Explainable and Federated Recommender Systems: A Survey and Conceptual Framework for Trustworthy Personalization

Abstract

Federated recommender systems (FRS) enable privacy-preserving collaborative training without sharing raw user data, while explainable recommender systems (XRS) aim to improve transparency, trust, and accountability. However, research that integrates federation and explainability remains limited and fragmented. This survey reviews recent work at the intersection of Federated Learning (FL), Explainable Artificial Intelligence (XAI), and recommender systems, referred to as Explainable Federated Recommender Systems (XFRS). We analyze architectures, learning paradigms, personalization strategies, and explainability mechanisms, and discuss their trade-offs in explainability, privacy, and trustworthiness. We propose a unified conceptual framework that links these components in decentralized recommendation settings. Combining bibliometric analysis with a systematic categorization of the literature, we identify key gaps and emerging trends, including the limited adoption of explainability in federated settings. Finally, we summarize open challenges and future directions toward trustworthy, privacy-aware personalized recommender systems.

1. Introduction

1.1. Motivation

Recommender systems (RS) have become a necessity in the online environment to establish user interaction and customize experience in various areas such as social networks [1], e-commerce [2], online learning [3], job search [4] and entertainment [5]. By integrating user preferences and behaviors, they go beyond convenience and have an impact on social conventions, market trends, and individual decisions. However, data-driven personalization raises concerns about user privacy, algorithm transparency, and fairness [6]. Two complementary paradigms address these concerns: Federated Learning (FL), which enables collaborative model training without centralizing raw data [7], and eXplainable Artificial Intelligence (XAI), which provides human-understandable justifications for recommendations [8]. Their combination is a key step towards trustworthy personalization [9] and motivates this survey.

1.2. Challenges

Despite promising advances in RS, several critical challenges remain in achieving trustworthiness, explainability, and decentralization [10,11]. Centralized RS expose users to privacy and security risks, and may amplify bias by optimizing on globally aggregated data, which can disadvantage minority user groups.

A second challenge is the trade-off between explainability and privacy [12]. Explanations can inadvertently reveal sensitive user information or internal model details, particularly in federated or privacy-preserving settings [13]. Balancing explainability with confidentiality therefore remains an open research problem.

Finally, federated and decentralized RS face technical challenges in scalability and heterogeneity. Non-independently and identically distributed (Non-IID) client data, heterogeneous devices and networks, and limited communication resources make convergence more difficult and can harm overall performance; adding explainability on top of this can further raise both computational and communication costs.

Addressing these interconnected issues is crucial to unlocking the full potential of explainable federated recommender systems (XFRS).

1.3. Contributions

This survey provides a structured scoping review of XFRS research and makes the following contributions:

• We systematically categorize the literature by architecture, learning paradigm, personalization strategy, and explainability mechanism, and discuss associated trade-offs. We conduct an extensive review of the existing literature on XFRS, covering methodological foundations and architectural designs that integrate explainability and FL principles.
• We complement the review with a bibliometric analysis to highlight the dynamics of research, gaps, and emerging trends.
• We introduce an integrated conceptual framework for XFRS that systematically structures the key elements—federated optimization, privacy-preserving techniques, explainability components, and trust-related aspects—and elucidates their interrelations in decentralized recommendation scenarios.
• We summarize open challenges and outline future directions toward trusted and privacy-aware personalized RS.

Unlike earlier surveys on RS, this review does not claim to introduce fundamentally new concepts but instead aims to serve as a complementary perspective. Prior surveys differ in their primary focus, with some concentrating predominantly on XRS, while others emphasize federated or privacy-preserving recommendation approaches. This work differs by simultaneously addressing explainability in conjunction with federated and decentralized recommendation scenarios. References  [14,15,16,17,18,19,20] were selected to reflect a progression from general explainability concepts to RS, and subsequently to FL and FRS. Although XRS and FRS have each progressed rapidly in recent years, their joint integration remains relatively underexplored, with only a limited number of studies explicitly addressing both paradigms simultaneously (Table 1). This gap highlights the novelty and timeliness of a comprehensive synthesis at this stage, aimed at consolidating emerging approaches and outlining future research directions toward trustworthy personalization.

Table 1. Positioning of existing surveys with respect to XFRS.

