and edge computing by enabling adaptive policy generation and anomaly detection. However, these studies often assume the availability of centralized data for AI training, which conflicts with ZTA’s data locality and privacy mandates. FL provides a framework for decentralized model training on distributed data silos, aligning significantly with ZTA’s data minimization principle. Its application in sensitive sectors like healthcare and finance underscores its privacy-preserving appeal. Several surveys, e.g., [5,9,10,11], comprehensively outline the architecture, benefits, and challenges of FL. A primary challenge in FL is data heterogeneity (non-IID data across clients), which can severely degrade model convergence and performance. Recent work by Chai et al. [11] addresses this by using prototype-based fine-tuning, leveraging shared class prototypes to align client representations and mitigate heterogeneity. Similarly, cross-domain learning frameworks, such as the unified multi-domain face normalization method by Pang et al. [12] demonstrate techniques for harmonizing disparate data distributions, a concept relevant to FL’s federated, often heterogeneous environment.

However, significant research has exposed FL’s vulnerability to privacy attacks, even without raw data sharing. Membership Inference Attacks (MIAs), pioneered by Shokri et al. [13], allow an adversary to determine if a specific sample was in the training set. Yeom et al. [14] formalized the connection between overfitting and MIA success. Property Inference Attacks (PIAs), as demonstrated by Ganju et al. [15], aim to infer global properties or sensitive attributes of the training dataset. Model Inversion Attacks [16] attempt to reconstruct representative features of the training data. These attacks exploit the information leakage inherent in shared model updates or gradients [17]. Layer-wise characterization of this leakage has shown that different layers reveal varying amounts of sensitive information [18].

To counter these threats, three primary classes of defences have emerged:

• Cryptographic Techniques: Secure Multi-Party Computation (MPC) and Homomorphic Encryption (HE) can compute over encrypted updates but incur high computational and communication overhead, making them less practical for large-scale, iterative FL processes [19].
• Differential Privacy (DP): Both Local DP (LDP) [20] and Central DP (CDP) [21] add calibrated noise to data or gradients, providing rigorous mathematical privacy guarantees (e.g., (ε, δ)-DP). However, a well-known trade-off exists: increased noise for stronger privacy often leads to degraded model utility (accuracy) [5,9].
• Update Perturbation and Obfuscation: Techniques like gradient clipping, pruning, and adding non-DP noise aim to reduce the signal available for inference attacks with potentially lower utility loss than formal DP [17]. These are often heuristic but can be more efficient.

The nascent integration of ZTA and FL is motivated by their synergistic goals: ZTA requires intelligent, data-driven policy engines, and FL provides a means to train such engines on distributed, private data. Recent literature posits this integration as a promising direction. Hu et al. [5] and Gosselin et al. [9] provide an overview of security and privacy in FL, implicitly aligning with ZTA’s “verify explicitly” tenet. Certain studies [17,22] discuss intelligent, adaptive systems for intrusion detection and network security that hint at FL’s potential within a ZTA context. More recently, Haque et al. [23] proposed an adaptive intrusion detection framework combining Proximal Policy Optimization (PPO) with Zero Trust continuous verification [23]. However, a critical research gap remains. Existing works demonstrate the following characteristics:

• Focus on ZTA or FL in isolation.
• Propose FL for ZTA without rigorously addressing the unique inference attack vulnerabilities that FL introduces into the high-stakes ZTA environment.
• Apply generic FL defences like DP without tailoring them to the dynamic, context-aware, and trust-evaluative framework of ZTA.
• Fail to fully integrate mechanisms for handling inherent FL challenges like data heterogeneity [11] into the security-focused ZTA paradigm.

The advent of quantum computing presents a dual-edged sword for privacy-preserving FL in ZTA environments. On one hand, large-scale quantum computers pose an existential threat to current public-key cryptography (e.g., RSA, ECC) that underpins secure communication channels and authentication in ZTA and FL systems [24]. A quantum-capable adversary could potentially decrypt previously intercepted communications or forge digital signatures, compromising the entire trust and verification chain. On the other hand, quantum technologies offer novel opportunities for enhancement. Quantum Key Distribution (QKD) can provide information-theoretically secure key exchange, fortifying the communication layer between ZTA components and FL participants [25]. Furthermore, quantum machine learning algorithms and quantum-inspired optimization may eventually offer more efficient methods for secure aggregation or anomaly detection within the ZT-FL loop. However, these applications remain largely theoretical or confined to laboratory settings. For the problem addressed in this paper—mitigating inference attacks in ZT-FL systems—quantum computing is not a practical solution at this time. The privacy threats from MIAs and PIAs stem from algorithmic information leakage in the ML model itself, not from broken encryption of the communication channel. While quantum-resistant cryptography (post-quantum cryptography) is essential for long-term system viability, defending against inference attacks requires algorithmic innovations at the ML level, such as those proposed in ZT-FL-PE. Therefore, our work focuses on the immediate, non-cryptographic privacy threats, while acknowledging that a comprehensive future-proof solution must eventually integrate both post-quantum cryptographic primitives and robust algorithmic defences.

This paper bridges the identified gaps. We propose ZT-FL-PE, a novel algorithm that is not merely FL applied to ZTA, but a ZTA-driven FL process. It embeds continuous trust evaluation, least-privilege access, and adaptive policy enforcement directly into the FL training loop. Our defence employs a strategic, trust-weighted obfuscation mechanism designed to be more efficient and utility-preserving than blanket DP, specifically tuned to thwart inference attacks while accounting for data heterogeneity challenges, positioning it as a robust solution for the present and a compatible foundation for future quantum-resistant architectures.

