Privacy-Enhanced Stable Federated Learning for Statistically Heterogeneous Geospatial Data

Abstract

To address statistical heterogeneity and update-level privacy risks in federated learning for geospatial data, this paper proposes a hierarchically decoupled collaborative framework that integrates client-side privacy perturbation with server-side consistency-aware aggregation, while incorporating governance as a system-level support module. Under strong non-IID conditions, the proposed soft-weight aggregation strategy mitigates update mismatch and improves convergence stability without hard filtering legitimate but distributionally shifted client contributions. Meanwhile, the risk-aware perturbation mechanism adaptively adjusts clipping and noise strength across clients to better balance privacy protection and model utility. An on-chain governance and off-chain training coordination mechanism is further introduced to support auditable and traceable collaboration without interfering with the main optimization process. Experimental results on EuroSAT_RGB with ResNet-18 show that the proposed design achieves more stable training and better overall performance than the compared baselines, especially under severe heterogeneity. These findings highlight the value of jointly considering privacy-aware perturbation and consistency-aware aggregation for improving training stability and preserving utility in geospatial federated learning under statistically heterogeneous settings.

1. Introduction

With the rapid development of remote sensing technology and large-scale spatial data platforms, geospatial data have achieved significant growth in both data scale and application scope [1]. The widespread deployment of mobile sensing devices and Internet of Things (IoT) infrastructures has further accelerated the accumulation of urban sensing data, providing important support for urban governance and intelligent management [2]. At the same time, high-resolution remote sensing imagery and Geographic Information System (GIS) data have been widely applied in scenarios such as environmental monitoring, land-use classification, and disaster early warning [3]. Benefiting from recent advances in deep learning, intelligent analysis of large-scale geospatial data has made remarkable progress, especially in tasks such as remote sensing image classification, spatial semantic modeling, and object recognition [4].

On public remote sensing datasets such as EuroSAT and BigEarthNet, deep learning models have already achieved performance levels close to, or even sufficient for, real-world application requirements, significantly promoting the deployment of intelligent remote sensing processing systems. However, geospatial data are usually inherently sensitive. On the one hand, such data contain information related to geographic locations, land-use structures, and regional functional distributions, and their statistical patterns often exhibit strong “spatial fingerprint” characteristics. On the other hand, multi-source spatial data usually involve sensitive information from government agencies, enterprises, and individual users. If such data are directly centralized for training, potential privacy leakage risks may arise [5]. With the continuous increase in requirements for data security and privacy compliance, how to achieve effective collaborative learning without sharing raw data has become a key issue that urgently needs to be addressed [6,7].

Federated learning (FL) provides a natural solution to this challenge. It allows multiple clients to jointly train a shared model without transmitting raw data, and each client exchanges only model parameters or updates with the server. The classical Federated Averaging (FedAvg) algorithm establishes the basic framework of FL: clients perform several steps of local optimization and then upload model updates, which are aggregated by the server to iteratively construct a global model [8]. As a decentralized machine learning paradigm, FL has been widely applied in recent years to scenarios such as mobile device learning, medical data analysis, financial risk control, and smart city systems [8,9,10].

For geospatial applications, FL is particularly attractive because it can support collaborative modeling among distributed data holders while reducing the direct exposure risk of raw spatial data. Nevertheless, FL for geospatial data still faces two core challenges. First, statistical heterogeneity is widespread. Data collected by different clients usually originate from different regions, sensing conditions, and semantic environments, and local datasets often exhibit significant non-IID characteristics [11,12]. Such heterogeneity amplifies the differences among client updates, leading to unstable aggregation, slower convergence, and even significant performance degradation [13,14]. Existing robust aggregation methods are often unable to fully adapt to strongly heterogeneous settings, and legitimate but distributionally shifted updates are prone to being misjudged and excessively suppressed [15]. Second, even without sharing raw data, model updates may still expose information related to regional scenes, land-use structures, and semantic characteristics, thereby introducing update-level privacy risks. Existing differential privacy (DP)-based methods usually rely on clipping and noise injection, but when heterogeneity is strong, applying a uniform perturbation intensity may further amplify update bias and damage model utility [16]. Therefore, in geospatial FL, privacy protection and aggregation stability should not be treated separately, but should instead be considered in a coordinated manner.

In addition, from the perspective of system deployment, in a multi-party collaborative environment lacking a fully trusted foundation, relying solely on algorithmic assumptions remains insufficient. Privacy policies, aggregation rules, and participation constraints need to remain transparent, auditable, and consistently enforced throughout long-term training. Blockchain-assisted governance therefore has potential value as a system-level support mechanism for rule recording, collaborative coordination, and audit traceability.

Based on the above observations, this paper constructs an FL framework for statistically heterogeneous geospatial data, with the goal of improving training stability and collaborative reliability without sacrificing practical efficiency. The main contributions of this paper are summarized as follows:

1.

A risk-aware client-level privacy perturbation mechanism is proposed. This method leverages reproducible statistical and semantic features to impose differentiated privacy protection on different clients, thereby achieving a better balance between privacy protection and model utility.

2.

A consistency-aware aggregation strategy is designed to alleviate training instability under heterogeneous data conditions and to reduce the systematic suppression of client updates that are legitimate but distributionally different.

3.

A collaborative framework integrating on-chain governance with off-chain FL training is constructed. As a system-level support module, the governance layer provides auditable and traceable support for multi-party collaboration without directly interfering with the main optimization process.

2. Related Work and Preliminaries

Remote sensing and geospatial data are often distributed across different regions, institutions, and sensing platforms. Therefore, FL provides an appropriate paradigm for collaborative modeling without centralizing raw data [11]. However, applying FL in this domain still involves two closely coupled core challenges. Firstly, shared model updates may still expose statistical characteristics or semantic cues associated with local geospatial data, thereby introducing update-level privacy risks [17,18,19]. Secondly, significant statistical heterogeneity may cause legitimate client updates to deviate markedly from the dominant distribution, thereby aggravating aggregation bias and undermining training stability [12,13,20]. In long-term cross-institutional collaboration, these technical issues are further intertwined with governance requirements such as rule enforcement, participant management, and process traceability. Therefore, in geospatial FL, privacy protection, stable aggregation, and trustworthy collaboration should not be considered in isolation.

Existing studies have mainly progressed along three directions: FL in remote sensing scenarios, robust aggregation under statistical heterogeneity, and governance support mechanisms for trustworthy collaboration [11,12,13,21,22,23]. However, most existing studies examine these issues separately, and limited attention has been paid to their coordinated design in highly heterogeneous geospatial settings. In particular, when client semantic distributions are severely imbalanced, privacy perturbation and aggregation mechanisms may interact with each other, further amplifying update inconsistency and making collaborative training more difficult to stabilize. To more clearly position the present work, this section reviews the literature along these three directions and further analyzes the limitations of existing studies from the perspective of coordinated design.

2.1. FL in Remote Sensing Scenarios

In remote sensing and Earth observation scenarios, data are often constrained by geographic sensitivity, institutional ownership, and policy compliance requirements. Therefore, FL is highly attractive for tasks such as remote sensing scene classification, object recognition, and multi-source data fusion. For example, Ben Youssef et al. evaluated the effectiveness of FL for remote sensing scene classification on real datasets and compared the performance of convolutional and Transformer-based models in this setting [24]. Moreno-Álvarez et al. further pointed out that heterogeneity in remote sensing scenarios is fundamentally different from that in conventional mobile-device FL settings [11]. Pei et al. proposed a hierarchical federated edge learning framework for satellite–ground collaborative networks and introduced a multi-level aggregation mechanism across satellite, ground, and cloud layers [25]. Hu et al. proposed a heterogeneity-aware pruning framework for personalized FL in remote sensing scene classification, where structural adaptation and personalized model pruning were used to alleviate resource and distribution disparities across clients [26]. Jin and Wang proposed a semi-decentralized federated framework for remote sensing scene classification, showing that system topology and collaboration mode themselves can also affect training stability and scalability in remote sensing environments [27]. Lin et al. further introduced vision–language models into federated remote sensing scene classification and proposed FedRSCLIP, which balances global knowledge sharing and local adaptability through parameter-efficient prompt learning [28]. Tan et al. proposed FedSense for pre-training remote sensing foundation models and employed federated mutual-guidance learning to mitigate model drift caused jointly by remote sensing heterogeneity and high communication overhead [29]. These studies indicate that remote sensing FL has moved beyond mere feasibility verification and is increasingly driven by practical issues such as data heterogeneity, privacy constraints, and cross-institutional deployment. It is also gradually evolving from single-model classification toward more realistic and complex application forms, including personalized collaboration, semi-decentralized cooperation, and foundation model pre-training.

Meanwhile, avoiding raw-data sharing does not imply that privacy risks naturally disappear. Existing studies have shown that shared model updates may still leak information related to local training data, especially in semantically sensitive remote sensing scenarios, where model updates often carry statistical traces of scene composition and regional characteristics [30]. Gong et al. systematically analyzed gradient leakage attacks in FL and showed that, under certain conditions, training samples can be partially reconstructed from shared gradients [17]. Du et al. further reviewed the key factors affecting gradient leakage, including model architecture, training configuration, and gradient post-processing strategies [18]. Wang et al. showed that even after secure aggregation, aggregated gradients may still leak label-related information, indicating that “sharing only updates” is not inherently secure [19]. To mitigate such risks, a common approach is to apply gradient clipping and noise injection to client updates before uploading, thereby reducing the possibility of recovering sensitive information from shared updates [16]. Yan et al. pointed out that appropriate perturbation can reduce the reconstruction quality of gradient inversion attacks [30], while Hu et al. found that DP-style noise mechanisms can, to some extent, reduce the success rates of label inference and gradient leakage attacks [31].

Recent studies have increasingly suggested that privacy perturbation should not be regarded as a static and uniform processing layer. For example, Zheng et al. proposed a sensitivity-aware DP method for federated medical imaging, showing that privacy protection can be adaptively adjusted according to data sensitivity so as to better balance privacy preservation and model utility [32]. Kianidehkordi et al. proposed a time-adaptive privacy budget allocation strategy that allows clients to spend privacy budgets non-uniformly across training rounds, thereby improving the privacy–utility trade-off [33]. Liu et al. further proposed an adaptive clipping-threshold mechanism, whereby the clipping intensity and noise scale in each training round can vary dynamically with the distribution of update norms, thus better matching the differences among clients and training stages under non-IID conditions [34]. These studies imply that privacy perturbation is not merely a “leakage prevention” component; rather, it also dynamically changes the scale and geometric structure of uploaded updates. However, most existing work still evaluates perturbation mainly from the perspective of leakage suppression or general utility preservation, while insufficient attention has been paid to how perturbation affects aggregation fairness and convergence stability under highly heterogeneous geospatial conditions. Therefore, for geospatial FL, the key issue lies not only in reducing update-level privacy risks, but also in maintaining aggregation fairness and collaborative training stability after perturbation is introduced. This also constitutes one of the direct motivations of this paper, namely, to jointly design client-side privacy protection and consistency-aware aggregation, rather than treating them as two independent problems.