Work	Primary Focus	Technical Coverage	Explainability & Evaluation Analysis (vs. XFRS)
2024 [14]	Explainability in FL (general ML)	Model-agnostic XAI; FL lifecycle; governance	XAI: Global/local taxonomy. Eval: No RS-specific metrics. Gap: No recommender focus; no XFRS protocol.
2024 [15]	Deep Federated RS	DL-based CF; FedAvg variants; local adaptation	XAI: None. Eval: Standard RS metrics only. Gap: No explainability or trust analysis.
2024 [16]	Federated RS architectures	CF, GNNs; cross-device FL	XAI: Mentioned conceptually. Eval: No unified framework. Gap: No taxonomy; no explanation criteria.
2024 [17]	FRS overview	CF; privacy-aware design; partial GNN discussion	XAI: Not central. Eval: High-level discussion only. Gap: No integration of FL, XAI, and trust.
2025 [18]	Comprehensive FRS survey	MF, GNNs; heterogeneity; FedAvg extensions	XAI: Briefly acknowledged. Eval: No explanation metrics. Gap: No privacy–explanation interplay.
2025 [19]	Cross-client FRS	Personalization; heterogeneity-aware FL	XAI: Conceptual motivation only. Eval: No XFRS-specific protocol. Gap: No XAI methods; no trade-off analysis.
2025 [20]	Cross-domain/multimodal FRS	Scenario-driven FL; GNN emphasis	XAI: Scenario-level mention. Eval: Not standardized. Gap: No unified XFRS framework; no leakage analysis.
Our paper (2026)	XFRS	Unified taxonomy (intrinsic, post-hoc, counterfactual); comparative FL architectures	XAI: Systematic mapping (attention/path, SHAP/LIME, counterfactuals). Eval: Faithfulness, simulatability, privacy-under-explanations. Contribution: First integrated framework aligning explainability, trustworthiness, and personalization; identification of research gaps.

Overall, this survey provides both a conceptual framework and practical insights for researchers and practitioners seeking to design the next generation of trustworthiness and explainable RS.

The identified gaps and challenges discussed in this survey motivate the following research questions:

 RQ1: 

How do explainability and FL contribute to building a trustworthy RS?

 RQ2: 

What are the main challenges of integrating explainability into FRS?

 RQ3: 

How do ethical principles such as fairness, transparency, robustness, and privacy manifest within XFRS architectures?

 RQ4: 

How can FL principles be systematically integrated into a unified conceptual framework to support trustworthy personalization in XRS?

These research questions guide the taxonomy, comparative analysis, and discussion of the open challenges presented throughout this survey.

1.4. Scope and Dimensions of the Survey

This survey adopts a structured scoping perspective to examine the methodological and architectural landscape of XFRS, providing both a systematic analysis of existing approaches and a conceptual synthesis of their core components. To promote clarity and uniformity, we clearly delineate the scope of the review using four analytical dimensions that emphasize learning paradigms, personalization approaches, explainability techniques, and characteristics related to trust. Figure 1 illustrates the multi-dimensional scoping framework adopted in this survey, highlighting the four key analytical dimensions that define the conceptual boundaries of XFRS research.

Figure 1. Multi-dimensional scoping framework.