3. Membership-Related Attacks in Federated Learning

In an FL setup, each client $k\in \left\{1,\dots ,K\right\}$ possesses a local dataset $D_k$ that is typically insufficient to train a statistically robust model in isolation. Due to privacy and data-governance constraints, clients do not share their raw data with other participants or the central server. Instead, after agreeing on a common model architecture and objective function, each client locally minimizes an empirical risk function expressed as follows:

$$F_k(\omega )={\displaystyle \frac{1}{D_k}}\sum _{(x,y)\in D_k}l(\omega ;x,y)$$

(1)

This it accomplishes utilizing its private data.

During each communication round, clients perform multiple steps of local stochastic gradient descent (SGD) to compute either local gradients or updated model parameters. These updates are sent to the server, which aggregates them—typically via weighted averaging (as in Federated Averaging (FedAvg)) or gradient-based aggregation (as in Federated SGD (FedSGD)) to obtain a global model update. The server then broadcasts the aggregated model back to the clients for the next round of local optimization.

By reducing communication frequency and operating on decentralized, potentially non-IID data distributions, federated optimization introduces unique convergence challenges. Nevertheless, under standard assumptions such as smoothness and bounded variance, algorithms like FedAvg have been shown to converge to stationary points of the following global objective:

$$F(\omega )=\sum _{k=1}^K{\displaystyle \frac{D_k}{D}}{F}_k(\omega )$$

(2)

The global objective in (2) generally focuses on minimizing the weighted empirical risk across all clients. The aggregated global model is then broadcast back to the clients for subsequent rounds of local optimization, and under standard smoothness and bounded variance assumptions, such federated optimization algorithms are known to converge to stationary points of the global objective while significantly reducing communication overhead compared to centralized training. Despite the absence of raw data sharing, FL systems remain vulnerable to various inference attacks that exploit information exposed through model updates or outputs. These attacks can be broadly categorized into Membership Inference Attacks (MIAs), Property Inference Attacks (PIAs), Model Inversion Attacks (MIs), and Model Extraction (model inference) attacks.

MIAs aim to determine whether a specific data sample was included in a target model’s training set. MIAs can be classified into binary classification–based versus metric-based approaches. Binary classification–based MIAs rely on training an auxiliary attack model to distinguish between members and non-members by capturing differences in the target model’s behavior. Typically, the adversary constructs multiple shadow models that replicate the target model’s architecture and training process. The outputs of these shadow models are labeled according to whether the input belongs to the training dataset, and a binary classifier is trained on these labels to predict membership status. Training such classifiers is often challenging due to limited access to representative data and discrepancies between the shadow and target models.

Metric-based MIAs, in contrast, apply a predefined metric to the target model’s outputs and compare the resulting value against a threshold to infer membership [26]. Common metrics include prediction correctness, prediction loss, prediction confidence, adversarial perturbation, and prediction entropy. Prediction entropy quantifies the uncertainty of the model’s output distribution and is defined as;

$$H(x)=-\sum _i{p}_i\left(x\right)\mathit{log}{p}_i\left(x\right)$$

(3)

where $p_i\left(x\right)$ denotes the confidence assigned by the target model to class, $i$ for input sample, $x$.

PIAs, on the other hand, aim to infer sensitive attributes or aggregate properties of training data without accessing the raw data. Early PIAs targeted individual attributes, such as gender, political orientation, or sexual preference, using publicly available information. Later work extended PIAs to infer global properties of the training dataset, including population-level statistics such as age distribution or gender ratios. In a typical PIA scenario, the adversary possesses an auxiliary dataset, partitions it based on the presence or absence of a property, and uses model updates or snapshots to extract features for each subset. An attack model is then trained on this labeled dataset to infer whether the property exists in the target training data.

PIAs can be either passive or active. Passive attacks do not interfere with the training process and rely solely on observing model outputs or updates. Active attacks manipulate the training process, for example, by injecting crafted samples or perturbations—to amplify the distinguishability of the target property. A notable subclass of active PIAs leverages generative models: the adversary samples latent variables $z~p\left(z\right)$ and queries the target generative model to obtain synthetic samples $\tilde{x}=G(z)$, constructs a property classifier on these samples, and defines a function that aggregates classifier outputs to quantify the presence of the property in the underlying training distribution.

Finally, MIs aim to reconstruct sensitive input data from model outputs or parameters. By iteratively optimizing inputs to match target outputs, an adversary can infer features of the training data, such as reconstructing images, text, or other private information. MIs exploit the fact that the global model implicitly encodes information from multiple clients’ datasets.

Model extraction or model inference attacks target the model’s structure or parameters. An adversary may query the model or analyze gradients to replicate its functionality, effectively stealing intellectual property or creating a surrogate model that mimics the original.

In analyzing these attacks, several threat-model assumptions are commonly made:

• Black-box vs. white-box access: In black-box attacks, the adversary can only query the model and observe outputs, whereas in white-box attacks, full access to model parameters and gradients is assumed.
• Honest-but-curious server: The server follows the federated learning protocol correctly but may attempt to infer private information from client updates.
• Malicious clients: Clients may deviate from the protocol to extract information about other clients’ data or the global model.
• Active vs. passive adversaries observe model updates without influencing training, while active adversaries manipulate training inputs, gradients, or aggregation to improve attack success.