2.2. Robust Aggregation Methods Under Statistical Heterogeneity

Robust aggregation methods were originally developed mainly to defend against Byzantine attacks and abnormal client behavior, with the core objective of maintaining global training stability in the presence of unreliable updates [35,36]. As FL has gradually moved toward practical deployment, such methods have also been widely adopted to alleviate training instability caused by statistical heterogeneity [12,13]. Existing methods can generally be divided into two categories: optimization-correction-based methods, which mainly mitigate client drift by correcting the local optimization process, and robust statistical aggregation methods, which mainly suppress highly deviated updates during server-side aggregation.

“Client drift” refers to the phenomenon that, under heterogeneous data distributions, the local optimization direction of FedAvg deviates from the global optimum [37]. Accordingly, optimization-correction-based methods usually compensate for local update bias or constrain excessive deviation between local and global models by introducing gradient correction, control variates, regularization constraints, or proximal terms [37,38,39]. In contrast, robust statistical aggregation methods more often suppress the influence of outlier updates through filtering, clipping, or reweighting. Representative methods include coordinate-wise median, trimmed mean [35]. and distance-based selection methods such as Krum [36]. However, under label skew and strongly non-IID conditions, large deviations do not necessarily indicate malicious or abnormal behavior; they may also arise from legitimate client updates with substantial distribution shifts [15,20]. Therefore, while suppressing abnormal updates, such methods may also mistakenly penalize clients whose updates are genuinely useful but distributionally different from the majority.

Overall, optimization-correction-based methods usually assume that all client updates are legitimate, whereas robust statistical aggregation methods tend to treat large deviations directly as abnormal signals. Both types of methods find it difficult to effectively distinguish between “truly harmful updates” and “legitimate but distributionally shifted updates,” which means that gains in robustness may come at the cost of suppressing heterogeneous information [15]. This issue is particularly prominent in geospatial FL scenarios, because heterogeneity may simultaneously arise from multiple sources, including geographic regional differences, land-cover composition differences, imaging-condition differences, sensor discrepancies, and variations in client data volume [11,12,13]. Recent remote sensing FL studies, such as HAPF, FedRSCLIP, FedSense, and Fed-RSSC, further indicate that heterogeneity in realistic remote sensing collaboration is reflected not only in label distributions, but also in model structure, parameter-efficient update strategies, communication patterns, and system topology [26,27,28,29]. Therefore, when the system simultaneously faces strong heterogeneity and noisy updates, existing methods often struggle to balance training stability with the preservation of heterogeneous information.

In recent years, researchers have begun to re-examine client update discrepancies from the perspective of distributional consistency and have attempted to incorporate discrepancy modeling directly into the aggregation stage. Existing studies have used metrics such as Hellinger distance, KL divergence, and JS divergence to quantify the deviation between a client distribution and a reference distribution [20,40,41,42]. Compared with earlier strategies that simply regarded large deviations as “abnormal,” this line of work places greater emphasis on distinguishing legitimate distribution shifts from truly harmful abnormal deviations and continuously adjusting client contributions according to the degree of inconsistency. This idea is more closely aligned with the geospatial setting considered in this paper. However, even within the direction of consistency-aware aggregation, existing studies have rarely further analyzed how privacy perturbation changes the relative discrepancy structure among client updates, especially when semantic distributions are severely imbalanced. Therefore, the interaction between privacy perturbation and consistency-aware aggregation remains insufficiently studied, particularly in semantically sensitive geospatial FL scenarios with significant statistical heterogeneity.

2.3. Blockchain-Assisted Governance Mechanisms for FL

In addition to privacy leakage and statistical heterogeneity, cross-party FL also faces practical challenges during long-term collaboration, such as rule enforcement, participant management, and traceable recording of critical events. To address these issues, blockchain has increasingly been introduced into FL as a supporting infrastructure for trustworthy collaboration. In existing blockchain-assisted FL frameworks, blockchain typically undertakes responsibilities such as participant registration, task publication, permission or incentive management, and confirmation of critical collaborative events, whereas local training and model aggregation are usually executed off-chain to avoid the high on-chain overhead caused by iterative high-dimensional computation [21,43].

Representative studies along this line have explored several paths. Some works combine blockchain with secure aggregation or decentralized verification to improve result confirmation and collaboration reliability [44]. Other works construct scalable blockchain-enabled FL architectures for large-scale collaborative environments, for example, through hierarchical coordination or asynchronous updating [45]. In addition, incentive-oriented collaboration, auditable participant selection, public auditability, and committee-based blockchain coordination have all been studied to strengthen accountability and traceability in cross-party FL [22,23,46,47]. More recently, Xu et al. proposed CBRFL, which uses a blockchain-based off-chain committee consensus mechanism to achieve gradient verification and adaptive aggregation, while incorporating contribution and reputation mechanisms to improve committee reliability [48]. Wu and Seneviratne proposed a blockchain-based FL framework for scalable and incentivized collaboration, in which smart contracts automatically execute key processes such as client registration, update verification, reward distribution, and global-state maintenance [49]. Overall, these studies indicate that the principal role of blockchain in FL is to provide verifiability, traceability, and governance support for collaboration, rather than to directly replace the core optimization process [21,22,23,43,44,45,46,47].

In geospatial FL, privacy protection, aggregation stability, and collaborative trustworthiness are tightly intertwined throughout long-term multi-party training. This makes it particularly important to incorporate governance support together with privacy perturbation and heterogeneity-aware aggregation into a coordinated framework. Motivated by this observation, this paper introduces blockchain-assisted governance as a support layer for rule commitment, participant management, committee confirmation, permission control, and record tracing, while keeping computationally intensive procedures, including local training, privacy perturbation, and server-side aggregation, off-chain. This design enhances the trustworthiness and auditability of cross-party collaboration and provides system-level support for privacy-aware perturbation and consistency-aware aggregation in geospatial FL.

3. Proposed Method

This section formulates the collaborative geospatial FL problem from a unified system-level perspective. The overall workflow is organized into three stages: update generation, update aggregation, and governance support. Correspondingly, the proposed method consists of three components: a risk-aware privacy perturbation mechanism at the client side, a spatial-consistency-driven aggregation strategy at the server side, and an on-chain governance mechanism for auditing and permission coordination. Together, these components form a hierarchically decoupled collaborative framework for geospatial FL under statistically heterogeneous settings.

3.1. System Model and Threat Assumptions

3.1.1. Collaborative Paradigm of Geospatial FL

In remote sensing and geospatial applications, FL commonly adopts a parameter-server architecture consisting of a central server and multiple geographically distributed data owners. In this setting, direct trust relationships among clients are not required, and the training process is centrally coordinated by the server.

The workflow follows an iterative process of “model broadcast–local update–centralized aggregation–rebroadcast”. At the beginning of each communication round, the server distributes the current global model to participating clients. After completing several gradient-based optimization steps on their local datasets, the clients upload their updated models to the server. The server then aggregates these updates according to client data sizes or predefined weighting rules to generate a new global model. Through repeated communication and aggregation, the global model gradually approaches the desired optimization objective [7,11].

This collaborative paradigm provides the operational basis for the proposed method. Specifically, client-side update generation is the stage at which privacy-aware perturbation is applied, server-side aggregation is the stage at which consistency-based weighting is introduced, and the overall training process provides the system context for governance support and audit coordination.

3.1.2. Threat Assumptions

This study considers a FL setting with multiple geospatial data owners and a central coordinating server. Raw data remain locally stored at each client, while model updates are exchanged during iterative training. Under this setting, the following threat assumptions are adopted.

1.

Honest-but-curious server assumption: The server is assumed to follow the prescribed training and aggregation protocol, but it may attempt to infer statistical characteristics or privacy-sensitive information about client data from the updates and auxiliary information legitimately available during system operation.

2.

Limited adversarial scope: This work focuses on privacy leakage risks and training instability under statistical heterogeneity rather than on strong active attacks. Accordingly, the adversary is modeled as a passive observer that does not tamper with the training process, manipulate aggregation results, or inject malicious updates.

Secure aggregation and strong active adversarial behaviors, such as poisoning attacks, backdoor attacks, and other Byzantine manipulations, are outside the scope of the current formulation.

3.1.3. Risk Analysis and Problem Definition

In the r-th communication round, client k obtains a local update $\Delta w_k^{\left(r\right)}$ after local training. In the absence of secure aggregation, the server can directly observe the current global model $w^{\left(r\right)}$, the perturbed update ${\widetilde{\Delta w}}_k^{\left(r\right)}$ uploaded by the client, and the updated global model $w^{(r+1)}$. Accordingly, the observable information available to an honest-but-curious server can be written as

$$O_k={\{w^{\left(r\right)},{\widetilde{\Delta w}}_k^{\left(r\right)},w^{(r+1)}\}}_{r=1}^R,$$

from which client-level statistical inference may be attempted.

Under this formulation, two risks are of primary concern.

1.

Statistical/Semantic Attribute Inference Risk: The server may attempt to infer whether a client exhibits distinctive semantic or statistical attributes, such as rare categories, high-risk semantic regions, or low-entropy label distributions. The severity of this risk depends on how accurately and confidently such attributes can be inferred from the observable updates. When information from multiple communication rounds is jointly analyzed, the inference capability may be further strengthened, thereby increasing privacy leakage risk [17,18,19,31].

2.

Aggregation Bias Risk: Under non-IID conditions, legitimate client updates may deviate substantially from the global mean. If such highly deviated updates are treated as unreliable solely according to their deviation magnitude, the aggregated model may become biased toward dominant classes or majority distributions. As a result, the representation ability for minority classes may be weakened, leading to training oscillation, unstable convergence, and reduced test accuracy [12,13,15,20].

To address these two risks jointly, we introduce two key design variables. The first is a client-side update release mechanism controlled by a privacy perturbation strategy. Let $r_k$ denote the relative privacy risk level of client k, and let $\mathrm{M}(·)$ denote a risk-aware perturbation mapping. The perturbed update uploaded by the client is defined as

$${\widetilde{\Delta w}}_k^{\left(r\right)}=\mathrm{M}\left(\Delta w_k^{\left(r\right)};r_k\right).$$

(1)

The second is a server-side aggregation weighting mechanism for mitigating update bias caused by statistical heterogeneity. Its abstract form is written as

$${\alpha }_k^{\left(r\right)}=\mathrm{A}\left(d_k\right),$$

(2)

where $d_k$ denotes the degree of statistical discrepancy between the client distribution and the global distribution. In the current design, the aggregation weight is explicitly determined by discrepancy-aware consistency evaluation, so as to directly regulate the influence of distributionally deviated updates during server-side fusion.