• Learning paradigm The scope of this survey is primarily limited to FRS, in which user data remain distributed, and model training is coordinated through federated optimization. The study presents different learning approaches which vary according to their levels of decentralization and communication methods and their effects on personalization, privacy, and explainability.
  FRS constitute the main focus of this survey. The system keeps user interaction data on each client device, but allows multiple devices to combine their local updates for training the global recommendation model. The system protects user privacy through prevention of data sharing, but faces difficulties with communication speed and managing different client devices and making decisions based on limited model information. The research briefly analyzes two decentralized learning methods that operate without a central server for model updates: fully distributed optimization and blockchain-enabled learning. The methods generate enhanced robustness but create complex systems that restrict the development of advanced explainability techniques. The survey excludes centralized learning methods, but uses them to establish a comparative framework for evaluation. Centralized XRS systems provide improved model understanding through advanced explanation systems that depend on large-scale data collection but create privacy and trust issues that limit their ability to scale.
• Personalization level Personalization level describes how RS adapt their predictions and explanations to individual users or user groups. The XFRS system faces major personalization challenges because it operates within data locality restrictions while handling diverse client systems and restricted access to model operations. The study identifies various levels of personalization which produce separate effects on learning performance and system transparency and user confidence.
  Global personalization functions as FRS which develops a unified model for all users by using implicit personalization. The method scales well and achieves stable results, but provides basic personalization, which results in standard explanations that do not address particular user tastes. Local personalization operates through complete model training or fine-tuning which happens directly on client devices. The system provides detailed recommendations and explanations, yet it faces challenges because of limited data availability and requires substantial client processing power, which reduces its ability to work in various situations. The hybrid personalization system combines worldwide knowledge distribution with region-specific adaptation processes to maintain both personalization effectiveness and system scalability and data protection.
  The level of personalization affects the type of explanation that can be provided according to the principles of explainability. Local and hybrid personalization enable user-centric explanations that reflect individual preferences, while global models often rely on aggregated explanations that emphasize population-level patterns. The selection of the degree of personalization serves as a vital design choice in XFRS because it determines both the user trust and the transparency of the system.
• Explainability mechanism The survey encompasses a wide spectrum of explainability strategies, spanning post-hoc explanation techniques, inherently interpretable models, and model-agnostic methods suitable for federated environments. Examines explainability from both a system-level standpoint and the viewpoint of explanations presented to end users.
• Dimensions of trustworthiness In addition to explainability, the survey investigates several aspects of trustworthy AI, such as fairness, transparency, robustness, and privacy. These aspects are analyzed in the context of federated system architectures and explainability methods, emphasizing the inherent trade-offs and unresolved issues involved in realizing trustworthy personalization.

To minimize confusion, it is essential to clearly separate learning paradigms from levels of personalization. Learning paradigms specify how models are trained and coordinated across different entities, while personalization levels specify how recommendations are tailored to individual users or user groups within a chosen learning paradigm. In this paper, we treat explainability and trustworthiness as closely related but distinct dimensions. Explainability denotes techniques that provide insight into model behavior, while trustworthiness covers a wider set of system-level characteristics, including privacy and fairness. Although explainability can contribute to the improvement of trustworthiness, it is not sufficient alone to ensure it. Together, these dimensions provide a unified analytical framework that guides the taxonomy, comparative evaluation, and discussion of open research challenges presented in the remainder of this survey.

This survey does not seek to benchmark or rank models by empirical performance. Rather, its goal is to provide a structured architectural and conceptual overview of the XFRS design space. Although many of the reviewed works present accuracy scores, differential privacy budgets, inconsistencies in datasets, evaluation setups, client participation strategies, and threat assumptions make direct quantitative comparison methodologically invalid. As a result, this survey focuses on architectural patterns, trust-related aspects, and explainability approaches instead of empirical rankings.

1.5. Paper Outline

The organization of the article is structured as follows: Section 2 provides an overview of the results of our review of the literature, which are based on a bibliometric analysis. Section 3 explores the fundamental concepts and background relevant to recommendations, while Section 4 discusses concepts related to explainability techniques for XRS. Section 5 focuses on concepts associated with FRS, and Section 6 emphasizes the critical dimensions of trustworthiness. Furthermore, Section 7 examines existing architectural approaches to RS that integrate explainability and FL and, based on this analysis, presents a conceptual architectural framework grounded in the core components identified from the literature. Section 8 details the practical application of the framework and evaluates its effectiveness using quantitative and qualitative measures. Lastly, Section 9 presents our conclusions and future work.

2. Bibliometric Analysis of Research Trends

To ensure a rigorous and reproducible analysis of the current landscape, we conducted a bibliographic study to illustrate the development trends of research on FL, explainability, and RS over time. This survey was conducted using predefined methods informed by a systematic review of the literature and was reported in accordance with the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) guidelines [21]. No formal protocol was registered in a public registry prior to data extraction. The study indicates that explainability and FL have developed as distinct research trajectories with limited integration, as evidenced by keyword co-occurrence and overlay visualizations that highlight the field’s structure. XFRS remains an emerging field, as demonstrated by the absence of significant links between these clusters. This section explores the implications of these trends, evaluates the field’s advancement, and underscores the research gaps that need to be addressed in the subsequent sections.