Together, these attacks and threat assumptions illustrate that, despite the privacy-preserving design of federated learning, careful defenses including differential privacy, secure aggregation, and gradient obfuscation—are essential to protect client data and model integrity.

4. ZT-Driven FL Privacy Enhancement Algorithm

The decentralized, collaborative nature of FL enables participating clients to train models locally using their private data, while sharing only model parameters with a centralized server for aggregation and consolidation into a global model. This approach inherently enhances privacy. However, FL-based training systems remain vulnerable to Membership Inference Attacks (MIAs), which attempt to extract sensitive information about the training data from the exchanged models.

4.1. ZT-FL-PE Architecture

In this section, we propose and evaluate a ZT-FL-PE framework algorithm with separate client-side and server-side algorithms, explicitly incorporating key elements such as ZTA controls, Adaptive model training, Model personalization, and model obfuscation (privacy protection). The overall framework structure comprises entities such as clients ($C_i$) which are edge devices holding private datasets $D_i$, an FL- server $S$ a FP-PE that aggregates updates and enforces policy, a FP-PE that evaluates trust and access, a PEP that enforces decisions, and finally a Model Registry and Attestation Service that ensures model integrity. The proposed framework is based on key ZT assumptions: that there is no implicit trust in any client or update; that identity, behavior, and model updates are continuously verified; that model access is least privileged; and that all updates are potentially malicious.

Potential threats can take various forms, e.g., an adversary may observe or tamper with model updates or launch inference attacks such as membership, property, or reconstruction. An adversary may submit poisoned or malformed updates, and can also pose as an authenticated but untrusted client.

Summarily, its core features include:

• Privacy-preserving local updates: Each client applies differential privacy or gradient obfuscation to its local model updates before transmission, reducing the risk of MIAs and property inference attacks.
• Secure aggregation with zero-trust verification: The server aggregates client updates using cryptographic protocols that prevent information leakage while enforcing verification of contributions without revealing individual client data.
• Adaptive utility–privacy trade-off: The algorithm dynamically adjusts noise levels and aggregation weights to maintain model performance (utility) while ensuring strong privacy guarantees.
• Computational efficiency: To minimize overhead, ZT-FL-PE employs selective update strategies, pruning redundant gradients, and exploiting partial aggregation techniques without compromising convergence.

The implementation takes place on the client side to protect both the overall FL model and individual client models. It introduces a privacy-sensitive layer that masks and safeguards model updates before they are sent to the FL server. Consequently, the server only receives an aggregated global model containing the masked version of this layer. When clients receive the global model, they restore their original, unmasked privacy-sensitive layer—preserved from the previous FL round—and integrate it with the global model to create a personalized model for predictions. The goal is to assess how different model layers influence Membership Inference Attacks (MIAs), which aim to identify whether a data sample was included in the training data. Using a trained FL model, we examine predictions on both member and non-member samples, calculate gradients for each layer, and analyze the generalization gap the difference between member and non-member gradients. A larger gap suggests a stronger MIA signal, making membership identification easier.

Figure 2 illustrates the overall algorithm structure, where each client executes the process independently. The ZT-FL-PE privacy-preserving strategy targets the penultimate layer, the privacy-sensitive layer, as it is most susceptible to information leakage [18]. While this layer is used locally for predictions, it is always encrypted before updates are sent to the FL server. As a result, the global model stored by the server never contains the raw privacy-sensitive layer. When clients receive the updated global model, they reinsert their previously stored non-obfuscated version, creating a personalised model that balances privacy and predictive performance. To further elaborate on the key steps to be executed by both the client and server-side algorithms, in Table 1, we define the following notations to be used further:

Figure 2. ZT-FL-PE algorithm structure.

Table 1. Notations [20].

Symbol	Description
θt	A global model at the round $t$
${\theta }_i^t$	Local personalized model
${\Delta }_i^t$	Client model update
${\mathrm{T}}_i^t$	Client trust score
${\mathrm{P}}_i$	Personalization layer
$\mathrm{O}(*)$	Obfuscation mechanism
${\eta }_i^t$	Adaptive learning rate
${\epsilon }_i^t$	Privacy budget

The client-side algorithm (Algorithm 1) is outlined as follows:

The initialisation phase commences with the generation of an Obfuscated update ($\widetilde{{\Delta }_i^t}$) from inputs such as the Global model (${\theta }^t$), local data set (${\theta }_i^t$), trust policy ($\Pi$), and Privacy budget (${\epsilon }_i^t$). This is followed by Zero Trust verification, i.e.

$$\mathrm{VeryfyIdentity}\left(C_i\right)\wedge \mathrm{VerifyDeviceState}\left(C_i\right)$$

(4)

If the verification fails, the client aborts participation. Next, Model Personalization, in which the splitting of model parameters takes place;

$${\theta }^t=\left[{\theta }_g^t\prime {\theta }_p^t\right]$$

(5)

followed by the generation of a personalized model:

$${\theta }_i^t={\theta }_g^t\oplus {{\rm P}}_i\left({\theta }_p^t\right)$$

(6)

Adaptive Local Training, which comprises an adaptive learning rate based on trust and data drift:

${\eta }_i^t={\eta }_0\bullet f\left({{\rm T}}_i^t,\nabla L_i\right)$ and local optimization ${\theta }_i^{t+1}={\theta }_i^t-{\eta }_i^t\nabla L\left(D_i,{\theta }_i^t\right)$ follows next.

