FL-SPDP: Spatially Modulated Differentially Private Federated Learning for Robust Satellite Image Recognition

Abstract

Satellite image recognition increasingly relies on data collected by geographically distributed institutions, but centralizing geospatial imagery is often infeasible due to policy and privacy constraints. Federated learning enables collaborative training, yet standard aggregation (e.g., FedAvg) degrades under strong geographic non-IID shifts, and adding client-level differential privacy (DP) can further reduce utility—especially for rare land-cover classes—due to gradient clipping and injected noise. We propose FL-SPDP, a spatially modulated DP federated framework that leverages coarse spatial priors to reweight and aggregate client updates among geographically related clients, improving robustness to heterogeneity while preserving formal privacy guarantees. Experiments on SEN12MS and BigEarthNet show that FL-SPDP improves accuracy and macro-F1 at a fixed privacy budget ($\epsilon \le 3.5$, $\delta ={10}^{-5}$) and strengthens rare-class performance, demonstrating an effective privacy–utility trade-off for satellite image analysis.

1. Introduction

The rapid expansion of satellite constellations and advances in remote sensing technologies have generated an unprecedented volume of high-resolution Earth observation data. These multispectral and multitemporal images underpin a wide range of critical applications, including land cover mapping, urban growth assessment, environmental monitoring, climate modeling, and agricultural forecasting. Deep learning models—especially convolutional neural networks (CNNs) and vision transformers (ViTs)—have become indispensable for extracting semantic information from such data, achieving state-of-the-art performance in classification, segmentation, and detection tasks. However, building these models often requires access to large and diverse datasets aggregated from multiple sources, which introduces significant privacy, security, and governance concerns. In particular, geospatial imagery frequently contains sensitive information about infrastructure or national territories, subject to strict data-sharing regulations that hinder centralized learning.

In the considered federated platform, each client corresponds to an organization (e.g., a regional agency, company, or research lab) that holds satellite imagery and labels locally and aims to train models for common remote sensing tasks such as multi-label land-cover classification, scene recognition, and related monitoring applications (e.g., crop/forest mapping or damage assessment). In this paper we focus on satellite image recognition (classification) as a representative task family, instantiated by land-cover recognition on SEN12MS and multi-label scene recognition on BigEarthNet.

Federated learning (FL) has emerged as a promising paradigm for decentralized model training that addresses these challenges by enabling multiple participants to collaboratively train a global model without exchanging raw data. In FL, each client performs local updates on private datasets and communicates only model parameters or gradients to a central server for aggregation. While this setup reduces the risk of direct data exposure, it remains vulnerable to privacy attacks such as gradient inversion and membership inference. To ensure stronger protection, differential privacy (DP) can be incorporated into the training process, offering formal guarantees that the contribution of any individual data record has a bounded influence on the resulting model. By injecting carefully calibrated noise into gradients or parameters, DP limits information leakage while maintaining model utility.

Despite its potential, integrating DP with FL for satellite image recognition introduces several unique challenges. Satellite imagery is highly heterogeneous—affected by variations in spatial resolution, atmospheric conditions, spectral bands, and regional characteristics—resulting in non-IID data distributions that amplify the detrimental effects of DP noise. This heterogeneity often leads to unstable convergence and performance degradation, especially when combined with strict privacy budgets. Moreover, remote sensing datasets exhibit substantial class imbalance, where rare land cover categories such as wetlands, snow, or burnt areas are sparsely represented, making them more susceptible to noise-induced misclassification. Additionally, communication and computational constraints on edge devices, such as ground stations or onboard satellite processors, limit the number of local and global training iterations, necessitating efficient and noise-tolerant optimization strategies.

To overcome these limitations, we propose FL-SPDP, a novel privacy-preserving framework that integrates federated learning with spatially modulated aggregation and adaptive client-local differential privacy. The key idea is to leverage spatial metadata—such as vegetation indices, elevation statistics, or spectral entropy—to modulate each client’s contribution during model aggregation. This spatially informed weighting mitigates the negative impact of non-IID data and improves model generalization across geographically diverse regions. At the client side, we employ differentially private stochastic gradient descent (DP-SGD) enhanced with adaptive gradient clipping and noise calibration to minimize the performance loss caused by privacy noise. Furthermore, we integrate domain-specific data augmentation strategies tailored to the spectral and temporal characteristics of satellite imagery, improving robustness under noisy and heterogeneous training conditions.

We evaluate FL-SPDP on two large-scale remote sensing benchmarks, SEN12MS and BigEarthNet, across both single-label and multi-label classification tasks. Experimental results demonstrate that FL-SPDP consistently outperforms existing federated and differentially private baselines in terms of accuracy and macro-F1 score, achieving up to 87% accuracy and 0.82 macro-F1 under strong privacy guarantees ($\epsilon \le 3.5$). The framework exhibits improved stability, faster convergence, and enhanced robustness on rare land cover categories. These findings underscore the potential of spatially aware and adaptively private federated learning as a foundation for secure and scalable satellite image recognition in future Earth observation systems.

The key contributions of this paper are summarized as follows:

• We propose FL-SPDP, the first federated learning framework that combines spatially modulated aggregation with adaptive client-local differential privacy to enable secure and effective satellite image recognition across geographically distributed datasets.
• We introduce a novel weighting scheme that leverages geospatial metadata (e.g., NDVI, elevation entropy) to reweight client updates, mitigating the impact of non-IID data and improving generalization in heterogeneous environments.
• We conduct extensive experiments on the SEN12MS and BigEarthNet datasets, demonstrating that FL-SPDP achieves superior accuracy and robustness compared to existing federated and DP-based baselines while maintaining strong privacy guarantees ($\epsilon \le 3.5$).

2. Related Work

2.1. Satellite Image Recognition

The application of deep learning to satellite imagery has transformed remote sensing workflows, enabling high-accuracy classification, object detection, and segmentation at global scale. Convolutional neural networks (CNNs), long short-term memory (LSTM) networks, and more recently vision transformers (ViTs) have been widely adopted for multispectral and multitemporal image analysis [1,2,3]. Public datasets such as BigEarthNet [4], SEN12MS [5], and EuroSAT [6] have supported the training of large models under diverse environmental and spectral conditions. However, most existing pipelines assume centralized data storage, which limits their applicability in privacy-sensitive or geopolitically regulated contexts. For instance, satellite images may contain sensitive information about infrastructure, disaster zones, or sovereign land use—data that many institutions are unwilling or unable to share directly due to policy, security, or licensing constraints. This motivates the exploration of distributed and privacy-preserving learning frameworks for remote sensing applications.

2.2. Federated Learning for Geospatial Data

Federated learning [7,8,9] is a decentralized machine learning paradigm that enables collaborative model training across distributed clients without transferring raw data. FL has gained popularity in domains like healthcare [10], finance [11], and mobile applications [12], but its adoption in the geospatial domain is relatively nascent. Recent works have investigated federated learning for land cover classification [13], flood detection [14], and agricultural analytics [15]. However, these approaches often overlook key domain characteristics: satellite imagery exhibits high intra-client heterogeneity due to varying atmospheric conditions, temporal sampling, sensor resolution, and biogeographical diversity. This violates the i.i.d. assumptions of conventional federated optimization methods and can lead to unstable or biased convergence when client data distributions differ significantly. Moreover, most geospatial FL frameworks to date do not integrate formal privacy mechanisms, making them vulnerable to model inversion and gradient leakage attacks.