The study follows a four-step methodological process (see Figure 2) that starts with the identification of the literature and proceeds to selection, and then moves to analysis before ending with synthesis and gap detection.

Figure 2. PRISMA-style flow diagram of the study selection process.

This review was reported in accordance with the PRISMA 2020 guidelines (see Checklist S1 in the Supplementary Materials).

2.1. Search Strategy and Data Sources

We conducted a systematic search of the Web of Science (WoS) Core Collection using a two-stage search strategy. First, a broad topic-based query was designed to capture research on federated and decentralized RS. This was achieved using the following expression:

TS = ((“recommender system*” OR “recommendation system*”)

      AND

      (“federated learning” OR “federated recommendation”

       OR “privacy-preserving” OR “distributed learning”

       OR “decentralized”))

This initial query was intended to identify the wider FRS literature. In a second stage, explainability-related concepts were considered during the screening process to isolate studies relevant to XFRS. A second, more focused query targeted works that also integrate explainability, defined by the search expression:

TS = ((“recommender system*” OR “recommendation system*”)

      AND

      (“federated learning” OR “federated recommendation”

       OR “privacy-preserving” OR “distributed learning”

       OR “decentralized”)

      AND

      (“explainable” OR “interpretable” OR “XAI”

       OR “transparent” OR “explanation”))

The search strategy employed complex Boolean search strings to identify relevant studies between January 2018 and December 2025.

The small number of studies that explicitly examine XFRS highlights the newness of this research area. The bibliometric analysis revealed only a small central body of work, indicating that XFRS should be regarded as an emerging topic rather than an established research field. The search was deliberately restricted to the WoS Core Collection and to computer science categories to maintain consistency, ensure high indexing quality, and support the reproducibility of the bibliometric analysis. Although other databases may also include relevant studies, broadening the search could lead to overlap and inconsistencies due to differing indexing practices.

2.2. Inclusion—Exclusion Criteria

The search strategy did not limit the type of documents considered, in order to achieve broad and comprehensive coverage. No restrictions were imposed on the type of document. Studies were included if they were published in English and indexed in the Web of Science Core Collection under the Computer Science research area, specifically within the categories Computer Science, Information Systems and Computer Science, Artificial Intelligence. Records indexed outside these categories were excluded to ensure relevance to technical contributions in RS, FL, and explainability.

Inclusion criteria:

• Articles from peer-reviewed journals indexed in the WoS Core Collection.
• Studies addressing explainability in federated or decentralized RS.
• Studies that provide methodological, architectural, or empirical contributions relevant to the scope of this scoping review.

Exclusion criteria:

• Studies not related to explainability in federated or decentralized RS.
• Articles with insufficient alignment with the defined scope of XFRS.
• Non–peer-reviewed publications or redundant records.

Screening and disagreement resolution: All records identified through the database search were screened based on titles and abstracts. Reports that passed the initial screening were assessed for full-text eligibility. Screening decisions were made using the predefined eligibility criteria.

2.3. Data Extraction and Synthesis

The initial search of the WoS Core Collection yielded 492 records related to federated and decentralized RS. A refined search incorporating explainability-related criteria, while applying the same inclusion and exclusion rules, resulted in 12 studies explicitly addressing XFRS. Following manual verification of keywords and abstracts, two studies were excluded for insufficient alignment with XFRS. The final corpus therefore comprised 10 studies that were included in the qualitative synthesis.

2.4. Quality Assessment and Gap Detection

The resulting dataset was analyzed using VOSviewer (version 1.6.20) to visualize keyword co-occurrence patterns and the temporal evolution of the research landscape. The selected publications underwent analysis through bibliometric methods, which included VOSviewer keyword co-occurrence and temporal overlay mapping, and qualitative analysis to discover common architectural designs and explainability methods, and trust-related elements.