Computing the update follows next;

$$\widetilde{{\Delta }_i^t}={\theta }_i^{t+1}-{\theta }^t$$

(7)

Model Obfuscation is next.

$$\widetilde{{\Delta }_i^t}=\mathrm{O}\left({\Delta }_i^t,{\epsilon }_i^t\right)$$

(8)

The final step involves secure transmission

$$Send\left(\widetilde{{\Delta }_i^t}\right)\stackrel{mTLS+attestation}{\to }S$$

(9)

Algorithm 1: ZT-FL-PE algorithm on client’s side (Client $C_i$)

//Initialization:    $input\text{\_}$${\theta }^t$, $D_{i`}$, ${\eta }_0$, ${\epsilon }_i^t$, $\Pi$, $P_i(\bullet )$, $O(\bullet )$; %, Global model, Local dataset, Initial learning rate,    Privacy budget, Trust policy, Personalization function, Obfuscation mechanism    $output\_\_$$\widetilde{{\Delta }_i^t}$; % Obfuscated model update    1: //-------- Zero Trust Pre-Access Verification --------    2:  if NOT VerifyIdentity ($C_i$) $\wedge$ VerifyDeviceState ($C_i$) then    3:      Abort participation    4:  end if    5: //-------- Model Personalization --------    6:  Decompose $\theta t$ into shared and personalized parameters:    7:      : ${\theta }^t\leftarrow \left[{\theta }_g^t\prime {\theta }_p^t\right]$    8:  Construct personalized model:    9:      ${\theta }_i^t\leftarrow {\theta }_g^t\oplus {{\rm P}}_i\left({\theta }_p^t\right)$    10://-------- Adaptive Local Training --------    11: Compute local loss gradient:    12:     $g_i^t\leftarrow \forall L(D_i,{\theta }_i^t)$    13: Compute adaptive learning rate:    14:     ${\eta }_i^t\leftarrow {\eta }_0\bullet Adapt(g_i^t,TrustScore(C_i\left)\right)$    15: Update personalized model:    16:   ${\eta }_i^{t+1}\leftarrow {\theta }_i^t-{\eta }_i^t\bullet g_i^t$    17://-------- Model Update Computation --------    18: Compute raw model update:    19:  $\widetilde{{\Delta }_i^t}\leftarrow {\theta }_i^{t+1}-{\theta }^t$    20://-------- Model Obfuscation (Privacy Enforcement) --------    21: Clip update norm:    22:     ${\Delta }_i^t\leftarrow Clip({\Delta }_i^t,C_{max})$    23: Apply obfuscation mechanism:    24:     $\widetilde{{\Delta }_i^t}\leftarrow \mathrm{O}({\Delta }_i^t,{\epsilon }_i^t)$    25://-------- Secure Transmission --------    26: Transmit $\widetilde{{\Delta }_i^t}$ to server using mTLS and remote attestation    27: return $\widetilde{{\Delta }_i^t}$

The Seve-side algorithm (Algorithm 2) focuses on ZT-driven secure aggregation and control, and its key sequential steps are as follows:

• Initialization: It receives obfuscated updates $\left\{\widetilde{{\Delta }_i^t}\right\}$ and in turn updates the global model ${\theta }^{t+1}$.
• Step I: Continuous Trust Evaluation

For each client:

$$T_i^t=g\left(histor{y}_i,\Vert \widetilde{{\Delta }_i^t}\Vert ,behaviour\right)$$

Reject updates if:

$$T_i^t<\tau$$

• Step II: Zero Trust Policy Enforcement

This is subject to controls such as update clipping, Partial aggregation, and increased noise for low-trust clients.

$$PEP(\widetilde{{\Delta }_i^t})\leftarrow PE(T_i^t,\Pi )$$

• Step III: Robust Secure Aggregation

In this case, the _Trust-weighted aggregation is as follows:

$${\theta }^{t+1}={\theta }^t+{\sum }_{i\in C_t}{\omega }_i^t\bullet \widetilde{{\Delta }_i^t},, \mathrm{where} {\omega }_i^t={\displaystyle \frac{T_i^t}{{\sum }_j{T}_j^t}}$$

• Step IV: Global Model Integrity Check

$$verify\ast \left({\theta }^{t+1}\right)\wedge Sign\left({\theta }^{t+1}\right)$$

• Step V: Controlled Model Release

This will be based on the following: Least-privilege model access, Versioned distribution, and enforced re-authentication for the next round.

• Step VI: Privacy–Utility–Trust Trade-off

$$\underset{\theta }{\max } \mathrm{E}\left[\mathrm{U}(\theta )\right] \mathrm{s}.\mathrm{t}. {\displaystyle \sum _{\mathrm{i}}{\epsilon }_{\mathrm{i}}^{\mathrm{t}}}\le {\epsilon }_{\max },T_i^t\ge \tau$$

Algorithm 2: ZT-FL-PE algorithm on the server’s side.