Why standard FL/DP baselines struggle. In geospatial FL, client data are strongly non-IID because each client observes a limited set of climates, seasons, and land-cover types. Uniform averaging (FedAvg [7]) therefore mixes conflicting gradients and can cause client drift, while rare classes that appear on only a few clients contribute weak, easily diluted updates. When client-level DP is added (e.g., DP-FedAvg [16]/DP-SGD [17]), per-client clipping introduces bias that disproportionately suppresses these already scarce rare-class gradients, and the injected Gaussian noise can dominate low-magnitude signals. FL-SPDP targets this failure mode by spatially modulating aggregation weights using coarse spatial priors, effectively pooling semantically related clients to increase the signal-to-noise ratio of informative (including rare-class) features under DP noise.

2.3. Differential Privacy in Federated Learning

Differential privacy [18] provides a rigorous framework for limiting the influence of individual data points in the training process, typically by perturbing gradients or parameters with noise. In the federated setting, DP is often implemented via local gradient clipping and additive noise before communication, as in the DP-FedAvg [16] and DP-FTRL [19] algorithms. The Moments Accountant technique introduced in [17] allows tight composition of DP budgets across rounds. However, privacy-preserving FL remains a challenging area: noise amplification under small batch sizes, communication constraints, and heterogeneous data significantly degrade performance, particularly in high-dimensional settings like satellite imagery. Several methods have attempted to mitigate this by using adaptive clipping bounds [20], importance sampling [21], or personalized noise schedules [22], but such techniques have yet to be widely validated in remote sensing applications.

Client heterogeneity is a central challenge in federated learning. Data across clients may differ in feature distributions (covariate shift), label frequencies (concept drift), or semantic classes (task imbalance), especially in environmental data collected across varying ecological zones. Approaches such as FedProx [23], FedNova [24], and FedDyn [25] attempt to mitigate these effects by incorporating regularization, dynamic weighting, or local adaptation. However, few studies have explored federated optimization techniques that are explicitly aware of spatial context. In satellite imagery, where pixel distributions may vary dramatically across regions (e.g., desert vs. forest vs. urban), incorporating spatial priors could significantly improve model stability and generalization. Our work addresses this gap by introducing spatially modulated aggregation, which reweights client contributions based on geospatial metadata such as vegetation indices and terrain variability.

2.4. Domain-Specific Augmentation and Regularization

Data augmentation is a standard technique for improving generalization in deep learning models. In remote sensing, augmentation strategies must account for the spectral and temporal structure of satellite data, including seasonality, cloud cover, and sensor noise. Prior work has proposed spectral channel dropout, seasonal jitter, and geometric transformations tailored to satellite imagery [26,27]. However, the role of such augmentations in privacy-preserving federated learning remains underexplored. DP noise tends to obscure fine-grained patterns, which makes regularization through augmentation even more crucial. Our work incorporates domain-specific augmentations into the FL pipeline to enhance model robustness under DP constraints, especially in rare semantic categories.

2.5. Positioning of Our Work

To the best of our knowledge, our proposed framework FL-SPDP is the first to combine spatially aware aggregation, locally differentially private optimization, and remote sensing-specific augmentation into a unified system for privacy-preserving satellite image recognition. Compared to prior work, we provide a holistic solution that addresses the triad of challenges in federated remote sensing: data heterogeneity, privacy risk, and domain-specific structure. By leveraging geospatial priors for adaptive aggregation and calibrating noise at the client level, we demonstrate that strong privacy guarantees can be achieved without sacrificing utility.

Relation to recent work. FedSuper [28] improves robustness to Byzantine clients, but it does not exploit spatial structure and is orthogonal to our goal of maintaining utility under client-level DP in geographically non-IID remote sensing data. ILLIA [29] uses k-anonymity for location privacy in continuous LBS queries and does not perform federated optimization or provide client-level DP guarantees. Private range-counting over evolving IoT data [30] focuses on centralized query answering rather than decentralized training, which is mismatched to federated satellite settings. In contrast, FL-SPDP couples spatial priors with client-level DP specifically to mitigate the privacy–utility degradation caused by geographic heterogeneity and rare classes in satellite imagery.

3. Preliminaries

This section introduces the foundational concepts that support our proposed framework: federated learning (FL) and differential privacy (DP). These two principles collectively enable collaborative model training across distributed satellite imagery sources while maintaining rigorous privacy protection.

3.1. Federated Learning

Federated learning (FL) is a distributed machine learning paradigm in which multiple clients jointly train a global model under the coordination of a central server. Each client i possesses a private local dataset $D_i$, which remains entirely on the client device throughout the process. Instead of sharing data directly, clients perform local computations and transmit only model updates to the server.

In each communication round t, the central server broadcasts the current global model parameters $w_t$ to a selected subset of clients $S_t$. Every participating client then performs local training on its dataset to minimize the local loss function:

$$L_i\left(w\right)={\displaystyle \frac{1}{|D_i|}}\sum _{(x,y)\in D_i}\mathsf{\ell }(w;x,y),$$

(1)

where $\mathsf{\ell }(w;x,y)$ is the per-sample loss function (e.g., cross-entropy). Using gradient descent, each client updates its model as follows:

$$w_i^{t+1}=w_t-\eta \nabla L_i\left(w_t\right),$$

(2)

where $\eta$ denotes the learning rate. Once the local optimization is completed, the updated parameters $w_i^{t+1}$ are sent back to the server.

The server aggregates all received client updates to produce the next global model $w_{t+1}$ using a weighted averaging scheme proportional to each client’s data size:

$$w_{t+1}=\sum _{i\in S_t}{\displaystyle \frac{|D_i|}{{\sum }_{j\in S_t}\left|D_j\right|}}{w}_i^{t+1}.$$

(3)

This process repeats iteratively until the global model converges. Although raw data remain local, prior studies have demonstrated that model gradients may still leak sensitive information through inversion or reconstruction attacks. This vulnerability motivates the integration of differential privacy within the federated framework.

3.2. Differential Privacy

Differential privacy (DP) provides a mathematically rigorous standard for quantifying and limiting the information an algorithm may reveal about any single data record. A randomized mechanism $\mathcal{M}$ satisfies $(\epsilon ,\delta )$-differential privacy if, for any two neighboring datasets D and $D^{\prime }$ differing by one entry, and for any measurable subset $\mathcal{O}\subseteq \mathrm{Range}\left(\mathcal{M}\right)$, the following condition holds:

$$Pr[\mathcal{M}\left(D\right)\in \mathcal{O}]\le e^{\epsilon }Pr[\mathcal{M}\left(D^{\prime }\right)\in \mathcal{O}]+\delta ,$$

(4)

where $\epsilon$ measures the privacy loss (smaller values correspond to stronger privacy), and $\delta$ represents a small probability that the guarantee may fail.

In our setting, confidential information includes (i) each client’s raw satellite imagery, labels, and associated acquisition/spatial metadata stored locally, and (ii) any per-example signal that could be inferred from communicated updates. The server and other clients never access raw data; they only observe DP-sanitized model updates.