The VOSviewer map displayed in Figure 3 illustrates the full keyword co-occurrence network for the first corpus, encompassing all 492 papers. The node size reflects the frequency of the keywords, the thickness of the link indicates the strength of co-occurrence, and the color scale of the overlay represents the average publication year. The visualization highlights RS and FL as dominant and highly connected nodes, with strong associations to privacy-related concepts (e.g., data privacy, privacy-preserving), trust-oriented technologies (e.g., blockchain), and learning paradigms. More recent research trends are visible around FL variants and security-related topics, while traditional recommendation techniques (e.g., collaborative filtering, matrix factorization) appear as foundational elements. While the full keyword network provides a broad, comprehensive view of the research landscape, the manually selected subset of 10 papers supports a more focused, concept-driven synthesis that aligns with the objectives of this survey and the proposed conceptual framework.

Figure 3. Bibliometric analysis of research trends between 2018–2025.

For the manually curated subset, a total of 88 keywords were obtained after preprocessing (see Figure 4). Given the exploratory nature of the analysis and the conceptual focus of this survey, a manual refinement step was applied to retain only the keywords most relevant to the scope of XFRS. This selection was guided by alignment with the core dimensions of the study—RS paradigms, FL, privacy preservation, trustworthiness, and explainability. As a result, the following keywords were retained for focused analysis: blockchain, collaborative filtering, federated learning, federated recommender, graph neural network, explainability, knowledge graph, neural networks, privacy protection, recommendation system, recommender system, recommender systems, trust, and XAI. This manual filtering ensured analytical clarity while preserving the conceptual breadth required for framework development. Figure 5 displays a VOSviewer overlay visualization of keyword co-occurrence, emphasizing both thematic linkages and temporal dynamics in the reviewed literature. In this map, FL emerges as a central, highly connected keyword, strongly associated with explainability, graph neural network, knowledge graph, and XAI. This pattern indicates that recent studies are increasingly focusing on explainable modeling approaches within federated frameworks. These nodes are mainly shaded in yellow, indicating their relatively recent prominence (2022–2024). On the right side of the visualization, RS serves as a key application node, closely linked to collaborative filtering and neural networks, which are colored from green to yellow-green, signaling their earlier development phase and their role as established foundations in recommendation research. The keywords trust and blockchain position themselves between FL and RS, forming a bridging layer that points to the increasing focus on trust-oriented methods and decentralized security solutions. FRS, in contrast, appears as a smaller and more sparsely connected node, reflecting the early and still fragmented stage of work that explicitly integrates federation with recommendation. Overall, the visualization highlights a clear temporal shift from traditional RS architectures toward federated, explainable, and trust-oriented approaches, supporting the conclusion that XFRS is an emerging research field marked by increasing methodological diversity.

Figure 4. Bibliometric analysis using all keywords and the finalized set of papers.

Figure 5. Bibliometric analysis using refined keywords and the finalized set of papers.

Building on the earlier qualitative and bibliometric analysis, Table 2 presents the categorization of the reviewed studies along the main analytical dimensions employed in this survey. Papers that do not explicitly address explainability in federated or decentralized RS are not considered central XFRS contributions. They are only cited as background work when they provide transferable insights that relate to the analytical dimensions investigated in this survey. Brings the results together by classifying each work according to its learning paradigm, its degree of personalization, its application of explainability methods, and its treatment of trust-related issues. This structured synthesis translates the earlier conceptual discussion into a tangible taxonomy and reveals the uneven incorporation of personalization, explainability, and trust in existing approaches, thereby emphasizing the necessity of the proposed conceptual framework.

Table 2. Classification of the included studies across core analytical dimensions.

Reference	Learning Paradigm	Personalization Level	Explainability	Trustworthiness
ECLAIR: A Centralized AI-Powered Recommendations System in a Multi-Node EXAIT System [22]	Centralized	Global	×	×
Collaborating with Users in Proximity for Decentralized Mobile Recommender Systems [23]	Decentralized	User	×	×
Marking the Pace: A Blockchain-Enhanced Privacy-Traceable Strategy for Federated Recommender Systems [24]	Federated	Global	×	✓
MobRec—Mobile Platform for Decentralized Recommender Systems [25]	Decentralized	User	×	×
Non-Negative Matrix Factorization in Recommender Models: Concept, Survey, and Future Direction [26]	Centralized	×	×	×
Latest Trends of Security and Privacy in Recommender Systems: A Comprehensive Review and Future Perspectives [27]	Centralized	×	×	✓
Enhancing Security of Host-Based Intrusion Detection Systems for the Internet of Things [28]	×	×	×	✓
KG-FedCGNN: Federated Cross-User Graph Neural Networks for Reliable Recommendations via Knowledge Graph Enhancement [29]	Federated	User	✓	✓
FedShield: Privacy Preservation for Blockchain Enabled Federated Learning with Homomorphic Encryption and Zero-Knowledge Proof [30]	Federated	×	×	✓
Bursting the Filter Bubble with Knowledge Graph Inversion [31]	Centralized	User	✓	×