Accordingly, the core problem in this work is to jointly design the privacy perturbation mechanism $\mathrm{M}(·)$ and the aggregation weighting function $\mathrm{A}(·)$ for FL under spatial-semantic heterogeneity, so as to balance update-level privacy protection, aggregation stability, and model generalization performance.

3.2. System Architecture

The proposed framework is organized into three functional layers, as illustrated in Figure 1. These layers are connected through a round-based collaborative workflow: the client-side layer generates privacy-protected updates, the server-side layer performs consistency-driven aggregation to produce the new global model, and the governance layer records and coordinates critical collaborative events to support auditable and traceable multi-party training.

Figure 1. Hierarchically decoupled architecture of the proposed geospatial FL framework.

1.

Client-side privacy control layer: This layer integrates the sensitivity and regional characteristics of geospatial data into local training and risk-aware update processing. Its primary objective is to reduce update-level privacy leakage associated with geographic semantics. It operates at the update generation stage and produces privacy-protected client updates for subsequent aggregation.

2.

Server-side aggregation control layer: After receiving client updates, this layer performs consistency-driven aggregation. The design explicitly accounts for spatial discrepancy and distribution imbalance in geospatial data. Its main role is to moderate the influence of distributionally deviated updates during update fusion, thereby improving convergence stability under statistically heterogeneous conditions.

3.

Governance support layer with on-chain auditing and institutional guarantees: This layer provides identity management, access control, rule commitment, and traceability for critical collaborative operations. The on-chain governance module records key decisions and round-level collaborative actions, thereby supporting auditable and regulated multi-party collaboration. It functions as a system-level support module and does not directly intervene in local model training or server-side parameter aggregation.

To further illustrate how the above three layers interact during each communication round, Figure 2 presents the detailed collaborative workflow of the proposed framework. Specifically, client-side local training and risk-aware perturbation generate protected updates, the server side performs consistency analysis and weighted aggregation based on semantic distribution discrepancy, and the governance layer provides rule commitment, result recording, and permission coordination as on-chain support for the overall process.

Figure 2. Round-based collaborative workflow of the proposed geospatial FL framework.

From a functional perspective, the privacy perturbation mechanism is responsible for update-level protection, the consistency-driven aggregation mechanism is responsible for maintaining training stability under heterogeneity, and the governance layer provides institutional support for coordination, auditability, and controlled information flow. The detailed designs of these three components are elaborated in the following sections.

3.3. Spatial-Aware Privacy Perturbation Method

To characterize privacy heterogeneity across geospatial clients, we introduce the concept of spatial risk, defined as the privacy and security risk that may be induced by model updates associated with a specific spatial region. During system initialization, the spatial domain is partitioned according to the spatial semantic attributes of participating clients. Each client is then assigned a corresponding region label, which serves as the basic unit for spatial risk modeling and subsequent risk assessment. Considering the characteristics of remote sensing data, spatial risk is modeled from the following three aspects.

• Semantic category sensitivity: Data associated with critical infrastructure, densely populated areas, and sensitive functional zones generally involve higher privacy risk than data representing natural landscapes.
• Distribution concentration: A more concentrated class distribution corresponds to lower entropy and makes model updates more likely to expose distinguishing features, thereby increasing privacy risk.
• Sample scale and resolution indicators: Higher-resolution imagery usually contains richer fine-grained spatial details, making local structures and positional features more salient. Accordingly, sample scale and image resolution are incorporated as auxiliary indicators in the risk assessment process.

For client k, the spatial risk score is defined as

$$r_k=\mathrm{R}(se{m}_k,H\left({\pi }_k\right),n_k,re{s}_k)$$

(3)

where $se{m}_k$ denotes the semantic region attribute, ${\pi }_k$ denotes the class distribution histogram, $H(·)$ is the entropy function, $n_k$ is the sample size, and $re{s}_k$ is the resolution indicator.

In practice, directly using a continuous risk mapping would produce highly heterogeneous clipping thresholds and noise intensities across clients, making parameter tuning and deployment less stable. A binary partition is easy to implement but cannot adequately capture gradual differences across moderately sensitive clients, whereas an overly fine-grained partition would substantially enlarge the parameter space, thereby increasing the cost of parameter tuning and system management while reducing reproducibility and practical deployability.

To balance expressive capability, system complexity, and experimental reproducibility, we discretize the continuous client risk score into several levels. Specifically, the continuous risk score $r_k$ is mapped to a discrete risk level $g_k$ through predefined thresholds, so that clipping and noise configurations can be assigned in a stable and reproducible manner. The resulting discrete risk level is defined as

$$g_k\in \{Low,Mid,High\}$$

(4)

A higher risk level requires stronger protection. After the risk level has been assigned to each client, a corresponding perturbation configuration is applied. With model updates treated as the direct object of protection, the system assigns different privacy strategies according to the risk level of each client. For high-risk clients, stronger perturbation and stricter clipping constraints are imposed. For medium-risk clients, a moderate protection strategy is adopted to balance privacy preservation and model utility. For low-risk clients, weaker protection is applied to reduce the impact on training accuracy and convergence speed. Under this framework, each client performs clipping and noise injection on its model updates. Specifically, the update vector is first clipped using the $L^2$ norm to bound the sensitivity of each update, resulting in the processed update ${\overline{\Delta w}}_k^{\left(r\right)}$:

$${\overline{\Delta w}}_k^{\left(r\right)}=\Delta w_k^{\left(r\right)}·\min \left(1,{\displaystyle \frac{C_k}{{\parallel \Delta w_k^{\left(r\right)}\parallel }_2}}\right)$$

(5)

The use of $L^2$-norm clipping is motivated by three considerations. First, in a high-dimensional parameter space, the $L^2$ norm is rotation-invariant, allowing the overall update magnitude to be constrained under a unified metric without introducing bias toward any individual dimension or local coordinate axis. Second, because the Gaussian mechanism calibrates injected noise according to $L^2$-sensitivity, clipping establishes a clear upper bound on sensitivity and thus maintains theoretical consistency between clipping and noise injection [16]. Third, $L^2$-norm clipping is computationally efficient and numerically stable, making it suitable for iterative FL training. Accordingly, the clipping threshold assigned to client k is defined as

$$C_k=\left\{\begin{array}{cc}{C}_H,\hfill & g_k=High\hfill \\ C_M,\hfill & g_k=Mid\hfill \\ C_L,\hfill & g_k=Low\hfill \end{array}\right.$$

(6)

Gaussian noise is then added to the clipped update to obtain the privacy-preserving update:

$${\widetilde{\Delta w}}_k^{\left(r\right)}={\overline{\Delta w}}_k^{\left(r\right)}+\mathcal{N}(0,{\sigma }_k^{2}I)$$

(7)

The noise scale assigned to client k is defined according to the risk level as

$${\sigma }_k=\left\{\begin{array}{cc}{\sigma }_H,\hfill & g_k=High\hfill \\ {\sigma }_M,\hfill & g_k=Mid\hfill \\ {\sigma }_L,\hfill & g_k=Low\hfill \end{array}\right.$$

(8)

The client uploads the perturbed update ${\widetilde{\Delta w}}_k^{\left(r\right)}$, and the entire mechanism is executed locally at the client side. The server is not required to access detailed risk information and only receives the DP-protected update. Compared with methods that adjust only the noise magnitude or perform clipping alone, the proposed approach adopts a risk-level-driven dual-channel coupling strategy.

Specifically, clipping constrains ${\parallel \Delta w_k^{\left(r\right)}\parallel }_2$ to establish an upper bound on update sensitivity, while the injected noise further suppresses identifiable information contained in the update within this bounded scale. Together, these two operations define a risk-aware perturbation mechanism that jointly controls sensitivity and privacy protection strength. Through this design, the system can flexibly regulate privacy protection across clients with different risk levels.

For low-risk clients, weaker perturbation and larger clipping bounds are adopted to preserve model performance. For high-risk clients, stronger perturbation and tighter clipping bounds are imposed to enhance privacy protection. In this way, the proposed method achieves an adaptive balance between privacy preservation and model utility. The detailed procedure is summarized in Algorithm 1.

Algorithm 1 Spatial Risk-Aware Privacy Perturbation on Client $C_k$

Input: Local dataset $D_k$, global model $w^{\left(r\right)}$, risk function $R(·)$, clip thresholds $\{C_H,C_M,C_L\}$, noise scales $\{{\sigma }_H,{\sigma }_M,{\sigma }_L\}$

Output: Privacy-preserving update ${\widetilde{\Delta w}}_k^{\left(r\right)}$

1: Train the local model on $D_k$ starting from $w^{\left(r\right)}$ to obtain $w_k^{\left(r\right)}$ 2: $\Delta w_k^{\left(r\right)}\leftarrow w_k^{\left(r\right)}-w^{\left(r\right)}$ 3: $r_k\leftarrow R(se{m}_k,H\left({\pi }_k\right),n_k,re{s}_k)$ 4: if $r_k\ge {\tau }_H$ then 5:     $C_k\leftarrow C_H$ 6:     ${\sigma }_k\leftarrow {\sigma }_H$ 7: else if $r_k\ge {\tau }_M$ then 8:     $C_k\leftarrow C_M$ 9:     ${\sigma }_k\leftarrow {\sigma }_M$ 10: else 11:     $C_k\leftarrow C_L$ 12:     ${\sigma }_k\leftarrow {\sigma }_L$ 13: end if 14: ${\overline{\Delta w}}_k^{\left(r\right)}\leftarrow \Delta w_k^{\left(r\right)}·\min \left(1,{\displaystyle \frac{C_k}{{\parallel \Delta w_k^{\left(r\right)}\parallel }_2}}\right)$ 15: ${\widetilde{\Delta w}}_k^{\left(r\right)}\leftarrow {\overline{\Delta w}}_k^{\left(r\right)}+\mathcal{N}(0,{\sigma }_k^{2}I)$ 16: return ${\widetilde{\Delta w}}_k^{\left(r\right)}$

3.4. Spatial-Consistency-Driven Robust Aggregation Method

Because real geographic coordinates, administrative boundaries, and precise object locations are highly sensitive and are often difficult to obtain consistently in collaborative settings involving public datasets and multiple institutions, we construct a client-side statistical representation based on reproducible semantic statistics. Specifically, the proposed method uses the label distribution of each client’s local dataset as a proxy for spatial semantic structure.

This design relies only on class counts and does not introduce sensitive positional information, thereby satisfying the privacy requirements of geospatial data. In addition, the resulting representation can be fully reproduced from dataset partition files alone, without requiring additional prior knowledge.