“Private optimization” means optimizing the learning objective with a randomized training algorithm that satisfies differential privacy: changing a single training example in a client dataset changes the distribution of the communicated update by at most a multiplicative $e^{\epsilon }$ (plus $\delta$) factor. Practically, we bound sensitivity via per-example ${\mathsf{\ell }}_2$-clipping and then add calibrated Gaussian noise, so training still minimizes the same empirical loss but with a controlled perturbation that protects individual examples.

Without DP, model updates can leak information through gradient leakage, model inversion, or reconstruction attacks, where an adversary tries to recover representative inputs/labels whose gradients match observed updates. DP mitigates this by (a) limiting the maximum influence of any single example (clipping) and (b) randomizing updates (noise), providing a formal, worst-case bound on what can be inferred about any individual example from the communicated messages.

To incorporate DP into model training, we adopt the Differentially Private Stochastic Gradient Descent (DP-SGD) algorithm, which modifies conventional SGD through two key operations: gradient clipping and noise addition. For each example i in a mini-batch B, the per-sample gradient $g_i$ is clipped to a maximum $L_2$-norm C to constrain the influence of any single data point:

$${\overline{g}}_i={\displaystyle \frac{g_i}{max\left(1,\frac{\parallel g_i{\parallel }_2}{C_k^t}\right)}}.$$

(5)

Next, Gaussian noise is injected into the average of the clipped gradients to ensure privacy:

$$\tilde{g}={\displaystyle \frac{1}{\left|B\right|}}\sum _{i\in B}{\overline{g}}_i+\mathcal{N}(0,{\sigma }^2{C}^{2}I),$$

(6)

where $\sigma$ is the noise multiplier that governs the privacy–utility trade-off, and I denotes the identity matrix, ensuring isotropic perturbation. The model parameters are then updated using the noisy gradient:

$$w\leftarrow w-\eta \tilde{g}.$$

(7)

As training progresses, the accumulated privacy loss must be monitored. To this end, we employ the moments accountant method, which provides a tighter and more stable estimation of the total privacy budget $\epsilon$ under repeated compositions.

By combining FL with DP, our framework enables privacy-preserving training on distributed satellite image datasets, allowing participants to collaboratively improve a global model while preventing the leakage of sensitive geospatial information.

4. Methodology

We delineate a federated optimization framework augmented with differential privacy for geospatial image classification under constrained communication and data governance regimes. The framework is designed to mitigate inter-client heterogeneity and information leakage while preserving model efficacy in high-dimensional remote sensing domains. Algorithm 1 gives a general pipeline of our proposal.

4.1. Formal Problem Statement

Let $\mathcal{C}=\{C_1,C_2,\dots ,C_K\}$ denote the set of participating entities (clients), each endowed with a local empirical distribution ${\mathcal{D}}_k$. The objective is to approximate the minimizer of the expected risk over the aggregate population distribution $\mathcal{D}={\displaystyle \frac{1}{K}}{\sum }_{k=1}^K{\mathcal{D}}_k$:

$$\underset{w\in {\mathbb{R}}^d}{min}F\left(w\right)={\displaystyle \frac{1}{K}}\sum _{k=1}^K{\mathbb{E}}_{(x,y)\sim {\mathcal{D}}_k}\left[\mathsf{\ell }(w;x,y)\right],$$

(8)

where w are the model parameters, and $\mathsf{\ell }:{\mathbb{R}}^d\times \mathcal{X}\times \mathcal{Y}\to {\mathbb{R}}_{+}$ is a convex, Lipschitz-continuous loss function (e.g., cross-entropy). Owing to the non-IID nature of satellite imagery across disparate geographies, standard assumptions of uniform data distributions are relaxed.

Algorithm 1: Federated Learning with Spatial Modulation and Differential Privacy (FL-SPDP)

Threat model and metadata. We assume an honest-but-curious server that observes the communicated model updates and attempts to infer information about any single client’s data; client-level DP is applied to each client update before communication. Spatial weighting uses only coarse, locally computed metadata summaries to derive a scalar ${\alpha }_k$; raw metadata and per-sample statistics are never shared. We discuss residual auxiliary-information risks and practical mitigations (quantization, public maps, or secure aggregation of ${\alpha }_k$) in Section 4.1.

4.2. Federated Optimization

In this work, we extend the canonical Federated Averaging (FedAvg) paradigm [7] by incorporating a spatiotemporally aware aggregation scheme designed to mitigate the deleterious effects of non-IID data distributions endemic to heterogeneous geospatial sensing environments. Unlike conventional FL algorithms which treat clients as exchangeable entities, our framework exploits auxiliary spatial metadata to modulate client influence during aggregation, thereby regularizing the global learning trajectory toward geodiversity-aware generalization.

At each communication round $t\in \{1,\dots ,T\}$, a stochastic subset of clients ${\mathcal{S}}_t\subseteq \mathcal{C}$ is activated according to a Bernoulli sampling process with uniform or stratified inclusion probability $p\in (0,1]$. Each selected client $k\in {\mathcal{S}}_t$ initializes its local copy of the global model $w_t\in {\mathbb{R}}^d$ and performs $E\in \mathbb{N}$ epochs of stochastic optimization over its private dataset $D_k$, partitioned into mini-batches ${\left\{B_b^{\left(k\right)}\right\}}_{b=1}^{M_k}$, each of size B.

The local update rule is defined as

$$w_k^{t+1}=w_t-\eta \sum _{b=1}^E\nabla {\widehat{F}}_k(w_t;B_b^{\left(k\right)}),$$

(9)

where ${\widehat{F}}_k(w;B_b^{\left(k\right)})={\displaystyle \frac{1}{|B_b^{\left(k\right)}|}}{\sum }_{(x_i,y_i)\in B_b^{\left(k\right)}}\mathsf{\ell }(f_w\left(x_i\right),y_i)$ denotes the empirical batch loss, $\eta >0$ is the learning rate, and $f_w$ is the parameterized hypothesis class (e.g., CNN or ViT-based encoder).

Upon completion of local training, the server aggregates the set of model updates ${\left\{w_k^{t+1}\right\}}_{k\in {\mathcal{S}}_t}$ using a spatially modulated convex combination. The global model is updated via

$$w_{t+1}=\sum _{k\in {\mathcal{S}}_t}{\omega }_k·w_k^{t+1},$$

(10)

where the client-specific weight ${\omega }_k\in {\Delta }^{|{\mathcal{S}}_t|}$ lies on the probability simplex and is defined as

$${\omega }_k={\displaystyle \frac{{\alpha }_k·\left|D_k\right|}{{\sum }_{j\in {\mathcal{S}}_t}{\alpha }_j·\left|D_j\right|}},$$

(11)

Here, “spatially modulated aggregation” means that the server uses non-uniform aggregation weights ${\omega }_k$ that combine data-size weighting with a spatial factor ${\alpha }_k$ derived from coarse, locally computed spatial metadata. In standard FedAvg, ${\alpha }_k=1$ for all clients, so weights depend only on $|D_k|$. In FL-SPDP, each participating client computes ${\alpha }_k=\varphi \left(z_k\right)$ from its local metadata vector $z_k$ (e.g., NDVI statistics, elevation entropy, spectral entropy, and a season bucket) and shares only this scalar (or a quantized version) together with its DP-sanitized model update. The server then normalizes ${\alpha }_k\left|D_k\right|$ over the round participant set to form ${\omega }_k$, which reduces update dilution under geographic non-IID and helps preserve rare-class signals concentrated on a subset of clients. “Adaptive aggregation” refers to recomputing ${\omega }_k$ each round for the sampled participant set ${\mathcal{S}}_t$ (and, if desired, smoothing the weights across rounds), so the effective aggregation adapts to which clients participate and their spatial priors.