//$\mathit{I}\mathit{n}\mathit{i}\mathit{t}\mathit{i}\mathit{a}\mathit{l}\mathit{i}\mathit{s}\mathit{a}\mathit{t}\mathit{i}\mathit{o}\mathit{n}\mathit{\text{:}}$ $input\text{\_}00$, $C$, $\tau$, $g(\cdot )$, $\mathrm{Agg}(\cdot )$, $\Pi$, $\mathit{T}`$;%, initial Global model, client set, Trust threshold, Trust evaluation function, aggregation function, ZT policy, total round $output\_\_\theta \mathit{T}$, % final global model 1: initialize, $00$ 2:  for $t=0$ to $\mathit{T}-1$ do 3:     //-------- Zero Trust Client Admission -------- 4:      $C_t\leftarrow 0$ 5:      for each $C_i\in C$ do 6:          if $\mathit{V}\mathit{e}\mathit{r}\mathit{i}\mathit{f}\mathit{y}\mathit{I}\mathit{d}\mathit{e}\mathit{n}\mathit{t}\mathit{i}\mathit{t}\mathit{y}\left({\mathit{C}}_{\mathit{i}}\right)\&\mathit{V}\mathit{e}\mathit{r}\mathit{f}\mathit{i}\mathit{y}\mathit{P}\mathit{o}\mathit{l}\mathit{i}\mathit{c}\mathit{y}\mathit{C}\mathit{o}\mathit{m}\mathit{p}\mathit{l}\mathit{i}\mathit{a}\mathit{n}\mathit{c}\mathit{e}({\mathit{C}}_{\mathit{i}},\mathit{\Pi })$ then 7:             $C_t\leftarrow C_t\cup \left\{C_i\right\}$ 8:          end if 9:      end for 10:      Broadcast ${\theta }_t$t to all $C_i\in C_t$ 11:    //-------- Secure Update Collection -------- 12:     Receive obfuscated updates ${\}}^{~}$ from $C_t$ 13:    //-------- Continuous Trust Evaluation -------- 14:     for each received update $\widetilde{{\Delta }_i^t}$ do 15:        $T_i^t\leftarrow g(C_i history,\widetilde{{\Delta }_i^t} statistics, behaviour metrics)$ 16:        if ${{\rm T}}_i^t<\tau$ then 17:            Reject $\widetilde{{\Delta }_i^t}$ 18:         end if 19:     end for 20:    //-------- Zero Trust Policy Enforcement ----------- 21:     for each accepted update $\widetilde{{\Delta }_i^t}$ do 22:         $\widetilde{{\Delta }_i^t}\leftarrow EnforcePolicy(\widetilde{{\Delta }_i^t},{\mathrm{T}}_i^t,\mathsf{\Pi })$ 23:     end for 24:    //-------- Robust Secure Aggregation -------- 25:     ${\theta }^{t+1}\leftarrow {\theta }^t+Aggr(\widetilde{{\Delta }_i^t},\{{\mathrm{T}}_i^t\})$ 26:    //-------- Model Integrity Verification -------- 27:     if NOT $VerifyModelIntegrity\left({\theta }^{t+1}\right)$ then 28:         Rollback to ${\theta }^t$ 29:     end if 30:    //-------- Controlled Model Release -------- 31:     Sign ${\theta }^{t+1}$ 32:     Log all trust and policy decisions 33: end for 34: return $\theta {\rm T}$

The following algorithm (Algorithm 3) is the trust-weighted robust algorithm utlised in Algorithm 2.

Algorithm 3: Trust Weighted Robust Aggregation (used in Algorithm 2)

$Input\text{\_}$$\widetilde{\{{\Delta }_i^t\}}$, $\left\{{{\rm T}}_i^t\right\}$ % Obfuscated updates, Trust scores $output\text{\_}{\Delta }_t$ % Aggregated update 1:  Normalize trust weights: 2:      ${\omega }_i^t\leftarrow {{\rm T}}_i^t/{\sum }_j{{\rm T}}_j^t$ 3:  Remove outlier updates using a robust filter: 4:      $\tilde{\Delta }filtered\leftarrow RobustFilter(\widetilde{\{{\Delta }_i^t\}})$ 5:  Aggregate updates: 6:      ${\Delta }^t\leftarrow {\sum }_i{\omega }_i^t\cdot {\Delta }^{~} filtered\left[i\right]$ 7:  return ${\Delta }^t$

4.2. Mathematical Formalization and Theoretical Analysis

The core innovation of ZT-FL-PE is the operationalization of the ZTA principle across the FL workflow. This is achieved through a dynamic, multi-factor trust score ${{\rm T}}_i^t\in \left[0,1\right]$ for each client $C_i$ at round $t$, which governs their participation, influence, and the level of privacy obfuscation applied. The score is not static; it evolves based on continuous behavioural telemetry and context. We define the trust evaluation function $g(\cdot )$ (from Algorithm 2, Step 15) as a weighted composite of historical, behavioural, and contextual signals:

$${{\rm T}}_i^t={\lambda }_H\cdot H_i^t+{\lambda }_B\cdot {{\rm B}}_i^t+{\lambda }_C\cdot C_i^t$$

(10)

subject to

$${\lambda }_H+{\lambda }_B+{\lambda }_C=1$$

(11)

where

$\left({\mathit{H}}_{\mathit{i}}^{\mathit{t}}\right)$- is a moving average of past contributions, penalizing volatility, and is often referred to as a historical trust. Note that if Update ${{\Delta }^{~}}_i^{t-1}$ was accepted, then

$$\mathrm{d}{H}_i^t=\beta \cdot {{\rm T}}_i^{t-1}+\left(1-\beta \right)\cdot {\rm I}$$

(12)

where $\beta \in \left(0,1\right)$ is a decay factor that emphasizes recent behaviour.