Assume that the classification task contains C classes. Let the local training dataset of client k be denoted by $D_k$. The corresponding label histogram is defined as

$${\mathbf{h}}_k=(h_{k,1},h_{k,2},\dots ,h_{k,C})$$

(9)

where each element is given by

$$h_{k,c}=\left|\{(x,y)\in D_k\mid y=c\}\right|.$$

(10)

This representation preserves the key structural information of class composition while avoiding exposure of individual sample content. It is then normalized into a probability distribution vector:

$${\mathbf{p}}_k={\displaystyle \frac{{\mathbf{h}}_k}{{\sum }_{c=1}^C{h}_{k,c}}}$$

(11)

The vector ${\mathbf{p}}_k$ characterizes the compositional structure of client k in the semantic class space and serves as its statistical semantic representation. Compared with explicit geographic location encoding, this representation does not rely on sensitive geographic metadata and therefore offers better privacy controllability and reproducibility. To provide a unified semantic reference for server-side analysis, we further define the global label distribution as

$${\mathbf{h}}_{global}=\sum _{k=1}^K{\mathbf{h}}_k,{\mathbf{p}}_{global}={\displaystyle \frac{{\mathbf{h}}_{global}}{{\sum }_{c=1}^C{h}_{global,c}}}$$

(12)

The vector ${\mathbf{p}}_{global}$ characterizes the overall semantic distribution of the federated system and provides a unified reference for measuring the deviation between an individual client and the global semantic structure. In practical computation, zero-valued elements may appear in probability distributions and cause numerical issues in the KL term. To address this, a small constant $\epsilon >0$ is added to each probability component during normalization for regularization [50]. In our implementation, $\epsilon ={10}^{-12}$ is used in double-precision floating-point computation. This setting has negligible influence on divergence ranking and remains numerically stable under long-tail class distributions and extreme non-IID conditions.

This representation and divergence evaluation are independent of the risk-aware privacy perturbation mechanism described in Section 3.3. After obtaining the client semantic distribution representation ${\mathbf{p}}_k$ and the global reference distribution ${\mathbf{p}}_{global}$, the Jensen–Shannon (JS) divergence is used to quantify spatial semantic discrepancy [51]. The JS divergence between client k and the global distribution is defined as

$$JS({\mathbf{p}}_k\Vert {\mathbf{p}}_{global})={\displaystyle \frac{1}{2}}KL({\mathbf{p}}_k\Vert {\mathbf{m}}_k)+{\displaystyle \frac{1}{2}}KL({\mathbf{p}}_{global}\Vert {\mathbf{m}}_k)$$

(13)

where

$${\mathbf{m}}_k={\displaystyle \frac{1}{2}}({\mathbf{p}}_k+{\mathbf{p}}_{global}),KL(\mathbf{a}\Vert \mathbf{b})=\sum _{c=1}^C{a}_c\log {\displaystyle \frac{a_c}{b_c}}$$

(14)

Compared with the asymmetric KL divergence, the JS divergence is symmetric and bounded, which gives it better numerical stability and interpretability in probability distribution space. When ${\mathbf{p}}_k$ and ${\mathbf{p}}_{global}$ are identical, the JS divergence is zero; as the discrepancy between them increases, the divergence value increases accordingly. Therefore, the JS divergence can be naturally interpreted as a measure of how far a client deviates from the global semantic structure.

To incorporate the quantified discrepancy into aggregation, we further map it to a continuous consistency score with range $(0,1]$. A higher score indicates greater semantic consistency with the global distribution. The spatial consistency score of client k is defined as

$$S_k^{\left(r\right)}=\exp \left(-\beta JS({\mathbf{p}}_k\Vert {\mathbf{p}}_{global})\right)$$

(15)

where $\beta >0$ denotes the consistency adjustment parameter. It controls the decay rate of aggregation weights as the discrepancy increases, thereby balancing stability and heterogeneous information preservation. Because the exponential mapping is monotonic and continuous, a larger discrepancy leads to a smaller weight without imposing hard truncation. Based on the resulting consistency scores, the aggregation weights are normalized as

$${\alpha }_k^{\left(r\right)}={\displaystyle \frac{S_k^{\left(r\right)}}{{\sum }_{j\in P}{S}_j^{\left(r\right)}}}$$

(16)

The global model is then updated as

$$w^{(r+1)}=w^{\left(r\right)}+\sum _{k\in P}{\alpha }_k^{\left(r\right)}{\widetilde{\Delta w}}_k^{\left(r\right)}$$

(17)

This weighting mechanism balances the contributions of clients under spatially non-IID settings. By continuously down-weighting highly deviated but legitimate updates, it reduces their disruptive effect on global convergence and improves training stability. Meanwhile, it preserves potentially useful information induced by spatial heterogeneity and avoids systematically suppressing regional semantic patterns. The detailed procedure is given in Algorithm 2.

Algorithm 2 Spatial Consistency-Driven Robust Aggregation

Input: Client updates ${\{{\widetilde{\Delta w}}_k^{\left(r\right)}\}}_{k\in P}$, label histograms ${\left\{{\mathbf{h}}_k\right\}}_{k\in P}$, parameter $\beta$

Output: Updated global model $w^{(r+1)}$

1: Compute client distributions ${\mathbf{p}}_k$ from ${\mathbf{h}}_k$ 2: Compute global histogram ${\mathbf{h}}_{global}\leftarrow {\sum }_{k\in P}{\mathbf{h}}_k$ 3: Normalize to obtain ${\mathbf{p}}_{global}$ 4: for each client $k\in P$ do 5:     Compute divergence $d_k\leftarrow JS({\mathbf{p}}_k\Vert {\mathbf{p}}_{global})$ 6:     Compute score $S_k^{\left(r\right)}\leftarrow \exp (-\beta d_k)$ 7: end for 8: Normalize weights ${\alpha }_k^{\left(r\right)}\leftarrow {\displaystyle \frac{S_k^{\left(r\right)}}{{\sum }_{j\in P}{S}_j^{\left(r\right)}}}$ 9: $w^{(r+1)}\leftarrow w^{\left(r\right)}+{\sum }_{k\in P}{\alpha }_k^{\left(r\right)}{\widetilde{\Delta w}}_k^{\left(r\right)}$ 10: return $w^{(r+1)}$

3.5. On-Chain Governance Auditing and Off-Chain FL Training Coordination Mechanism

Existing enterprise-grade consortium blockchain platforms, such as Hyperledger Fabric, have developed relatively mature engineering paradigms. However, such platforms are not well suited for the intensive iterative computation involved in high-dimensional model training [52]. To balance governance reliability with computational efficiency, this paper adopts a collaborative architecture that combines on-chain governance and auditing with off-chain training and aggregation.

3.5.1. Collaborative Architecture and Responsibility Allocation

The proposed mechanism consists of four functional layers.

1.

Data layer: This layer consists of the geospatial data locally maintained by each participating party. It is responsible for local data storage and preprocessing, and provides the execution basis for local model training and client-side privacy perturbation.

2.

Off-chain training and aggregation layer: This layer is responsible for all computationally intensive tasks, including local training, client-side privacy perturbation, spatial consistency evaluation, and server-side aggregation. Following the principle of off-chain computation [53], high-dimensional iterative operations are executed outside the blockchain.

3.

On-chain governance and auditing layer: This layer supports governance functions and uses the consortium blockchain to achieve trusted record keeping. The recorded information includes rule management, result recording, committee coordination, and permission control. This layer does not directly participate in the main optimization process.

4.

Application and interaction layer: This layer provides user-facing interfaces, including training task submission, committee member inquiry, process monitoring, node status tracking, and permission management, thereby supporting the practical operation of the collaborative system.

Based on the above architecture, four system roles are defined.

• Coordinator node: The coordinator node initiates training tasks, organizes the collaborative process, and submits governance-related commitments in accordance with predefined rules.
• Training node: The training node performs local model training, applies the privacy perturbation mechanism, and contributes local update results to the off-chain training process.
• Validation node: The validation node participates in committee-based governance activities, including collaborative confirmation and decision support for governance-related actions.
• Audit node: The audit node queries on-chain records, checks rule consistency, and conducts historical auditing to ensure the transparency of the governance process.

The proposed architecture follows the principle of minimal on-chain recording [54]. The blockchain layer is responsible for trusted confirmation, auditable recording, and governance coordination of critical collaborative events, while the computationally intensive FL process remains off-chain. This separation avoids introducing blockchain overhead into the main training loop and preserves the efficiency of iterative model optimization. At the same time, it enhances the traceability and verifiability of cross-party collaboration, thereby providing institutional support for reliable coordination, auditable execution, and controlled information flow throughout the collaborative training process.

3.5.2. Adaptive Committee-Driven Governance Mechanism

To support dynamic and trustworthy governance in collaborative FL, this paper introduces an adaptive committee-driven governance mechanism based on node reputation evaluation. The reputation of node i is jointly determined by three aspects: historical contribution, governance participation, and behavioral consistency.

1.

Historical contribution: This metric measures the long-term effective contribution of a node during the FL training process, while also considering the node’s role in improving global model performance and protecting the privacy of sensitive geospatial data

$$Re{p}_{contrib,i}={\displaystyle \frac{1}{T}}\sum _{t=1}^{T}Quality(\Delta w_i^{\left(t\right)})$$

(18)

where T denotes the length of the statistical window, reflecting the smoothing of fluctuations in model update quality during individual training rounds. $Quality(·)$ is the update quality function, defined as

$$Quality(\Delta w_i^{\left(t\right)})={\lambda }_1\Delta Ac{c}_i^{\left(t\right)}+{\lambda }_2{S}_i^{\left(t\right)}$$

(19)

where $\Delta Ac{c}_i^{\left(t\right)}$ represents the marginal improvement of the update on the global validation performance, satisfying ${\lambda }_1+{\lambda }_2=1$.

2.

Governance participation: This metric quantifies the extent to which node i participates in governance and consensus activities. It is calculated as the ratio between the actual number of times node i participates in consensus and the corresponding expected number within the evaluation period. In accordance with reputation-based election principles, nodes with stronger data protection capability are assigned higher election weights. Conversely, nodes that remain offline for extended periods or repeatedly fail to participate in consensus are penalized through reputation decay. Free-riding or persistently inactive nodes are filtered out at this stage.

3.

Behavioral consistency: This metric is used to characterize the stability and consistency of a node’s behavior within the statistical window. The behavioral feature vector of node i within the statistical window is defined as

$$Behavio{r}_i=\{b_i^{\left(r\right)}\mid r=r_0,\dots ,r_0+T-1\}$$

(20)

where $b_i^{\left(r\right)}$ considers the update norm, the privacy perturbation intensity, and the participation in governance. It is used to evaluate the stability of node behavior during FL and governance. The consistency score is defined as

$$Re{p}_{consist,i}=1-{\displaystyle \frac{\mathrm{Var}\left(Behavio{r}_i\right)}{{\max }_j\mathrm{Var}\left(Behavio{r}_j\right)}}$$

(21)

After normalization, this indicator maps the behavioral stability of nodes into the interval $[0,1]$. Nodes with larger behavioral fluctuations obtain lower consistency scores and are correspondingly suppressed in committee election and subsequent permission allocation.