${\alpha }_k\in {\mathbb{R}}^{+}$ represents a learned or heuristically derived spatial prior that quantifies the epistemic contribution or topographic representativeness of client $C_k$. This factor may be constructed from domain-specific features such as the following:

• Normalized Difference Vegetation Index (NDVI) statistics (mean/variance), a proxy for vegetation density and land-cover composition [31].
• Elevation entropy, computed as Shannon entropy over a binned DEM histogram within the client region, capturing terrain complexity and heterogeneity [32].
• Spectral entropy, computed as Shannon entropy of the normalized mean reflectance across bands, capturing radiometric diversity and mixed materials [33].
• A coarse seasonality indicator (e.g., month-of-year bucket/climate zone), capturing temporal domain shift.

Rationale for NDVI/elevation entropy/spectral entropy. These variables are widely used in remote sensing as compact summaries of (i) vegetation vigor (NDVI), (ii) terrain-driven variation (elevation entropy), and (iii) spectral mixture/complexity (spectral entropy). Importantly, they are low-dimensional, stable to pixel-level noise, and can be computed locally without sharing raw imagery, making them suitable signals for spatial weighting under strong geographic non-IID.

Although these statistics are coarsened summaries, they can still correlate with location and thus constitute auxiliary information. In FL-SPDP, metadata are computed on-device and only used to derive a scalar weight ${\alpha }_k$; raw metadata never leaves the client. When metadata sensitivity is a concern, ${\alpha }_k$ can be derived from binned/quantized metadata, computed from publicly available climatology/DEM products, or transmitted via secure aggregation; we add this discussion explicitly in Section 4.1.

In practice, ${\alpha }_k$ may be computed as a scalar function ${\alpha }_k=\phi \left(m_k\right)$, where $m_k\in {\mathbb{R}}^q$ is a vector of metadata features and $\phi :{\mathbb{R}}^q\to {\mathbb{R}}^{+}$ is either a parametric mapping (e.g., small neural network) or a domain-calibrated rule-based estimator. This effectively imposes a non-uniform geometry on the client population, enhancing convergence in scenarios of geographical stratification.

Additionally, we also introduce a sparsity-aware regularization term in the update objective to prevent overfitting to underrepresented spatial contexts. The adjusted local training objective for client k becomes

$${\tilde{F}}_k\left(w\right)={\widehat{F}}_k\left(w\right)+\lambda ·{\Omega }_k\left(w\right),$$

(12)

where $\lambda$ is a regularization coefficient and ${\Omega }_k\left(w\right)$ penalizes spatial misalignment with historical model drift trajectories. A concrete instantiation is

$${\Omega }_k\left(w\right)={\parallel w-{\overline{w}}_k\parallel }_2^2,$$

(13)

where ${\overline{w}}_k$ is the exponentially weighted moving average of previous global models observed by client k. This encourages local updates to remain proximal to the global manifold, mitigating divergence under strong non-IID conditions.

4.3. Client-Local DP-SGD with Adaptive Noise Calibration

In our federated framework, each client independently incorporates differential privacy into its local stochastic optimization process via the Differentially Private Stochastic Gradient Descent (DP-SGD) algorithm. This ensures that no single data point within a client’s local dataset has a disproportionate influence on the model update, thereby preventing leakage of sensitive spatial or contextual information.

The local training protocol proceeds in discrete iterations over mini-batches. Let $B={\left\{(x_i,y_i)\right\}}_{i=1}^{\left|B\right|}\subset D_k$ denote a sampled mini-batch from client $C_k$’s dataset. For each iteration, the client performs the following operations:

First, the gradient of the loss function is computed on a per-sample basis. That is, for each $(x_i,y_i)\in B$, the raw gradient is given by $g_i={\nabla }_w\mathsf{\ell }(f_w\left(x_i\right),y_i),$ where $f_w$ is the current model, and ℓ is the loss function. These per-example gradients are not aggregated immediately but instead individually processed to limit sensitivity.

To bound the contribution of each data point to the final update, the gradients are subjected to $L_2$-norm clipping. Specifically, each gradient vector $g_i\in {\mathbb{R}}^p$ is scaled down if its norm exceeds a fixed threshold C, yielding a clipped gradient:

$${\overline{g}}_i={\displaystyle \frac{g_i}{max\left(1,\frac{\parallel g_i{\parallel }_2}{C}\right)}}.$$

(14)

This operation ensures that the influence of any individual data sample on the subsequent update is strictly limited to the bounded region defined by the $L_2$-ball of radius C. Clipping is a critical step that sets the global sensitivity of the gradient aggregation mechanism, which in turn determines the scale of the noise required to achieve a specific privacy guarantee.

Adaptive clipping (computed per client, updated per round, applied per mini-batch). Each client k maintains a running clipping statistic ${\widehat{C}}_k^t$. During round t, for every local mini-batch update we obtain the DP-sanitized update vector $\tilde{g}$ (after clipping and noise); we record its norm $\parallel \tilde{g}{\parallel }_2$ and update the next-round clipping norm via

$${\widehat{C}}_k^{t+1}=\beta {\widehat{C}}_k^t+(1-\beta )·{\mathrm{median}}_{s\in {\mathcal{U}}_k^t}{\parallel {\tilde{g}}_{k,s}\parallel }_2,C_k^{t+1}=\mathrm{clip}\left(\tau {\widehat{C}}_k^{t+1},C_{min},C_{max}\right).$$

(15)

The resulting $C_k^t$ is then used for per-sample ${\mathsf{\ell }}_2$-clipping inside every mini-batch step in round t (Equation (9)), and the Gaussian noise is scaled accordingly (Equation (11)). Since ${\widehat{C}}_k^{t+1}$ is computed only from $\tilde{g}$, which is already differentially private, this adaptation is post-processing and does not incur additional privacy loss.

Once the gradients are clipped, they are aggregated by averaging over the mini-batch:

$$\overline{g}={\displaystyle \frac{1}{\left|B\right|}}\sum _{i\in B}{\overline{g}}_i.$$

(16)

To this averaged, sensitivity-bounded gradient, Gaussian noise is added to obfuscate individual contributions and satisfy differential privacy. The noise vector is sampled from a multivariate isotropic Gaussian distribution with covariance matrix ${\sigma }^2{C}^2{\mathbf{I}}_p$, where $\sigma >0$ is the noise multiplier calibrated based on the desired privacy level:

$$\tilde{g}=\overline{g}+\mathcal{N}(0,{\sigma }^2{C}^2{\mathbf{I}}_p).$$

(17)

The variance ${\sigma }^2$ is carefully selected via analytical bounds provided by Rényi Differential Privacy (RDP), which allows tighter privacy accounting under composition than traditional ($\epsilon ,\delta$)-DP. This facilitates tracking the cumulative privacy loss over T communication rounds while ensuring that the resulting mechanism adheres to the global privacy budget.