Behavioural Trust $\left({\mathit{{\rm B}}}_{\mathit{i}}\mathit{t}\right)$: Measures the statistical “normality” of the client’s update relative to the population, detecting outliers or potential poisoning.

$${{\rm B}}_i^t=\mathit{exp}\left(-{\displaystyle \frac{{\Vert {{\Delta }^{~} }_i^t-{\mu }_{\Delta }^t\Vert }_2^2}{2\cdot {\left({\sigma }_{\Delta }^t\right)}^2+\epsilon }}\right)$$

(13)

${\mu }_{\Delta }^t$ and ${\sigma }_{\Delta }^t$ are the mean and standard deviation of all updates in the round $t$. This term uses a Radial Basis Function (RBF) to assign high trust to updates close to the consensus and low trust to statistical outliers.

Contextual Trust $\left({\mathit{C}}_{\mathit{i}}^{\mathit{t}}\right)$: Encodes real-time ZTA signals (device posture, network location, time-of-access).

$$C_i^t=sigmaoid\left({\omega }_1\cdot PostureScore+{\omega }_2\cdot GeoCompliance-\xi \right)$$

(14)

This transforms binary or categorical policy checks (e.g., “device encrypted”, “on corporate VPN”) into a continuous trust metric. The threshold $\xi$ allows for strict policy enforcement. Dynamic Adjustment Across Learning Phases is accomplished in three phases as follows:

• Initial Phase $\left(\mathit{t}=0\right)$: Trust is bootstrapped via strong cryptographic authentication $\left(C_i^0\right)$ and may rely on initial attestation. Weights ${\lambda }_C$ are high.
• Mid-Training Phase: As historical data accumulates, ${\lambda }_H$ increases, allowing the system to identify consistently reliable or unreliable clients. ${{\rm B}}_i^t$ becomes critical for detecting model drift or concept drift in non-IID data, as updates from a client whose local data distribution diverges significantly will appear as outliers.
• Late Phase/Convergence: The system stabilizes. $H_i^t$ dominates, rewarding clients with long-term, consistent participation. The adaptive mechanism automatically reduces the verification overhead for high-trust clients (e.g., by sampling their updates for full audit less frequently), while maintaining scrutiny on low-trust clients.

Algorithm Complexity Analysis

The computational and communication overhead introduced by ZT-FL-PE is additive and scales linearly with standard FL operations. Let $N$ be the number of clients, $P$ the number of model parameters, and $K$ the size of the historical window for trust evaluation.

Client-Side Complexity per Round:

• Local SGD Training: $0\left(\left|D\right|\cdot P\right)$, where $\left|D_i\right|$ is the local dataset size. This is unchanged from standard FL
• ZT Operations: The additional steps—model personalization, norm clipping, lightweight obfuscation $0(\cdot )$, and secure transmission preparation are all $0\left(P\right)$. The dominant cost remains the local training. The adaptive verification (Step I in Algorithm 2) involves a constant-time cryptographic handshake, $0\left(1\right)$.

Server-Side Complexity per Round:

• Trust Score Computation: Calculating ${{\rm B}}_i^t$ for all clients involves computing the mean and variance of $N$ updates of size $P$, resulting in $0\left(N\cdot P\right)$ complexity. Updating $H_i^t$ is $0\left(N\cdot K\right)$.
• Trust-Weighted Aggregation: This is a weighted sum of $N$ vectors of size $P$, which is $0\left(N\cdot P\right)$, identical to the aggregation cost in FedAvg.
• Policy Enforcement & Integrity Checks: These operations are also linear in model size or number of clients, $0\left(N\cdot P\right)$.

Total Overhead: Both client and server overheads scale as $0\left(P\right)$ and $0\left(N\cdot P\right)$ respectively, aligning with the fundamental complexity of federated learning. The constant factors are increased due to cryptographic and trust computations, but the asymptotic scalability remains unchanged. This analysis confirms the feasibility of deployment in large-scale, heterogeneous networks.

Convergence Guarantees

We provide a theoretical sketch demonstrating that ZT-FL-PE converges to a stationary point of the global objective under standard assumptions, despite the introduced trust-weighting and obfuscation. This is done under the following assumptions:

• L-Lipschitz Smooth Gradient: The global loss function $F\left(\omega \right)$ has L-Lipschitz continuous gradients.
• Bounded Stochastic Gradient Variance: The variance of stochastic gradients on each client is bounded by ${\sigma }^2$.
• Bounded Trust-Induced Perturbation: The trust-weighted aggregation and privacy obfuscation introduce a bounded bias. Formally, the aggregated update ${\Delta }^t$ satisfies:

$${\rm E}\left[{\Delta }^t\right]=\forall F\left({\omega }^t\right)+{\xi }^t, \mathrm{with}\Vert {\xi }^t\Vert \le \Gamma , \mathrm{and} \mathrm{its} \mathrm{variance} \mathrm{is} \mathrm{bounded} \mathrm{by} {\tilde{\sigma }}^2$$

(15)

Rationale for Bounded Perturbation: The trust weights $\omega t_i$ are normalized $\left({\sum }_i{\omega }_i^t=1\right)$ and the obfuscation function $0(\cdot )$ (e.g., bounded noise injection, clipping) is designed to have a finite, tunable impact. This ensures $\Gamma$ is a controllable parameter.