These results underscore the need for a comprehensive review that connects explainability and FL. This aims to improve trustworthiness and decentralized RS, providing researchers with a unified perspective on ongoing advances and the challenges that remain to be addressed.

3. Traditional Recommendation Paradigms as Building Blocks for XFRS

RS can be classified into several types, depending on the algorithms and approaches used to create recommendations. The five primary categories of traditional RS include content-based, collaborative filtering (CF), knowledge-based, context-based, and demographic-based systems. However, as time has progressed, numerous methodologies have been developed that have contributed to the emergence of hybrid-based systems. Numerous practical applications extensively use RS to assist users in finding relevant content within large datasets. In a cloud-based data center, traditional RS gather user–item interaction data and train a centralized model to provide recommendation services.

In this survey, our objective is not to provide an exhaustive review of all traditional RS categories. Instead, we focus on CF, content-based, and hybrid approaches, as these paradigms form the core methodological foundations upon which most federated and XRS are built. Other paradigms, such as knowledge-based, context-aware, and demographic-based systems, are typically incorporated as auxiliary components within hybrid architectures and are therefore implicitly discussed when relevant [32].

• Collaborative Filtering as a Foundation for XFRS

CF methods are used to suggest items by analyzing user–item interaction histories, identifying user preference patterns without relying on content details [33]. While this approach can yield precise and diverse recommendations, its reliance on centralized data storage and unrestricted access to full data sets restricts scalability and creates privacy concerns in large-scale or sensitive environments [34]. However, when these models are trained in centralized settings, they still require complete access to user data, potentially endangering privacy.

The integration of FL into CF frameworks addresses these limitations by supporting distributed model training across various user devices or institutions without centralizing raw data [35]. In federated CF, each participant trains a model locally on their own interactions, and only the model updates are combined on a central server. This data-decentralized learning paradigm maintains data privacy while ensuring accurate recommendations. Furthermore, FL-based CF systems can boost trust and transparency by incorporating explainable recommendation mechanisms to show how specific user actions or relationships affect the recommendation result [36]. Therefore, by merging FL for privacy-preserving model training with explainable CF techniques, RS can balance personalization, scalability, and explainability in modern data-sensitive environments (see Figure 6). The asterisk (*) in Figure 6 indicates that these interactions reflect non-IID user behavior, implying that each client can hold data drawn from distinct distributions, a typical property of FL settings.

Figure 6. Federated CF with explainable recommendations (* User-item interactions are non-IID, varying across users and contexts).

• Content-Based Recommendation in XFRS

These methods derive user preferences by examining past interactions and determining the features of items a user has liked or rated before [33]. The system then suggests new items with attributes similar to those previously favored. Unlike CF, which relies on behavior across different users, content-based methods focus on the features of items, such as keywords, textual content, visual elements, or metadata, to build personalized user profiles. Although effective for personalization, centralized content-based methods face significant issues such as scalability, data scarcity, and user privacy concerns, as user profiles and behavior logs are generally stored and managed in a central location [37]. To address these issues, FL has been integrated into content-based frameworks, allowing distributed model training between user devices or institutional nodes without the need to share sensitive personal data [38,39]. Each client develops a local user model based on private interaction data, while a global model is periodically updated through the federated aggregation of model parameters instead of raw data. This FL approach improves privacy and supports the continuous improvement of the model as new information arrives [40]. Furthermore, integrating XAI techniques into content-based systems increases user trust and transparency [41]. In conclusion, FL combined with explainable content-based methods fosters privacy-conscious personalization, understandable reasoning, and adaptive learning, key features for modern RS operating in distributed and sensitive data environments (see Figure 7).

Figure 7. Federated content-based with explainable recommendations.