Finally, the noisy gradient $\tilde{g}$ is used to update the local model parameters using a standard gradient descent step:

$$w\leftarrow w-\eta \tilde{g},$$

(18)

where $\eta$ is the local learning rate. This update procedure is repeated for a fixed number of local epochs before the privatized model $w_k^{t+1}$ is returned to the server.

The integration of DP-SGD at the client level allows privacy protection to be enforced in a decentralized manner. Crucially, no information about the raw gradients, clipped vectors, or added noise is transmitted, thereby preserving both individual-level data confidentiality and inter-client model independence. This design ensures the compatibility of DP guarantees with federated learning architectures deployed in sensitive or regulated geospatial contexts.

4.4. Privacy Budget Accounting

We employ the Moments Accountant technique [17] to obtain a tighter upper bound on the cumulative privacy loss under composition. Let $\alpha$ denote the Rényi divergence order. The privacy loss at iteration t is defined as

$${\mathcal{A}}_t\left(\alpha \right)=log\mathbb{E}\left[exp\left((\alpha -1)D_{\alpha }(\mathcal{M}\left(D\right)\parallel \mathcal{M}\left(D^{\prime }\right))\right)\right],$$

(19)

with the overall budget after T rounds being

$$\epsilon =\underset{\alpha }{min}\left\{{\displaystyle \frac{1}{\alpha -1}}\left(\sum _{t=1}^T{\mathcal{A}}_t\left(\alpha \right)-log\delta \right)\right\}.$$

(20)

5. Privacy–Utility Trade-Off Analysis

The incorporation of differential privacy (DP) into federated learning (FL) intrinsically perturbs the information geometry of the optimization process, engendering a high-dimensional trade-off manifold between epistemic fidelity and stochastic obfuscation. In this section, we formalize the quantitative structure of this tension and elucidate its algorithmic manifestations within the coupled dynamics of gradient regularization, privacy composition, and communication cadence. The emergent trade-off landscape—nonlinear, nonconvex, and data-dependent—constitutes the principal axis along which the convergence behavior of privacy-preserving distributed optimization can be understood.

5.1. Formal Characterization via Rényi Divergence Composition

Let the overall privacy expenditure after T global communication epochs be expressed as a cumulative tuple $(\epsilon ,\delta )$ under the $\alpha$-order Rényi differential privacy (RDP) accountant. Each stochastic mechanism ${\mathcal{M}}_t$ associated with the t-th local update is parameterized by its Rényi divergence $D_{\alpha }({\mathcal{M}}_t\left(D\right)\parallel {\mathcal{M}}_t\left(D^{\prime }\right))$, which captures the logarithmic moment-generating function of the privacy loss random variable. The total composition is thus constrained by

$$\epsilon \le \underset{\alpha >1}{min}\left\{{\displaystyle \frac{1}{\alpha -1}}(\sum _{t=1}^T{D}_{\alpha }({\mathcal{M}}_t\left(D\right)\parallel {\mathcal{M}}_t\left(D^{\prime }\right))-log\delta )\right\}.$$

(21)

This formulation encapsulates the intrinsic coupling between gradient stochasticity and cumulative information leakage, where the additive divergence structure encodes both temporal and spatial correlations of privacy perturbations.

5.2. Signal-to-Noise Geometry of DP-SGD

Within the canonical Gaussian mechanism, the effective signal-to-noise ratio (SNR) of the privatized gradient estimator emerges as a dominant factor governing model utility:

$$\mathrm{SNR}={\displaystyle \frac{\mathbb{E}\left[{\parallel \overline{g}\parallel }_2^2\right]}{\mathrm{Tr}\left(\mathrm{Cov}\left(\mathcal{N}(0,{\sigma }^2{C}^2{\mathbf{I}}_p)\right)\right)}}={\displaystyle \frac{{\parallel \overline{g}\parallel }_2^2}{{\sigma }^2{C}^{2}p}}.$$

(22)

Here, $\overline{g}$ represents the clipped, mean gradient vector within a batch, p the parameter dimensionality, and ${\sigma }^2{C}^2$ the isotropic variance envelope induced by DP perturbations. This ratio quantifies the degree to which the optimization trajectory retains informative curvature directionality in the presence of additive Gaussian diffusion. As $\sigma$ increases, the curvature of the empirical loss landscape becomes progressively attenuated, effectively contracting the Fisher information volume accessible to the optimizer.

The asymptotic structure of the accuracy function $\mathcal{A}$ with respect to SNR can be phenomenologically approximated by a logarithmically concave mapping:

$$\mathcal{A}(\sigma ,C)\approx {\kappa }_1·log\left(1+{\displaystyle \frac{{\kappa }_2}{{\sigma }^2{C}^2}}\right),$$

(23)

where ${\kappa }_1$ and ${\kappa }_2$ denote data-dependent curvature constants capturing the spectral scaling of the Hessian under privacy perturbations. This relation formalizes the intuition that accuracy deteriorates sub-logarithmically with increasing privacy noise intensity, with diminishing sensitivity as stochastic regularization saturates.

5.3. Temporal Privacy Accumulation and Communication Cadence

The stochastic composition of privacy guarantees under iterative federated updates admits a linear upper bound with respect to communication periodicity E. Denoting ${\epsilon }_E$ as the per-round privacy cost, the total privacy expenditure scales as

$${\epsilon }_T=T·{\epsilon }_E,{\epsilon }_E\propto {\displaystyle \frac{E}{B·K_{\mathrm{eff}}}}·{\displaystyle \frac{C^2}{{\sigma }^2}},$$

(24)

where B is the local batch size and $K_{\mathrm{eff}}$ is the effective cardinality of participating clients. This proportionality underscores a delicate interplay: increasing local computation (E) inflates the local privacy loss per round, whereas enlarging client participation and batch dimensionality amortizes the same cost over a broader stochastic basis. The resulting dependency implies that privacy leakage propagates not merely as an additive function of iteration count, but as a multiplicative function of interaction density across the federated topology. Consequently, temporal scheduling and probabilistic client sampling emerge as first-order instruments for navigating the privacy–utility frontier.

The Gaussian perturbation mechanism can equivalently be interpreted through the lens of information theory as a contraction mapping on the mutual information between model parameters and local data sources. For client i, the mutual information $I(w;D_i)$ between parameters w and dataset $D_i$ satisfies

$$I(w;D_i)\le {\displaystyle \frac{1}{2ln2}}·{\displaystyle \frac{\parallel \overline{g}{\parallel }_2^2}{{\sigma }^2{C}^2}}.$$

(25)

This inequality delineates an upper bound on the extractable informational content encoded within the model after privatization, revealing that DP-SGD effectively reduces the representational entropy of learned parameters. The addition of noise thus acts as a form of implicit capacity regularization, constraining the mutual information channel through which private patterns could otherwise be memorized. In the high-noise limit, this manifests as a degradation of model-specific Fisher information, enforcing an implicit information bottleneck at the gradient aggregation layer.