Convergence Result: Using a decaying learning rate ${\eta }_t={\displaystyle \frac{\gamma }{\sqrt{t}}}$, the expected gradient norm after $\mathrm{T}$ rounds is bounded by:

$${\displaystyle \frac{1}{T}}\sum _{t=1}^{{\rm T}}{\rm E}{\Vert \forall F\left({\omega }^t\right)\Vert }^2\le {\displaystyle \frac{C_1}{\sqrt{{\rm T}}}}+C_2\cdot {\Gamma }^2$$

(16)

where $C_1$,$C_2$ are constants depending on $L$, ${\sigma }^2$, ${\tilde{\sigma }}^2$, and the initial conditions. Note that in the term ${\displaystyle \frac{C_i}{\sqrt{T}}}$ represents the standard sublinear convergence rate of SGD-based methods. The term $C_2\cdot {\Gamma }^2$ is a non-vanishing bias introduced by our ZTA-driven modifications. Crucially, $\Gamma$ is a design parameter controlled by the intensity of the privacy obfuscation and the selectivity of the trust filter. By setting these mechanisms to operate within moderate bounds (as evidenced by our empirical results showing minimal accuracy loss), $\Gamma$ remains small. Thus, ZT-FL-PE converges to a neighbourhood of a stationary point, with the neighbourhood radius proportional to the strength of the privacy and trust enforcement. This theoretical insight aligns perfectly with our experimental findings: ZT-FL-PE achieves a near-identical final accuracy as non-private FL (a small $\Gamma$) while providing substantial privacy and security enhancements. The framework offers a principled trade-off where increased security/privacy $\left(\Gamma \right)$ can be explicitly balanced against model utility.

In summary, the ZT-FL-PE algorithm provides:

• Adaptive Security: A mathematically defined trust score that dynamically adjusts verification rigor based on client behaviour and the learning phase.
• Controlled Overhead: Computational and communication complexity that preserves the fundamental scalability of federated learning.
• Provable Convergence: Formal guarantees of convergence to a bounded region around an optimal point, with the region size explicitly linked to the privacy-security parameters.

As such, this formal foundation demonstrates that the integration of Zero Trust principles is not merely a heuristic addition but a rigorously designed component that enhances security and privacy while maintaining the core performance guarantees of federated learning.

5. Performance Results and Discussion

To ensure comprehensive evaluation across diverse domains and to rigorously validate the generalization of ZT-FL-PE for real-world ZTA scenarios, we employed datasets spanning image recognition, speech processing, structured tabular tasks, and critically, network security and endpoint management. The latter domains are of paramount importance as they directly mirror the data sources (network logs, device telemetry) used for AI-driven policy engines in ZTA. Table 2 summarizes all datasets. The inclusion of UNSW-NB15 and CIC-IDS2017 allows us to test FL-PE’s efficacy in privacy-preserving collaborative intrusion detection. The Drebin dataset tests its application to malware classification across heterogeneous mobile endpoints, a common challenge in zero-trust environments.

Table 2. Datasets used for Evaluation.

Dataset	Type	Samples	Classes	Resolution/Features	Reference
CIFAR-10/100	Object Images	60,000	10/100	32 × 32 px	[24]
GTSRB	Traffic Signs	52,000	43	Variable sizes	[27]
Speech Commands	Audio	~65,000	35 commands	1 s clips	[28]
Purchase100	Transactional	197,324	100	600 features	[29]
Texas100	Healthcare	67,330	100	6170 features	[30]
CelebA	Facial Images	~203,000	40 attributes	178 × 218 px	[31]
UNSW-NB15	Network Traffic	~2.5 M	49 features/multi-class	Structured logs	[32]
CIC-IDS2017	Network Intrusion	~2.8 M	80+ features/Benign + Malicious	Structured flows	[33]

We benchmarked the proposed framework against three established privacy-preserving mechanisms from the literature: Local Differential Privacy (LDP), Central Differential Privacy (CDP), and Weak Differential Privacy (WDP). All experiments were conducted using PyTorch ver 2.10 [34] with NVIDIA A100 GPUs. The federated learning setup involved 100 clients with non-IID data distribution, following standard practices in federated learning research [9,17]. Each experiment was repeated 10 times with different random seeds, and results are reported as mean ± standard deviation.

We focused on evaluating metrics such as Attack Success Rate (ASR), Attack AUC (50% = random guessing), Privacy Budget Utilization, Model Utility, alongside computational metrics (time complexity, memory footprint, and communication overhead). We evaluated against established attack methodologies from the literature, including Membership Inference Attacks (MIA) [13,14], property inference attacks [15], gradient leakage attacks [16,17], and adversarial performance metrics.

We begin by examining how the proposed algorithm defends against membership inference attacks (MIAs) on both local and global models. Following established methodologies [13,14], each dataset is split into training and test sets, with half of the data allocated as the adversary’s prior knowledge and the remaining portion used for evaluation. We benchmark it against common defenses, namely WDP, LDP, and CDP [9,17].

Figure 3, Figure 4 and Figure 5 present the attack AUC for local and global models separately, with each bar representing a different defense. Across all evaluated datasets, ZT-FL-PE consistently lowers the attack AUC toward the random baseline of 50%, demonstrating strong privacy protection.

Figure 3. Comparative Analysis of Privacy Leakages: ZT-FL-PE vs. State-of-the-Art Protection Mechanisms.

Figure 4. Comparative Analysis of Privacy Leakages: FL-PE vs. State-of-the-Art Protection Mechanisms.

Figure 5. Comparative Analysis of Privacy Leakages: ZT-FL-PE vs. State-of-the-Art Protection Mechanisms.

Differential privacy methods, by contrast, demonstrate less reliable performance. For instance, on local models, ZT-FL-PE achieves up to a 29% reduction in privacy leakage (Figure 3), whereas WDP yields only 3%, and CDP reaches 25%.