By jointly considering the above three sub-indicators, the overall reputation score of node i is defined as

$$Re{p}_i=w_{1}Re{p}_{contrib,i}+w_{2}Re{p}_{part,i}+w_{3}Re{p}_{consist,i}$$

(22)

where $w_1,w_2,w_3>0$ and satisfy $w_1+w_2+w_3=1$.

After obtaining the reputation scores of all nodes, a hybrid scheduling strategy is adopted to dynamically select committee members. Nodes whose reputation scores satisfy $Re{p}_i\ge \tau$ are first selected from all validator nodes to form a candidate set C. Committee members are then chosen from the candidate set using a weighted random strategy. The probability that node i is selected into the committee is defined as

$$P(i\in Committee)={\displaystyle \frac{Re{p}_i^{\alpha }}{{\sum }_{j\in C}Re{p}_j^{\alpha }}}$$

(23)

where the parameter $\alpha >0$ controls the trade-off between reputation priority and randomness. When $\alpha >1$, the election process tends to favor high-reputation nodes; when $\alpha <1$, stronger randomness is introduced to improve robustness. The system re-executes committee election after every R rounds of FL training, thereby reducing the risk that a fixed subset of nodes may maintain long-term control over the governance process.

Through this mechanism, committee formation is made adaptive to node contribution, participation quality, and behavioral stability, thereby providing an institutional basis for subsequent governance decision-making and dynamic permission adjustment.

3.5.3. Smart Contract–Driven Dynamic Permission Governance Mechanism

Building on the committee-driven governance framework presented above, this section introduces a smart contract–driven dynamic permission governance mechanism. Its purpose is to translate committee decisions into executable access-control actions, thereby forming a closed-loop process of governance decision-making, permission enforcement, and on-chain verification.

Because inadequate permission modeling and weak execution constraints may expose smart contracts to security risks [55], the proposed mechanism adopts explicit rule-based triggering conditions for permission adjustment. In particular, permission modification is initiated when one of the following conditions is satisfied: significant degradation in node reputation, detection of abnormal behavior or rule violation, arrival of a predefined periodic review stage, or manual intervention by the system administrator. Such a design enables the governance process to respond to both automatically detected abnormalities and externally imposed administrative requirements.

Once any trigger condition is met, the system generates a corresponding permission adjustment proposal

$$p=⟨u,L_u^{old},L_u^{new},reason,round\_id⟩$$

(24)

where u denotes the target node, $L_u^{old}$ represents the original permission level, $L_u^{new}$ denotes the updated permission level, $reason$ indicates the triggering cause, and $round\_id$ corresponds to the current training round.

The generated proposal is submitted to the committee of the current round for consensus-based decision-making. After approval, the permission state of the target node is updated accordingly, and the approved adjustment together with its associated governance metadata is committed on-chain for subsequent verification and audit. The overall process is illustrated in Figure 3.

Figure 3. Smart Contract-Driven Dynamic Permission Governance Process.

In this way, the permission governance process is naturally embedded into the previously described committee-driven governance framework, ultimately achieving closed-loop coordination among governance decision-making, permission enforcement, and audit traceability.

4. Experimental Design and Results Analysis

As a system-level support module for auditability, coordination, and traceability, rather than a learning-side component that directly participates in model optimization, the governance layer in this work is evaluated through a two-level experimental organization consisting of learning-side performance evaluation and governance-side prototype validation. Specifically, the first half of the experiments focuses on the FL-side mechanisms that directly affect model utility, convergence behavior, and training stability, namely, the client-side spatial risk-aware privacy perturbation mechanism and the server-side spatial-consistency-driven aggregation strategy. The second half further conducts prototype validation of the governance layer based on real off-chain training results, with emphasis on its closed-loop executability, audit traceability, and abnormality-triggered permission management capability.

To comprehensively evaluate the effectiveness of the proposed framework, the experiments are conducted from six aspects. First, centralized training is compared with FedAvg to establish an upper-bound performance reference and an FL baseline. Second, under IID, moderately non-IID, and strongly non-IID conditions, the impact of statistical heterogeneity on convergence speed and training stability is analyzed. Third, the proposed risk-aware noise mechanism is compared with a uniform noise scheme, and passive attribute inference attack experiments are introduced to evaluate the effectiveness of the differentiated perturbation mechanism from three dimensions: model utility, training stability, and privacy suppression capability. Fourth, under non-IID conditions, the effectiveness of the spatial-consistency-based aggregation method in improving training stability is evaluated. Fifth, joint experiments are conducted by integrating the spatial noise mechanism with the consistency mechanism, so as to assess the overall effectiveness of the proposed collaborative design in achieving privacy preservation and stable optimization under heterogeneous data distributions. Sixth, for the governance layer, an on-chain closed-loop governance prototype is constructed based on real off-chain training metadata, and its closed-loop execution capability under normal scenarios, permission-triggered update capability under abnormal scenarios, and on-chain write latency are respectively validated, thereby demonstrating the engineering integrability and institutional support value of the governance layer in multi-party collaboration.

4.1. Experimental Settings

4.1.1. Dataset and Data Partitioning

This study uses the EuroSAT_RGB dataset for experimental evaluation [56]. The dataset contains 27,000 RGB remote sensing images covering 10 land-cover classes, and the task is formulated as a multi-class image classification problem. A unified global partitioning scheme is adopted in this study, in which the dataset is divided into training, validation, and test subsets. Among them, the validation and test subsets are shared across all clients, while client-level partitioning is applied only to the training subset.

To systematically evaluate aggregation methods under heterogeneous settings, many studies adopt Dirichlet-based data partitioning, in which a single concentration parameter is used to control the degree of label-distribution skew across clients [39]. This strategy offers good controllability, reproducibility, and comparability, and has become one of the standard protocols for simulating non-IID FL scenarios. Following this common practice, we set the concentration parameter to $\alpha \in \{0.5,0.1\}$ in our experiments, where $\alpha =0.5$ and $\alpha =0.1$ represent moderate and strong non-IID settings, respectively. This setup not only allows us to examine the overall performance degradation caused by increasing heterogeneity, but also enables us to evaluate whether the proposed mechanisms remain effective when client label distributions become severely skewed. All methods are evaluated under the same data partition protocol using three random seeds, namely 1, 42, and 2024. These seeds are used to reduce the influence of incidental randomness arising from data partitioning and training initialization, and to provide a basic assessment of result stability and reproducibility across repeated runs.

4.1.2. Experimental Environment

All experiments use ResNet-18 as the backbone classification model, with the number of output classes set to 10. The experiments are conducted in an Ubuntu 22.04 (WSL2) environment on an NVIDIA GeForce RTX 4090 GPU. The implementation is built with Python 3.12.7 and PyTorch 2.10.0 with CUDA 12.8 support, and the FL workflow is implemented using a custom PyTorch-based training pipeline with GPU acceleration. Unless otherwise specified, all compared methods are evaluated under the same hardware and software environment and follow a unified training protocol to ensure fair comparison and reproducibility.

4.1.3. Experimental Configuration

The number of clients is set to $K=10$, the participation rate to $q=1.0$, and the total number of communication rounds to $R=100$. A full-participation setting ($q=1.0$) is adopted to eliminate the additional randomness introduced by client subsampling, so that the observed performance differences can be more directly attributed to data heterogeneity and aggregation behavior. Setting $K=10$ provides a moderate multi-client scenario for simulating cross-client distribution skew, while $R=100$ provides a sufficiently long training horizon for observing convergence behavior and training stability. For local optimization, SGD is used with an initial learning rate of 0.01, momentum of 0.9, weight decay of $1\times {10}^{-4}$, and a batch size of 64. Unless otherwise specified, all compared methods follow the same training configuration to ensure fairness and reproducibility.

4.1.4. Baseline Methods

• Centralized: Centralized supervised training on the pooled dataset, used as an approximate upper-bound reference for the current dataset-model setting.
• FedAvg: The standard federated averaging method, used as the main baseline to characterize training performance under IID and non-IID client distributions.
• FedAvg + Uniform Noise: A privacy-perturbation baseline in which all clients adopt the same clipping threshold and noise intensity during update release.
• FedAvg + Spatial-aware Noise: A differentiated perturbation setting in which client updates are protected using the proposed risk-level-driven clipping and noise assignment strategy, while the server still uses standard FedAvg aggregation.
• Trimmed Mean: A coordinate-wise robust aggregation baseline that removes extreme values before averaging.
• Krum: A distance-based robust aggregation baseline that selects updates according to pairwise similarity in the update space.
• Consistency: The proposed spatial-consistency-driven soft weighting aggregation method, which adaptively reweights client updates according to their JS-divergence-based consistency scores.
• Integrated Method: The joint version of the proposed framework, combining the client-side spatial-aware perturbation mechanism with the server-side consistency-driven aggregation strategy.

4.2. Baseline Experiment: Centralized Training Behavior Analysis

This experiment provides a centralized reference under IID conditions for interpreting the performance gap introduced by FL training and statistical heterogeneity in the subsequent experiments. Figure 4 shows the training and validation accuracy trajectories over the training process.

Figure 4. Training and validation accuracy curves of centralized training under IID conditions.

Repeated runs are conducted using three fixed random seeds to reduce the influence of incidental randomness from initialization and data splitting. The centralized model achieves a final test accuracy of $96.73\pm 0.22\%$, indicating stable and reproducible performance under the current dataset-model setting.

In the early stage of training, the accuracy fluctuates noticeably due to random initialization and the relatively large learning rate. As training proceeds, both the training and validation curves become progressively more stable, and the model converges to a consistently high-accuracy regime. This result serves as an approximate upper-bound reference for the subsequent FL experiments and helps quantify the performance gap introduced by decentralized training, heterogeneous client distributions, and privacy-aware perturbation.

4.3. Performance of FedAvg Under IID and Non-IID Conditions

This experiment evaluates the sensitivity of standard FedAvg to increasing statistical heterogeneity and establishes the main FL baseline for the subsequent analysis. The experiments are repeated under moderate and strong non-IID settings ($\alpha \in \{0.5,0.1\}$) using three fixed random seeds, so that both average performance and variability can be examined.

In Figure 5, the light-colored curves represent the results of individual runs under different random seeds, while the bold curves indicate the corresponding averaged performance. Under IID conditions, FedAvg converges rapidly and achieves a final test accuracy of $95.04\pm 0.32\%$. When the level of statistical heterogeneity is moderate ($\alpha =0.5$), the overall convergence trend remains largely consistent with the IID case, although mild fluctuations can be observed in the early stage of training, and the final accuracy decreases slightly to $94.01\pm 1.45\%$. In contrast, under strong heterogeneity ($\alpha =0.1$), the model converges much more slowly, and the final test accuracy drops significantly to $72.91\pm 2.82\%$.