6. Experiments

To evaluate the effectiveness of our proposed FL-SPDP framework, we conduct extensive experiments on two benchmark satellite image datasets. Our goals are to (i) quantify the trade-off between privacy and utility, (ii) assess the robustness of spatially modulated aggregation, and (iii) benchmark against existing federated learning baselines.

6.1. Experiment Setup

6.1.1. Datasets

We use SEN12MS and BigEarthNet in our experiments. SEN12MS [5] is a multi-temporal, multi-spectral dataset constructed from Sentinel-1 and Sentinel-2 satellite imagery. It includes over 180,000 patches annotated with land cover labels from the CORINE classification system. Each patch contains 12-band multispectral imagery and spans diverse ecological zones and seasons. BigEarthNet [4] is a large-scale remote sensing dataset composed of 590,000 Sentinel-2 image patches across ten European countries. Each image is associated with multi-label annotations drawn from the CORINE Land Cover (CLC) database. The dataset covers 43 land cover classes and exhibits significant geographical and spectral heterogeneity.

To simulate real-world federated settings, we partition each dataset by geographic region (e.g., northern, central, and southern Europe), emulating non-IID distributions across clients. Each simulated client holds data from a single region or country, ensuring diversity in climate, vegetation, and imaging conditions.

6.1.2. Implementation Details

We implement our FL-SPDP framework using PyTorch 2.0 and extend the Opacus library for differential privacy integration. All experiments are conducted on a distributed computing environment with NVIDIA A100 GPUs, where each simulated client process is assigned a separate GPU thread to parallelize local training.

Model Architecture. We use a ResNet-18 backbone modified for remote sensing. The first convolutional layer is adapted to accept 12 spectral bands (from Sentinel-2), replacing the standard 3-channel configuration. To improve spectral feature fusion, we also introduce a lightweight spectral attention module after the second residual block. Batch normalization layers are retained and synchronized across clients. Dropout with $p=0.3$ is applied before the final fully connected layer. For BigEarthNet (multi-label), we replace the softmax activation with a sigmoid, and use binary cross-entropy loss.

Federated Setup. Each training run simulates $K=15$ clients partitioned by geographic regions (e.g., Northern vs Southern Europe). In each communication round, we randomly sample $|{\mathcal{S}}_t|=5$ clients without replacement. The global model is initialized with Xavier uniform weights and distributed to all selected clients at the start of each round.

Each client performs $E=5$ local epochs of DP-SGD per round, using a mini-batch size of $B=64$. We use the Adam optimizer with hyperparameters ${\beta }_1=0.9$, ${\beta }_2=0.999$, $ϵ={10}^{-8}$, and weight decay $\lambda =5\times {10}^{-4}$. The learning rate is initialized at $\eta ={10}^{-3}$ and decayed by a factor of $0.5$ every 30 rounds. Gradient accumulation is used across microbatches of size 16 to accommodate memory constraints under DP.

Differential Privacy Configuration. Clients apply DP-SGD using the Gaussian mechanism. The per-sample gradient norm is clipped to a bound $C\in \{0.5, 1.0, 2.0\}$, and noise is added from the distribution $\mathcal{N}(0,{\sigma }^2{C}^2{\mathbf{I}}_d)$ with noise multiplier $\sigma \in \{0.5, 1.0, 2.0, 3.0\}$. The privacy budget is tracked using the Moments Accountant [17], which enables tight composition bounds. For all experiments, we target a total budget of $(\epsilon ,\delta )=(\le 4, {10}^{-5})$ over $T=100$ communication rounds.

To reduce privacy leakage due to repeated participation, each client is sampled independently with probability $p=0.33$ per round, resulting in approximately uniform exposure across clients. Sampling probabilities are recorded and used in the privacy accountant for accurate total $\epsilon$ estimation. We use an RDP accountant for the subsampled Gaussian mechanism to track $(\epsilon ,\delta )$ (with $\delta ={10}^{-5}$). Within each client, DP-SGD uses per-step mini-batch sampling with rate $q_k=\left|B\right|/|D_k|$ and noise multiplier $\sigma$ (reported in each table). For accounting, we compose over the total number of local DP-SGD steps across all participating rounds; we evaluate RDP orders $\alpha \in \{1.1, 1.2, \dots , 64\}$ and convert to $(\epsilon ,\delta )$ via the standard optimal-order bound. Client participation is uniform at rate $p=m/K$ (with m participating clients per round and K total clients).

Augmentations. After reflectance normalization to $[0, 1]$, we apply per-band multiplicative jitter $x_b\leftarrow s_b{x}_b$ with $s_b\sim \mathcal{U}[0.9, 1.1]$, additive Gaussian noise $x_b\leftarrow x_b+\mathcal{N}(0,0.{01}^2)$, and random band dropout (set $x_b=0$) with probability $0.1$. Seasonal augmentation: For multi-temporal SEN12MS samples, we randomly select one acquisition among available seasons for each epoch and randomly swap season pairs with probability $0.5$; for BigEarthNet, we apply illumination/contrast jitter as a proxy for seasonal radiometry shift.

Convergence and Early Stopping. Training proceeds for up to $T=100$ rounds or until validation loss stagnates for 10 consecutive rounds. The best global model is selected based on validation macro-F1 and is used for final test evaluation.

Spatial Weight Calibration. The spatial aggregation weights $\left\{{\alpha }_k\right\}$ are computed from per-client NDVI statistics and elevation entropy. Each client extracts summary statistics from its local region, which are linearly scaled into the range $[0.5,1.5]$ to reflect representational importance in the spatially weighted average.

All random seeds are fixed to 42 across NumPy (v1.26), PyTorch (v2.1), and Python (v3.10) RNGs (including CUDA/cuDNN determinism where applicable). We release all training scripts and configuration files to ensure full reproducibility.

6.1.3. Baselines

We compare the proposed method against the following baselines:

• Centralized (No Privacy): Standard deep learning with full access to all training data.
• FedAvg [7]: Classical federated averaging without privacy or spatial modulation.
• FedProx [34]: Federated learning with a proximal term to handle client drift.
• FedDyn [35]: Dynamic regularization to mitigate objective inconsistency under non-IID data.
• SCAFFOLD [36]: Control variates to reduce client drift and accelerate convergence under heterogeneity.
• FedNova [37]: Normalized aggregation to handle heterogeneous local progress across clients.
• FedAvg + DP: Standard FedAvg integrated with client-local DP-SGD using fixed noise and clipping.
• FedDyn/SCAFFOLD/FedNova + DP: DP variants obtained by applying the same client-local DP-SGD (clipping + Gaussian noise) to the local optimizer while keeping each method’s server-side correction unchanged.

6.1.4. Evaluation Metrics

To evaluate both model performance and privacy, we employ several key metrics: Top-1 classification accuracy for single-label tasks, macro-averaged F1 score to capture the balance between precision and recall across all classes, and mean Average Precision (mAP) for assessing multi-label classification performance, particularly on the BigEarthNet dataset. For privacy evaluation, we report the final privacy budget as the $\epsilon$ value under a fixed $\delta ={10}^{-5}$. Additionally, we track the total number of communication rounds needed for the model to converge, reflecting training efficiency. Communication cost. For each round, each participating client uploads one model (or update) and downloads the global model; thus the per-round volume is ${\mathrm{Comm}}_{\mathrm{round}}=2m\left|w\right|$ (uplink+downlink), where m is the number of participating clients and $\left|w\right|$ is the model size in bytes. We report both (i) the number of rounds to reach a target performance and (ii) the corresponding total communication ${\mathrm{Comm}}_{\mathrm{total}}={\mathrm{Comm}}_{\mathrm{round}}\times R$, enabling a quantitative comparison of convergence speed.