This effectiveness arises from ZT-FL-PE’s design: sensitive layers are concealed, and parameters are substituted with randomized values. The resulting perturbation ensures that adversaries observe a distorted version of the target model, making its outputs difficult to align with those of the shadow model. This undermines the attack process and explains the observed drop in AUC. To assess the influence of ZT-FL-PE on model behavior, we study the loss profiles of member and non-member samples under each defense. Ideally, these distributions should overlap—preventing membership signals—while remaining concentrated around low loss values to reflect good predictive performance. On the Purchase100 dataset, we compute the loss separately for members and non-members across all defense settings.

The results show that ZT-FL-PE effectively reduces divergence between the two distributions while retaining mostly low loss values. Differential privacy mechanisms, however, either fail to close the gap or cause substantial accuracy loss.

Finally, for computational efficiency, we analyze the resource costs of ZT-FL-PE relative to differential privacy. We consider three metrics: client training time per round, server aggregation time, and GPU memory usage.

As illustrated in Figure 6, LDP, WDP, and CDP introduce significant slowdowns due to noise addition and gradient perturbation. ZT-FL-PE, however, incurs negligible computational cost, since its protection mechanism relies on lightweight parameter obfuscation rather than expensive gradient manipulation. This enables ZT-FL-PE to maintain efficiency while ensuring robust privacy, effectively addressing one of the primary drawbacks of differential privacy in FL. We further evaluate the temporal cost of server-side aggregation across different privacy-preserving configurations. Aggregation latency is the time elapsed between receiving all client model updates and transmitting the aggregated model. The simulation results in Figure 7 demonstrate that CDP incurs substantial latency overhead, primarily because it injects calibrated noise into the global parameter set prior to dissemination. This operation significantly prolongs the aggregation process, with delays of seconds observed in our experiments.

Figure 6. Client-side model training time frames.

Figure 7. Server-side FL aggregation time frames.

Conversely, ZT-FL-PE, LDP, and WDP exhibit aggregation times of comparable order to the non-privacy-preserving baseline, indicating that these approaches introduce negligible additional computational burden during aggregation.

We further evaluate GPU memory utilization, with an emphasis on the overhead induced by differential privacy (DP) mechanisms. Local DP, Central DP, and Weak DP each impose substantial memory requirements, resulting in a 15% increase over the no-defence baseline. This overhead stems primarily from (i) storing calibrated noise vectors, (ii) maintaining privacy budget bookkeeping, and (iii) buffering model updates prior to perturbation. As shown in Figure 8, ZT-FL-PE, in contrast, avoids noise injection and budget management by design, thereby incurring negligible GPU memory overhead, making it memory-optimal relative to DP-based defences.

Figure 8. Client-side memory utilisation.

Overall, while aggregate metrics (Figure 6, Figure 7 and Figure 8) demonstrate ZT-FL-PE’s efficiency relative to DP-based methods, a granular breakdown is essential to assess its practical deployment feasibility. We further breakdown the per-round computational overhead on a standard client device (8-core CPU, 16 GB RAM) for the CIFAR-100 experiment, comparing the baseline (No Defense), ZT-FL-PE, and CDP as a representative high-overhead method.

The breakdown reveals that ZT-FL-PE’s primary overhead sources are (1) the essential ZTA verification steps and (3) its efficient update obfuscation. Crucially, it avoids the expensive noise injection and privacy accounting that dominate CDP’s cost (Update Processing). The ~5% increase in total runtime is a reasonable trade-off for integrated ZTA compliance and strong privacy. The server-side overhead (additional logic for trust-weighted aggregation) is moderate and scales linearly with the number of clients, making it manageable for enterprise-grade infrastructure.

6. Conclusions

We proposed and evaluated a ZT-FL-PE algorithm designed primarily to address one of the most pressing privacy risks in FL MIAs. Unlike existing solutions, ZT-FL-PE was tested across a wide range of datasets, neural network architectures, and advanced privacy-preserving mechanisms, showing consistent performance. Our results demonstrate that the algorithm not only enhances privacy but also preserves model accuracy while maintaining low and well-understood computational costs—making it both effective and practical for real-world deployment. The overhead analysis, as provided in Table 3, confirms that ZT-FL-PE’s primary cost stems from mandatory ZTA verification, not from cumbersome cryptographic or noise-addition processes, resulting in a modest ~5% runtime increase over an undefended baseline.

Table 3. Per-Round Client-Side Computational Overhead Breakdown (Mean ± Std Dev in seconds).

Component	No Defense	ZT-FL-PE	Central DP (CDP)
1. ZT Verification & Auth	0.05 ± 0.01	0.22 ± 0.03	0.05 ± 0.01
2. Local Model Training	12.41 ± 0.85	12.50 ± 0.91	12.45 ± 0.88
3. Update Processing	0.02 ± 0.00	0.15 ± 0.02	1.85 ± 0.15
4. Cryptographic Operations	0.10 ± 0.02	0.35 ± 0.05	0.12 ± 0.02
Total Client Time/Round	12.58 ± 0.87	13.22 ± 0.95	14.47 ± 1.02
Server Aggregation Overhead	Low	Moderate	High

Importantly, its benefits extend beyond membership inference. The algorithm shows strong potential to defend against broader privacy threats across diverse data domains, including network intrusion detection and endpoint security, as validated on multiple cross-domain benchmarks. This makes it a versatile tool for safeguarding FL systems within the heterogeneous data ecosystems of modern enterprises. Furthermore, integrating quantum-secure communication protocols could enhance the security of model update transmissions against emerging quantum threats, paving the way for even stronger defenses in FL systems.