Figure 5. Test accuracy trajectories of FedAvg under IID and non-IID settings.

Figure 6 further presents the rolling standard deviation of test accuracy computed using a sliding window of size 10, which is used to characterize training stability across communication rounds. In the early stage of training, all settings exhibit noticeable fluctuations, as model performance improves rapidly from random initialization. As training proceeds, the fluctuation amplitude gradually decreases under IID and moderate heterogeneity conditions, and the optimization process becomes increasingly stable. In contrast, under strong statistical heterogeneity ($\alpha =0.1$), the rolling standard deviation remains at a relatively high level throughout the middle and later stages of training, and severe label skew continues to hinder the stable convergence of the global model.

Figure 6. Rolling standard deviation of FedAvg test accuracy under IID and non-IID settings.

Taken together, these results indicate that standard averaging remains effective when client distributions are relatively similar or only moderately skewed, but its reliability declines significantly when local data distributions are severely imbalanced. Under strong non-IID conditions, the local objective functions across clients become increasingly inconsistent, causing the resulting updates to be more dispersed in both direction and magnitude. No malicious clients or abnormal updates are introduced in this experiment, so the observed performance degradation can be attributed entirely to statistical heterogeneity. This finding provides direct empirical motivation for the subsequent experiments on differentiated privacy perturbation and consistency-driven aggregation.

4.4. Comparison Between Uniform Noise and Risk-Aware Noise

This section evaluates the proposed spatial risk-aware differentiated perturbation mechanism under strong statistical heterogeneity conditions. Specifically, under a strong non-IID setting ($\alpha =0.1$), we compare three strategies from three aspects: final accuracy, convergence behavior, and training stability: FedAvg, FedAvg + Uniform Noise, and FedAvg + Spatial-aware Noise. The core objective of the experiments is to examine whether, when the client label distribution is highly skewed, the differentiated perturbation strategy based on risk levels can preserve model utility more effectively than the uniform perturbation scheme; meanwhile, we further verify through newly added passive attribute inference attack experiments whether, under a threat model in which the server can observe the statistical characteristics of updates, this mechanism can more effectively suppress privacy risks.

In the Uniform Noise setting, all clients adopt the same clipping threshold and noise intensity during update release. By contrast, in the Spatial-aware Noise setting, different clipping thresholds and noise intensities are assigned to clients according to their respective risk levels. Specifically, the clipping threshold and noise coefficient are set to 80 and 0.07 for high-risk clients, 100 and 0.05 for medium-risk clients, and 120 and 0.03 for low-risk clients. This parameter design is intended to provide three progressively differentiated levels of protection while keeping the overall perturbation strength within a reasonable range that still supports stable convergence. Through this setup, we further examine whether differentiated perturbation can achieve a better balance between privacy protection and model utility than uniform perturbation under heterogeneous training conditions.

Figure 7 shows the variation in test accuracy over communication rounds for the three compared strategies under the strong non-IID setting. Although all three methods eventually converge, their convergence levels and trajectories differ substantially. FedAvg without perturbation achieves a final accuracy of $72.91\pm 2.82\%$. After uniform perturbation is introduced, the final accuracy drops markedly to $65.00\pm 2.73\%$, indicating a considerable utility loss. By contrast, the proposed Spatial-aware Noise achieves $67.52\pm 1.31\%$, consistently outperforming the Uniform Noise scheme during the middle and later stages of training.

Figure 7. Test accuracy trajectories under different perturbation strategies.

Figure 8 further reports the rolling standard deviation of test accuracy within a sliding window of size 10, which is used to characterize training stability. Under strong non-IID conditions, FedAvg exhibits pronounced fluctuation peaks in the middle and later stages of training. The Uniform Noise scheme shows noticeable oscillations, especially in the early convergence stage. In contrast, Spatial-aware Noise maintains relatively smaller fluctuations overall, resulting in a smoother and more stable training process.

Figure 8. Rolling standard deviation of test accuracy under different perturbation strategies.

Building on the discussion in Section 3.1.3 regarding the risk that the server side may further infer sensitive attributes based on the statistical patterns of client updates, the experiments further conduct a quantitative verification of the privacy suppression capability of the perturbation mechanism from the attack perspective. We construct two types of passive attribute inference attack tasks, namely high-risk client inference and low-entropy client inference. The attacker performs binary inference using only the statistical features of client updates observable at the server side, simulating the risk of passive inference of clients’ sensitive statistical attributes in an honest-but-curious scenario. The parameters of this attack validation experiment follow the basic settings of the previous FL training, so as to ensure a fair comparison between the two perturbation methods under the same implementation scale. All experiments run for 100 communication rounds, and adopt the validation-selected best checkpoint as the final model selection criterion, in order to reduce the interference of late-stage oscillations on evaluation during the strong non-IID FL optimization process.

Figure 9 shows the comparison results of AUC for two types of passive attribute inference attacks under different perturbation settings. In the high-risk inference task, the attack AUC values of no perturbation, uniform perturbation, and spatial-aware perturbation are 0.8251, 0.7721, and 0.6433, respectively; in the low-entropy inference task, the corresponding attack AUC values are 0.7521, 0.7069, and 0.5589, respectively. In both tasks, spatial-aware perturbation achieves the lowest attack AUC, indicating that it can more effectively suppress the server’s passive inference capability regarding clients’ sensitive statistical attributes. From the utility results, the best test accuracy values of no perturbation, uniform perturbation, and spatial-aware perturbation are 0.6059, 0.5701, and 0.6057, respectively. This indicates that, under the current attack validation experimental setting, spatial-aware perturbation basically maintains predictive capability comparable to that of the no-perturbation baseline, while being clearly superior to uniform perturbation. In other words, differentiated perturbation does not bring about a significant utility decline as uniform perturbation does, but instead achieves a more robust protection effect while maintaining a relatively high accuracy level.

Figure 9. Utility and passive attribute inference results under different perturbation settings.

In summary, the results of this section indicate that uniform perturbation is not suitable for highly heterogeneous FL scenarios. On the one hand, from the perspective of training behavior, it further aggravates the inconsistency among client updates on top of the original statistical heterogeneity, making server-side aggregation more sensitive to update mismatch; on the other hand, from the attack validation results, although it can reduce the risk of attribute inference to a certain extent, the cost is a more evident loss of model utility. In contrast, while maintaining good predictive performance and training stability, the spatial-aware perturbation proposed in this paper can not only achieve smoother optimization behavior under strongly heterogeneous FL training conditions, but also simultaneously balance utility preservation and privacy risk suppression under the passive observation threat model, demonstrating a better privacy–utility trade-off. This also further explains why it is necessary to subsequently introduce a consistency weighting mechanism based on JS divergence, so as to adaptively regulate the influence of distribution-deviated updates in aggregation.

4.5. Comparison of Robust Aggregation Under Non-IID Conditions

In this section, we evaluate the effectiveness of the proposed spatial-consistency-driven aggregation strategy under strong statistical heterogeneity. The comparison is conducted in the strong non-IID setting with Dirichlet $\alpha =0.1$ and $K=10$ clients, where update mismatch caused by label skew is most pronounced. The compared methods include FedAvg as the standard averaging baseline, Trimmed Mean and Krum as representative robust aggregation baselines, and the proposed Consistency method. All methods are evaluated under the same data partition, random seed settings, and local training protocol. Except for the server-side aggregation rule, all other training configurations remain identical, so that the observed differences can be attributed primarily to the aggregation strategy itself.

Figure 10 compares the test accuracy trajectories of the four aggregation strategies under the strong non-IID setting. Although all methods show a certain degree of improvement as training proceeds, their convergence behavior and final performance differ significantly. As the standard baseline, FedAvg exhibits repeated accuracy drops and oscillations in the middle and later stages of training, indicating high sensitivity to cross-client distribution mismatch under severe heterogeneity. Trimmed Mean converges more smoothly, but its performance ceiling remains limited. Although coordinate-wise truncation suppresses variance, it does so at the cost of weakening potentially useful client contributions. Krum performs substantially worse in this setting, with accuracy remaining at a relatively low level throughout the training process, indicating that an overly conservative selection mechanism is not suitable for strongly statistically heterogeneous environments. By contrast, the proposed Consistency method begins to outperform both FedAvg and Trimmed Mean from approximately the middle stage of training and maintains this advantage in the subsequent rounds.

Figure 10. Test accuracy trajectories of different aggregation strategies under strong non-IID conditions.

Figure 11 further presents the rolling standard deviation of test accuracy, which is used to characterize training stability. FedAvg shows noticeable fluctuation peaks in the middle and later stages, reflecting the instability caused by highly inconsistent client updates. Trimmed Mean reduces part of this fluctuation and appears more stable overall, but this comes with a lower performance ceiling. Krum also exhibits relatively low fluctuation, but such apparent stability is accompanied by clear performance degradation and is more likely to reflect underfitting caused by overly aggressive exclusion. In contrast, the proposed Consistency method maintains controlled fluctuations across most communication rounds without sharp spike-like oscillations, indicating a more favorable balance between convergence quality and stability.

Figure 11. Rolling standard deviation of test accuracy for different aggregation strategies under strong non-IID conditions.

Taken together, these results indicate that, compared with hard-selection or hard-trimming baselines, the proposed consistency-driven aggregation strategy is better suited to strong non-IID FL settings. Under severe statistical heterogeneity, hard exclusion may mistakenly suppress legitimate but distributionally shifted updates. However, the proposed method uses JS-divergence-based continuous weighting to adaptively moderate the influence of deviated updates rather than discarding them completely. This design helps preserve useful information carried by heterogeneous clients while reducing aggregation oscillation, thereby achieving a more favorable balance between accuracy and stability.

4.6. Integrated Method: Spatial Noise + Consistency Joint Mechanism Verification

Building on the previous experiments, this section evaluates the joint effect of the spatial risk-aware perturbation mechanism and the consistency-driven aggregation strategy under strong non-IID conditions. The objective is to examine whether the proposed server-side consistency weighting can mitigate the additional aggregation instability caused by severe statistical heterogeneity in the presence of privacy-aware perturbation, while still preserving model utility.

In this experiment, the client-side perturbation settings follow the same graded configuration as in the previous perturbation study, so that the additional effect of server-side consistency weighting can be examined under a comparable protection scheme. Specifically, the client-side perturbation configuration remains the same as that used in the previous perturbation experiment, and the corresponding clipping thresholds are set to $C_H=80$, $C_M=100$, and $C_L=120$. The consistency weighting parameter is set to $\beta =5.0$, which controls the decay of aggregation weights with increasing JS-divergence-based discrepancy. All other training configurations remain unchanged. Under this setting, the server computes consistency scores according to the divergence between each client’s local label distribution and the global reference distribution, and then performs weighted aggregation based on the resulting consistency coefficients. Therefore, this experiment focuses on whether consistency-driven weighting can compensate for the additional update mismatch introduced jointly by strong data heterogeneity and differentiated privacy perturbation.