6.2. Results and Analysis

We assess our proposed FL-SPDP framework on the SEN12MS

Table 1. Performance comparison on SEN12MS under $(\epsilon \le 4,\delta ={10}^{-5})$.

Method	Accuracy (%)	F1 (Macro)	$\mathit{\epsilon }$	Rounds
Centralized (No DP)	89.2	0.823	–	–
FedAvg (No DP)	86.7	0.799	–	100
FedProx (No DP)	87.1	0.804	–	100
FedDyn (No DP)	87.5	0.808	–	100
SCAFFOLD (No DP)	87.8	0.812	–	95
FedNova (No DP)	87.3	0.807	–	100
FedAvg + DP ($\sigma =1.0$)	82.5	0.741	3.8	120
FedDyn + DP ($\sigma =1.0$)	83.4	0.752	3.8	110
SCAFFOLD + DP ($\sigma =1.0$)	83.9	0.758	3.8	105
FedNova + DP ($\sigma =1.0$)	83.1	0.748	3.8	112
FedAvg + DP ($\sigma =2.0$)	79.3	0.708	2.2	130
DP-FTRL ($\sigma =1.0$)	80.9	0.716	3.9	130
DP-FTRL ($\sigma =2.0$)	76.8	0.692	2.1	140
FL-SPDP ($\sigma =1.0$)	85.6	0.782	3.4	90
FL-SPDP ($\sigma =2.0$)	82.1	0.751	2.1	95

and BigEarthNet Table 2 datasets under various privacy constraints and compare against state-of-the-art baselines. Our metrics include accuracy, macro-F1, mAP, and $\epsilon$ under fixed $\delta ={10}^{-5}$, across 100 rounds of training.

Evaluation on SEN12MS Table 1. Since all methods communicate the same model size and use the same client participation, the total communication is proportional to the number of rounds. On SEN12MS with $\sigma =1.0$, FL-SPDP reaches the selected early-stopping criterion in 90 rounds versus 120 for FedAvg + DP, corresponding to a $25\%$ reduction in total communication volume.

FL-SPDP provides the best balance of accuracy and privacy. Even with $\sigma =2.0$, it retains an F1 score above 0.75, outperforming DP-FTRL by nearly 6%. The use of spatially weighted updates accelerates convergence and reduces the need for excessive communication rounds (See Figure 1).

Table 2. Results on BigEarthNet under $(\epsilon \le 4,\delta ={10}^{-5})$.

Method	mAP	F1 (Macro)	$\mathit{\epsilon }$
Centralized (No DP)	0.881	0.826	–
FedAvg (No DP)	0.855	0.802	–
FedDyn (No DP)	0.862	0.808	–
SCAFFOLD (No DP)	0.866	0.812	–
FedNova (No DP)	0.860	0.807	–
FedAvg + DP ($\sigma =1.0$)	0.781	0.739	3.7
FedDyn + DP ($\sigma =1.0$)	0.792	0.746	3.7
SCAFFOLD + DP ($\sigma =1.0$)	0.795	0.748	3.7
FedNova + DP ($\sigma =1.0$)	0.789	0.742	3.7
FedAvg + DP ($\sigma =2.0$)	0.748	0.708	2.0
DP-FTRL ($\sigma =1.0$)	0.767	0.721	3.9
DP-FTRL ($\sigma =2.0$)	0.731	0.695	2.0
FL-SPDP ($\sigma =1.0$)	0.823	0.773	3.5
FL-SPDP ($\sigma =2.0$)	0.795	0.742	2.1

Table 2. Results on BigEarthNet under $(\epsilon \le 4,\delta ={10}^{-5})$.

Method	mAP	F1 (Macro)	$\mathit{\epsilon }$
Centralized (No DP)	0.881	0.826	–
FedAvg (No DP)	0.855	0.802	–
FedDyn (No DP)	0.862	0.808	–
SCAFFOLD (No DP)	0.866	0.812	–
FedNova (No DP)	0.860	0.807	–
FedAvg + DP ($\sigma =1.0$)	0.781	0.739	3.7
FedDyn + DP ($\sigma =1.0$)	0.792	0.746	3.7
SCAFFOLD + DP ($\sigma =1.0$)	0.795	0.748	3.7
FedNova + DP ($\sigma =1.0$)	0.789	0.742	3.7
FedAvg + DP ($\sigma =2.0$)	0.748	0.708	2.0
DP-FTRL ($\sigma =1.0$)	0.767	0.721	3.9
DP-FTRL ($\sigma =2.0$)	0.731	0.695	2.0
FL-SPDP ($\sigma =1.0$)	0.823	0.773	3.5
FL-SPDP ($\sigma =2.0$)	0.795	0.742	2.1

FL-SPDP yields a higher F1 score than all DP-enhanced baselines across privacy levels. Gains on rare labels (e.g., “Permanent Snow”) suggest improved robustness through client-local spectral augmentation and adaptive gradient clipping.

In contrast, as quantitatively summarized in

Table 3. Fine-grained accuracy and F1 across increasing $\sigma$ values (fixed $C=1.0$).

$\mathit{\sigma }$	Accuracy (%)	F1 (Macro)	$\mathit{\epsilon }$
0.5	87.2	0.801	6.7
0.75	86.2	0.793	5.1
1.0	85.6	0.782	3.4
1.5	83.8	0.765	2.5
2.0	82.1	0.751	2.1
2.5	80.3	0.729	1.6
3.0	78.3	0.709	1.3

, FL-SPDP shows graceful degradation, retaining over 78% accuracy even at $\epsilon \approx 1.3$. Lower noise levels yield better utility but weaker privacy guarantees.

Figure 2 presents a heatmap of macro-F1 scores across six representative land cover classes in BigEarthNet, comparing four methods: FedAvg+DP, DP-FTRL, FL-SPDP, and a non-private baseline (No DP). The results clearly demonstrate that FL-SPDP outperforms other differentially private approaches across all classes, achieving F1 scores closest to the No DP upper bound. The advantage is especially pronounced on rare categories such as Burnt Areas, Wetlands, and Permanent Snow, where FL-SPDP achieves gains of 4–7 percentage points in macro-F1 over FedAvg+DP. This highlights the effectiveness of spatially modulated aggregation and adaptive clipping in stabilizing gradient updates for underrepresented semantic classes. For frequent classes like Urban Fabric and Arable Land, FL-SPDP maintains high accuracy while preserving privacy, indicating robust generalization without sacrificing utility. Overall, the heatmap confirms that FL-SPDP provides consistent improvements in both common and rare categories under tight differential privacy constraints.

In summary, the proposed FL-SPDP framework consistently achieves strong performance, reaching 85–87% accuracy on SEN12MS and over 0.82 mAP on BigEarthNet while maintaining a tight privacy budget of $\epsilon <3.5$. Its design proves scalable across varying datasets, noise levels, and client heterogeneity. Notably, FL-SPDP converges 20–30% faster than standard DP baselines like FedAvg+DP, leading to reduced communication overhead. Moreover, it demonstrates stable privacy–utility trade-offs Figure 3, with sublinear accuracy degradation under increasing noise, confirming the effectiveness of spatial aggregation and adaptive DP mechanisms in preserving model utility under strict privacy constraints.

Figure 2. Heatmap of per-class macro-F1 scores on BigEarthNet. FL-SPDP consistently improves both common and rare categories.

Figure 2. Heatmap of per-class macro-F1 scores on BigEarthNet. FL-SPDP consistently improves both common and rare categories.

Figure 3. Privacy–utility trade-off on SEN12MS. FL-SPDP consistently yields higher utility under equivalent privacy budgets.

Figure 3. Privacy–utility trade-off on SEN12MS. FL-SPDP consistently yields higher utility under equivalent privacy budgets.

6.3. Ablation Studies

To isolate the contributions of each component in our FL-SPDP framework, we conduct a series of ablation experiments on the SEN12MS and BigEarthNet datasets. Each experiment removes or modifies one module at a time while keeping all other settings fixed. Results are reported under $(\epsilon \le 3.5,\delta ={10}^{-5})$ with noise multiplier $\sigma =1.0$ and clipping norm $C=1.0$. The results are given in

Table 4. Ablation results on SEN12MS (accuracy and F1 at fixed $\epsilon \le 3.5$).

Configuration	Accuracy (%)	F1 (Macro)	$\mathit{\epsilon }$
FL-SPDP (Full)	85.6	0.782	3.4
– No Spatial Aggregation	83.2	0.755	3.4
– Fixed Clipping ($C=1.0$)	84.1	0.768	3.4
– No Augmentation	84.2	0.764	3.4
– No Spatial + No Augment.	82.5	0.744	3.4

.

Metadata-variable ablation. To isolate the impact of each metadata signal used for spatial weighting, we additionally evaluate ${\alpha }_k$ computed from (i) NDVI-only, (ii) elevation-entropy-only, and (iii) spectral-entropy-only, as well as pairwise combinations. This directly answers which variable drives the gains under geographic non-IID and rare classes. Results are summarized in

Table 5. Metadata-variable ablation for spatial weighting on SEN12MS (fixed $\sigma =1.0$).

Weight Signal for ${\mathit{\alpha }}_{\mathit{k}}$	Accuracy (%)	F1 (Macro)	$\mathit{\epsilon }$
NDVI only	84.6	0.770	3.4
Elevation entropy only	84.1	0.765	3.4
Spectral entropy only	84.3	0.767	3.4
NDVI + Elevation entropy	85.0	0.775	3.4
NDVI + Spectral entropy	85.2	0.777	3.4
Elevation entropy + Spectral entropy	84.8	0.772	3.4
All (FL-SPDP)	85.6	0.782	3.4

.

Spatial Aggregation: Removing ${\alpha }_k$ degrades accuracy by 2.4% and F1 by 0.027. This confirms the value of client-specific weighting in mitigating regional data skew.

Adaptive Clipping: Switching to fixed global clipping yields a 1.4% F1 drop. Adaptive norms stabilize per-client training under heterogeneous feature statistics.

Augmentation: Removing spectral and seasonal augmentations reduces F1 by 1.8%, suggesting these operations help retain model generalization under high noise.

Compound Effect: Eliminating both spatial aggregation and augmentation results in a 4% utility loss, emphasizing their synergy in preserving privacy-robust learning.

Table 6. F1 scores on selected BigEarthNet classes under different methods.

Class	FedAvg + DP	DP-FTRL	FL-SPDP	No DP
Urban Fabric	0.812	0.793	0.834	0.855
Coniferous Forest	0.749	0.728	0.782	0.801
Non-irrigated Arable	0.772	0.741	0.804	0.823
Wetlands (Rare)	0.590	0.563	0.627	0.664
Burnt Areas (Rare)	0.505	0.488	0.552	0.601
Permanent Snow (Rare)	0.538	0.519	0.579	0.622

presents a detailed class-wise performance breakdown on the BigEarthNet dataset. FL-SPDP offers the strongest performance on both frequent and rare classes. Improvements of 5–7% F1 on minority categories highlight the benefits of spectral augmentation and stable local updates.

We also instigate the effect of Clipping Norm C. The results are presented in

Table 7. Impact of clipping norm C on model utility (fixed $\sigma =1.0$).

C	Accuracy (%)	F1 (Macro)	$\mathit{\epsilon }$
0.5	84.3	0.769	2.8
1.0	85.6	0.782	3.4
1.5	85.1	0.778	4.2
2.0	84.4	0.766	5.3

. In particular, smaller C values limit gradient sensitivity but restrict learning. We find $C=1.0$ achieves the optimal privacy–utility balance in both convergence and final performance.

In summary, the ablation studies demonstrate that each component of FL-SPDP plays a critical role in achieving strong privacy-preserving performance. Spatial aggregation and spectral augmentation each contribute more than 2% to the final macro-F1 score, enhancing generalization across both frequent and rare classes. Adaptive gradient clipping further stabilizes training under heterogeneous client distributions by addressing local variance in data sensitivity. Collectively, these modules enable FL-SPDP to maintain high utility while adhering to strict differential privacy guarantees, confirming the effectiveness of the system’s integrated design.

Removing spatial aggregation yields the largest drop in macro-F1, consistent with the fact that spatial weighting reduces effective heterogeneity by emphasizing geographically related clients that share background statistics (illumination, seasonality, vegetation indices) and class co-occurrences. This increases the effective sample size for rare classes whose occurrences are confined to a subset of clients, making their gradients less likely to be washed out by uniform averaging. Under DP, this also improves robustness because spatially weighted aggregation reduces update variance across clients; with lower variance, more gradient components survive clipping and the aggregated update has a higher signal-to-noise ratio relative to the added Gaussian noise. The clipping-norm study in Table 7 further supports this view: overly small C increases clipping bias, whereas FL-SPDP remains comparatively stable because spatial modulation dampens extreme client updates before averaging.

7. Conclusions

This paper introduces FL-SPDP, a novel framework for privacy-preserving satellite image recognition that integrates federated learning with client-level differential privacy and spatially modulated aggregation. Designed for the challenges inherent in remote sensing—including heterogeneous data distributions, rare semantic classes, and strict privacy constraints—FL-SPDP leverages geospatial priors and domain-specific augmentations to enhance learning stability and robustness. Through comprehensive evaluations on SEN12MS and BigEarthNet, we show that FL-SPDP consistently outperforms baseline methods, achieving strong accuracy under tight privacy budgets and significantly improving performance on underrepresented land cover types.

These results underscore the importance of combining domain-aware aggregation with principled privacy mechanisms in federated optimization for geospatial tasks. As remote sensing systems increasingly rely on distributed learning pipelines, our work provides a scalable and privacy-preserving foundation for satellite-based analytics. Future directions include extending FL-SPDP to segmentation and change detection tasks, integrating adaptive personalization, and deploying on edge-based satellite systems to support real-time federated learning.