Figure 12 compares the test accuracy trajectories of the perturbation-only setting and the joint mechanism under strong statistical heterogeneity. Both methods are evaluated using three fixed random seeds. Under the same strong non-IID setting, FedAvg with Spatial-aware Noise achieves a final test accuracy of $67.52\pm 1.31\%$, whereas the joint method combining Spatial-aware Noise with Consistency-based aggregation reaches $76.21\pm 1.21\%$, corresponding to an absolute improvement of 8.69 percentage points.

Figure 12. Test accuracy trajectories of the joint mechanism under strong non-IID conditions.

The experimental results show that the joint mechanism achieves consistent performance gains across different random seeds, indicating that the proposed method has good stability and reproducibility. In addition, the training curves do not exhibit extra abnormal oscillations, suggesting that the improvement in final accuracy is not achieved at the cost of reduced training stability. To provide a unified view, Table 1 summarizes the final accuracy of the compared methods together with their experimental settings, privacy perturbation strategies, and aggregation schemes.

Table 1. Overall comparison of the main experimental results.

Method	Experimental Setting	Privacy Perturbation	Aggregation Strategy	Final Accuracy (%)
Centralized	IID	None	Centralized	$96.73\pm 0.22$
FedAvg	IID	None	FedAvg	$95.04\pm 0.32$
FedAvg	$\alpha =0.5$	None	FedAvg	$94.01\pm 1.45$
FedAvg	$\alpha =0.1$	None	FedAvg	$72.91\pm 2.82$
Uniform Noise	$\alpha =0.1$	Uniform noise	FedAvg	$65.00\pm 2.73$
Spatial-aware Noise	$\alpha =0.1$	Spatial-aware noise	FedAvg	$67.52\pm 1.31$
Integrated Method	$\alpha =0.1$	Spatial-aware noise	Consistency-based weighting	$76.21\pm 1.21$

As shown in Table 1, the proposed design achieves the best overall performance among all compared settings. In particular, under strong non-IID conditions, the combination of spatial-aware local perturbation and consistency-driven server-side aggregation can effectively alleviate the performance degradation jointly caused by privacy-aware perturbation and statistical heterogeneity. These results further support the core view of this paper that, in geospatial FL under severe heterogeneity, privacy-aware local protection and consistency-aware aggregation should be jointly designed.

4.7. Closed-Loop Governance Prototype Validation Based on Real Off-Chain Training Results

Building upon the preceding FL experiments, this section further validates the proposed governance mechanism from the perspective of system-level engineering deployment. Specifically, the experiment focuses on the on-chain executability of the governance closed loop, as well as its auditability, traceability, and abnormality-triggered permission governance capability. To keep the validation complexity under control while preserving the key governance logic, a simplified yet executable prototype implementation is adopted in this study. It should be clarified that the purpose of this experiment is not to evaluate the direct effect of the governance layer on model accuracy or convergence performance. Instead, the objective is to examine whether, given real off-chain training results that have already been obtained, the governance layer can map key training metadata into on-chain governance events and form a complete collaborative governance loop covering rule commitment, aggregation-result commitment, committee recording, permission adjustment, and audit query.

In the prototype implementation, node reputation is jointly determined by three aspects: historical contribution, governance participation, and behavioral consistency. Historical contribution is characterized by the mean quality within the statistical window; governance participation is estimated by the smoothed ratio of successful participations in governance-related activities; and behavioral consistency jointly reflects behavioral fluctuation and inactivity penalties, so as to characterize the stability and sustained responsiveness of a node in the governance process. After obtaining the overall reputation scores, nodes whose scores exceed a predefined threshold are first selected to form a candidate set, and committee members are then elected from this set through a weighted random mechanism. In the present experiment, $R=1$ is adopted, meaning that the committee composition is updated after each training round, so as to intuitively demonstrate the sensitivity of the governance layer to round-level changes in node status.

The experiment uses the JSON file generated by the aforementioned joint method under random seed 1 as the source of real off-chain training results, and constructs the on-chain governance inputs on this basis. To control the experimental complexity while preserving the observability of round-level governance logic, six observed clients and ten consecutive training rounds are selected for governance validation. This setting ensures that the committee dynamics remain interpretable while allowing non-trivial reputation differences to emerge, and at the same time covers both stable closed-loop execution and the occurrence of abnormal events within a relatively compact observation horizon. In reputation evaluation, a sliding statistical window of length 3 is adopted to dynamically assess recent client behavior. The committee size is fixed at 2 to avoid excessive governance coordination complexity. The entire experiment is conducted on a Hyperledger Fabric test network, where governance-record chaincode is deployed on-chain, while summaries of real training results and governance-trigger judgment logic are retained off-chain.

On this basis, training-side metadata are further mapped into four types of on-chain governance events. Rule commitment is used to record governance-related configurations; aggregation-result commitment is used to record the hash summaries of round-level aggregation results; committee records are used to preserve the committee composition and the corresponding governance round; and permission updates are used to execute node-level permission adjustment and retain approval information when predefined abnormal conditions are satisfied. Through this design, an end-to-end prototype closed loop of “dynamic reputation evaluation–committee election–aggregation commitment–abnormality triggering–permission update–audit query” is established.

The core objectives of this experiment are threefold. First, to verify whether real off-chain training results can be structurally mapped into on-chain governance records. Second, to verify whether the governance layer can form a continuous, stable, and executable closed loop under normal training conditions. Third, to verify whether permission governance can be effectively triggered under predefined abnormal conditions while preserving a complete audit trail.

4.7.1. Scenario A: Validation of the Normal Governance Closed Loop

In Scenario A, all observed clients are assumed to successfully participate in training and aggregation in every round by default.

The experimental results are shown in Table 2. The rule record rule_A_seed1 is stably reused throughout the governance process of all rounds; the aggregation commitment records from agg_A_r1 to agg_A_r10 are all successfully written on-chain; and the corresponding committee records from committee_A_r1 to committee_A_r10 can also all be correctly queried, which indicates that the metadata of real training rounds can already be stably mapped into on-chain governance events.

Table 2. Ten-round governance closed-loop execution results in Scenario A.

Round	Rule Record	Aggregation Commitment Record	Committee Record	Committee Members	Audit Query Result
Round 1	rule_A_seed1	agg_A_r1	committee_A_r1	[7, 1]	Success
Round 2	rule_A_seed1	agg_A_r2	committee_A_r2	[1, 8]	Success
Round 3	rule_A_seed1	agg_A_r3	committee_A_r3	[3, 5]	Success
Round 4	rule_A_seed1	agg_A_r4	committee_A_r4	[5, 8]	Success
Round 5	rule_A_seed1	agg_A_r5	committee_A_r5	[9, 7]	Success
Round 6	rule_A_seed1	agg_A_r6	committee_A_r6	[5, 9]	Success
Round 7	rule_A_seed1	agg_A_r7	committee_A_r7	[9, 8]	Success
Round 8	rule_A_seed1	agg_A_r8	committee_A_r8	[9, 1]	Success
Round 9	rule_A_seed1	agg_A_r9	committee_A_r9	[5, 8]	Success
Round 10	rule_A_seed1	agg_A_r10	committee_A_r10	[5, 9]	Success

Furthermore, under Scenario A, the committee composition is dynamically updated along with round progression and changes in node reputation. Under normal operating conditions, subtle changes in recent participation and consistency signals may still lead to differences in committee composition across rounds. Even in the normal governance setting where there is no abnormality-triggered permission adjustment, the committee can still be reconfigured at the round level according to the dynamic reputation evaluation results, indicating that the governance layer is able to adaptively adjust the committee election results according to changes in node status during the collaborative process.

From the perspective of engineering execution, Scenario A validates the continuous closed-loop capability of the governance layer under normal training conditions. That is, when the governance rules remain unchanged and the training process continues to advance, the system can automatically generate and preserve key governance records around each training round, and further support subsequent audit retrieval based on the on-chain ledger.

4.7.2. Scenario B: Validation of Abnormality-Triggered Governance

In Scenario B, this paper further constructs an abnormal governance scenario to verify whether the predefined governance rules can trigger actual permission adjustment operations under abnormal conditions. The experiment retains the same ten-round governance framework and sets client7 to fail consecutively in Round 4 and Round 5. After the abnormality satisfies the trigger condition of “two consecutive rounds of failure”, a permission update is executed after Round 5, adjusting the permission status of this client from active to watchlist.

The results in Table 3 show that the rule record, aggregation commitment record, and committee record have all been successfully written on-chain and can be retrieved through the query interface. More importantly, the permission update record has also been successfully committed on-chain, fully recording the abnormal object, old permission, new permission, trigger reason, trigger round, and approver.

Table 3. Permission-triggered governance results in Scenario B.

Client	Trigger	Round	Old Status	New Status	Approver	Record ID
client7	Two failures	Round 5	active	watchlist	comm_B_r5	perm_c7_r5

Figure 13 presents the dynamic reputation evolution of the abnormal node client7 under Scenario B. In Round 4 and Round 5, as consecutive participation failures occur, both the participation reputation and the behavioral consistency reputation of the node decrease significantly, causing the overall reputation to drop to its lowest point in Round 5. Thereafter, although the behavioral fluctuation of the node is reduced and gradually becomes stable, its participation reputation remains at a relatively low level. As a result, the overall reputation only recovers to a lower steady state rather than returning to the initial high-reputation range, because the recovery of behavioral stability alone is insufficient to offset the sustained reduction in participation-related reputation within the current statistical window. These results indicate that the proposed dynamic reputation mechanism can characterize the persistent impact of abnormal participation behavior on the governance status of a node and provide a quantitative basis for subsequent permission adjustment.

Figure 13. Dynamic reputation evolution of Client 7 under Scenario B.

The above experimental results indicate that the proposed governance layer can not only map training-related metadata into on-chain commitments, but also execute corresponding governance actions when predefined rule conditions are satisfied and record them completely in the ledger. In this way, the system forms a closed-loop process of “training results–governance decision–permission adjustment–audit traceability”, demonstrating that the governance layer possesses executable response capability for abnormal states, as well as corresponding traceability and auditability.

4.7.3. On-Chain Confirmation Write Latency Analysis

After completing the functional validation of the governance closed loop, this paper further evaluates the confirmation write latency of on-chain governance operations. To ensure that the measurement results reflect the actual end-to-end overhead from transaction submission to on-chain confirmation, millisecond-level timestamps are recorded before and after executing peer chaincode invoke, and the event waiting mechanism is enabled. In this way, the confirmation write latency of different types of governance transactions can be measured in an end-to-end manner. The results show that the confirmation latency of different governance events remains relatively stable, with an overall level of approximately 2.08 s. The detailed results are shown in Table 4.

Table 4. Cleaned write latency results (unit: ms).

Operation	Run 1	Run 2	Run 3	Run 4	Run 5	Average
Rule Commit	2073	2067	2074	2106	2085	2081.0
Agg. Commit	2079	2104	2095	2077	2088	2088.6
Committee	2076	2074	2070	2080	2089	2077.8
Perm. Update	2079	2075	2071	2079	2076	2076.0

As shown in Table 4, the write latencies of the four types of governance operations are close to each other, and no obvious fluctuation differences are observed across repeated runs. In the current prototype implementation, rule commitment, aggregation-result commitment, committee recording, and permission update all exhibit stable confirmation overhead at the second level. This indicates that the proposed governance layer does not introduce significantly unstable additional write cost due to differences in governance event types.

Overall, the experimental results indicate that the governance prototype proposed in this paper has a stable and acceptable on-chain write cost under small-scale engineering implementation conditions. Since only governance-related summary information and decision records are committed on-chain, the measured overhead here should be regarded only as the additional cost of the governance support layer. Combined with the validation results of the normal governance scenario and the abnormality-triggered scenario, it can be concluded that the proposed governance layer is able to complete key governance actions while maintaining transaction confirmation overhead within a relatively stable range, thereby providing a feasible engineering basis for further extension to larger-scale governance deployment.

5. Discussion and Limitations

5.1. Discussion of Main Findings

The experimental results indicate that the core issue addressed in this work is not the isolated effect of either privacy preservation or heterogeneity-aware optimization alone, but rather the coupling between the two in geospatial FL. Privacy perturbation acts at the client-side update generation stage, whereas heterogeneity coordination mainly acts at the server-side aggregation stage. Although these mechanisms are implemented at different positions in the federated optimization process, they jointly determine the convergence behavior, training stability, and final performance of the global model. Therefore, the contribution of this work does not lie in improving any single module in isolation, but in designing a collaborative framework for update protection and aggregation under strongly heterogeneous geospatial conditions.

The baseline experiments first show that centralized training and FL under IID conditions achieve relatively similar performance. This indicates that, under the current dataset and model configuration, the target task itself is learnable, and the adopted backbone network also has sufficient representational capability. The performance degradation observed in the experiments of this paper cannot be simply attributed to insufficient model expressiveness or the failure of the basic training framework. On the contrary, the significant performance degradation is mainly concentrated under strong non-IID conditions, which indicates that the core factor truly constraining the effectiveness of FL is the continuous accumulation of statistical distribution differences among clients in heterogeneous environments, and the disruption caused by such differences to the consistency of global optimization.

Further analysis shows that strong statistical heterogeneity causes substantial divergence in the local objectives of different clients. Differences in semantic structure, label distribution, and feature statistics across regions lead to inconsistency in local update directions. When these evidently deviated updates are continuously uploaded and participate in global aggregation, the optimization process no longer progresses stably toward a unified global objective, but is more likely to oscillate among competing local directions. Therefore, the performance degradation observed under strong non-IID conditions should be understood as a structural consequence of cross-client distribution mismatch, rather than incidental training instability. This finding emphasizes that the key challenge in geospatial FL is not merely “whether training can be carried out,” but rather “how to maintain update consistency and training stability under long-term statistical heterogeneity.”

The perturbation-related experimental results show that, in highly heterogeneous FL environments, privacy protection strength cannot be simply handled through a uniform configuration. Compared with the no-perturbation setting, Uniform Noise causes a more obvious accuracy drop and stronger training oscillation. The fundamental reason is that the uniform perturbation scheme imposes the same clipping threshold and noise intensity on all clients, which implicitly assumes that all clients have similar sensitivity structures and privacy risk characteristics. However, in geospatial scenarios, clients often correspond to different regions, and uniform perturbation ignores risk heterogeneity and may disproportionately weaken clients that are already in a disadvantaged position, thereby increasing instability in global training. In contrast, Spatial-aware Noise assigns differentiated clipping and noise configurations according to client risk levels, providing stronger protection for high-risk clients while avoiding unnecessary perturbation for low-risk clients. This enables it to achieve a better balance among privacy protection, model utility, and training stability.

The aggregation experiments reveal another related issue regarding the nature of update deviation under strong non-IID conditions. When label skew is severe, FedAvg exhibits obvious training fluctuations and degraded final performance, indicating that simple averaging cannot sufficiently coordinate inconsistent updates from heterogeneous local distributions. Although Trimmed Mean and Krum can reduce the influence of extreme updates, their underlying logic still treats substantially deviated updates as objects to be truncated, weakened, or removed. However, in the geospatial FL setting considered in this paper, deviation does not necessarily imply abnormality or maliciousness; rather, it more often reflects reasonable semantic differences between local client distributions and the globally dominant distribution. If such updates are handled only through hard filtering, useful information from minority regions, marginal regions, or distribution-shifted regions may be lost. The consistency-based weighting method proposed in this paper instead constructs continuous aggregation weights according to JS divergence and adjusts client influence according to the degree of semantic discrepancy. This design does not attempt to eliminate heterogeneity completely, but rather reduces its disruptive effect on optimization while preserving valuable heterogeneous information. This also explains why the proposed aggregation strategy achieves a better balance between accuracy and fluctuation control than FedAvg, Trimmed Mean, and Krum.

The joint experiments reveal a very important phenomenon: there exists significant interaction between the client-side perturbation mechanism and the server-side aggregation strategy. Differentiated perturbation can provide more appropriate privacy protection on the client side, but such protection is not without cost. Because different clients adopt different clipping thresholds and noise intensities according to their risk levels, the differences among client updates are further amplified by differences in perturbation configurations, which may offset the intended benefits of the client-side differentiated protection mechanism. By introducing a consistency-driven soft weighting mechanism on the server side, the integrated method outperforms the perturbation-only setting in both accuracy and training stability, and this performance improvement is not achieved at the cost of larger training oscillation. The relationship between client-side differentiated privacy protection and server-side consistency weighting is a joint design with inherent collaborative logic, and should be understood as two mutually coupled core dimensions within the same collaborative learning process, requiring coordinated modeling and design.

The purpose of the governance-layer experiments is different from that of the above learning-side experiments. The FL experiments evaluate the direct effects of perturbation and aggregation on model utility and convergence, whereas the governance experiments evaluate system-level collaborative trustworthiness and execution capability. In this study, the governance layer is evaluated as an executable prototype for closed-loop coordination, auditability, traceability, and rule-triggered permission management, rather than as a direct contributor to model accuracy or convergence. The results show that key training metadata can be structurally mapped into on-chain governance events without changing the main off-chain training workflow, thereby supporting rule submission, aggregation-result recording, committee recording, permission updates, and audit queries. Therefore, the value of the governance layer lies in enhancing auditability, traceability, and rule enforcement capability in long-term multi-party collaboration. This architectural choice is also consistent with the system design of this paper: high-frequency and computation-intensive training and aggregation processes remain off-chain, whereas governance, record keeping, and rule execution are deployed on-chain. Such decoupling helps maintain learning efficiency while improving collaborative trustworthiness and institutional support for practical deployment.

The experiments in this paper relatively fully verify the rationality of the overall idea of “hierarchical decoupling and collaborative design.” The risk-aware perturbation mechanism addresses the differentiated protection problem at the client-side update generation stage, the consistency-driven aggregation mechanism addresses the stable optimization problem under heterogeneous updates at the server side, and the governance layer addresses the problem of trustworthy coordination and auditability in multi-party collaboration. The three act respectively on the three levels of update protection, global optimization, and collaborative governance. They each undertake different functions while simultaneously forming a mutually supportive unified framework at the system level. In this way, this paper constructs an integrated design path for strongly heterogeneous geospatial FL scenarios, which not only improves the training stability and predictive performance of the model under complex distribution environments, but also enhances the system integrity of the federated collaboration process in terms of privacy protection, rule constraints, and long-term trustworthy operation.

5.2. Limitations

This study has several limitations that define the scope of the current experimental evaluation. The experiments in this paper are conducted on the EuroSAT_RGB dataset with ResNet-18 as the backbone model. Although this setting is sufficient to verify the effectiveness of the proposed design under controlled heterogeneous conditions, further validation on more diverse geospatial datasets, model architectures, and task types would help strengthen the generality of the conclusions.

Second, this paper focuses on the problem of stable optimization in FL under statistical heterogeneity, mainly examining the impact of data distribution shifts on model convergence behavior and performance. Strong active adversarial scenarios, such as model poisoning, backdoor attacks, and other Byzantine malicious behaviors, are not included in the current experimental setting.

Finally, the governance component is currently evaluated at a relatively small scale, with the primary purpose of verifying the feasibility of its integration with the proposed FL framework and its basic support functions for auditable coordination and traceability. Therefore, the present experiments do not aim to provide a complete engineering assessment for large-scale deployment, such as consensus overhead, long-term cross-institutional operation, or system performance under substantially expanded node participation. These issues remain important directions for future work, especially as the framework moves toward more realistic deployment environments.

6. Conclusions

This paper investigates the coupled challenge of update-level privacy risk and statistical heterogeneity in geospatial FL, and proposes a hierarchically decoupled collaborative framework consisting of three functional components: client-side privacy control, server-side consistency-aware aggregation, and governance support. On the client side, a risk-aware perturbation mechanism is introduced to reduce the exposure risk of sensitive statistical and semantic information in shared updates. On the server side, a consistency-driven soft-weight aggregation strategy is designed to alleviate the excessive suppression of legitimate but distributionally shifted updates under non-IID conditions. At the system level, an architecture combining on-chain governance with off-chain training is introduced as an auditable support layer for multi-party collaboration.

Experiments on the EuroSAT_RGB dataset show that the proposed design is particularly effective when statistical heterogeneity becomes severe. The results indicate that, under strong non-IID conditions, differentiated privacy perturbation preserves model utility better than uniform perturbation, while consistency-aware aggregation can further reduce update mismatch and improve convergence stability. In particular, the joint design achieves the best overall performance among all compared settings. This finding supports the view that, in geospatial FL, privacy-aware local protection and consistency-aware server-side coordination should be co-designed rather than treated as isolated modules. From a practical perspective, these findings suggest that FL for geospatial applications may benefit from a layered design path that functionally decouples privacy control, aggregation stability, and auditable collaboration, while coordinating them at the system level.

Future work will further extend the proposed framework in several practically relevant directions. The current design can be expanded to a broader range of geospatial application scenarios, including more diverse remote sensing classification tasks, multi-source Earth observation analysis, and cross-institutional spatial intelligence collaboration. Richer semantic representations can be explored, and the framework can be further extended to more challenging collaborative environments, including stronger distribution shifts, more complex participation patterns, and adversarial interference. From a systems perspective, future work will focus on improving the scalability and deployability of the overall framework, so that privacy-aware training, consistency-aware aggregation, and auditable collaboration can be effectively integrated in more realistic large-scale multi-party settings.