• Hybrid Approaches as Enablers of Trustworthy Personalization

Hybrid RS strategies provide flexible solutions to mitigate the weaknesses of individual recommendation techniques by combining multiple paradigms within a unified framework [42]. These approaches integrate the strengths of the methods to address common challenges such as data sparsity, cold start problems, and limited personalization. The primary aim of hybridization is to improve the overall performance of the system by capitalizing on the strengths of each method to improve accuracy, diversity, and robustness [43]. Recent advances have extended hybrid frameworks with FL to enable data collaboration that preserves privacy across multiple FL sources [18]. Furthermore, integrating XAI mechanisms into hybrid systems improves user trust and system transparency [44]. In summary, federated and explainable hybrid recommendation models represent an evolution of traditional approaches: achieving a balance between personalization, privacy, and explainability while maintaining the adaptability required for modern, large-scale RS (see Figure 8).

Figure 8. Federated hybrid approaches with explainable recommendations (* User preferences are non-IID across users).

4. Explainable Recommender Systems (XRS)

The term explanation is defined as a statement or account that elucidates something. In RS, an explanation is given through the information shown to the users to clarify the reason behind the recommendation of a specific item [8]. The explainability in RS can be divided into two main dimensions: scope and mechanism. With regard to scope, global explainability aims to provide a complete understanding of the reasoning and decision-making patterns of the model in all users and items, providing insight into the overall behavior of the system [45]. In contrast, local explainability focuses on clarifying the reasoning behind individual recommendations, for example, why a particular item was recommended to a specific user [4].

From a mechanistic standpoint, intrinsic explainability denotes models whose internal structure is naturally interpretable, such as decision trees [46] and rule-based systems [47], along with specific neural network architectures. An instance of the latter is the use of explicit attention mechanisms over semantically meaningful inputs, which can provide some structural transparency by highlighting the components that exert the greatest influence on a prediction, even though these mechanisms still do not guarantee that the resulting explanations are fully faithful [48]. On the other hand, post-hoc explainability involves using explainability techniques after model training to elucidate the behavior of complex or opaque models, such as deep neural networks. Post-hoc methods, including Local Interpretable Model-agnostic Explanations (LIME) [49], SHapley Additive exPlanations (SHAP) [50], integrated gradients [51], path-based reasoning [52], or counterfactual reasoning [53,54], seek to approximate the decision-making logic of the model, locally or globally, to make it comprehensible to humans. In Figure 9, all explainable methods are shown in highlight.

Figure 9. Explainable methods.

• Rule-Based Approaches

In decision-tree models, each leaf node signifies a final recommendation decision, presenting hierarchical structures where each internal node denotes a user or object attribute [46]. This allows users to easily track how specific features influenced the outcome, as each prediction follows a distinct and readable path from root to leaf. Rule-based systems improve this explainability by defining recommendation logic through collections of IF-THEN rules, often derived from patterns in user–item interactions [55]. These rules explicitly outline the specific conditions under which an item is recommended, thereby aiding in straightforward auditing, validation, and enhancement of the underlying logic.

• Attention-Based Approaches

The attention mechanisms of neural networks provide a more subtle, yet comprehensible kind of reasoning [56]. Attention weights measure the relative significance of input components during prediction in place of explicit rules. Attention provides important information about what the model focuses on when making recommendations, even if it does not ensure causality. Because of this, attention-based models are especially helpful in complicated designs where direct explainability is otherwise challenging, such as sequence models and graph neural networks [48,57].

• LIME-Based Explainability

LIME operates entirely on the client device without needing server-side or global data access, which is well aligned with FRS [36]. This ensures that sensitive interaction histories remain local, safeguarding user privacy, and allowing personalized explanation creation. The main limitation is its stability; in sparse or high-dimensional recommendation contexts, different perturbation samples can lead to varying explanations. However, LIME remains a valuable tool in FL environments as it aligns with the decentralization and privacy goals of the federated model, while still offering fast, clear, and model-agnostic explanations.

• SHAP-Based Explainability

In discussing the clarity of understanding SHAP provides, the focus is not on how the technique interprets the models to which it is applied but rather on how it presents the data afterward. SHAP can be expensive when dealing with high-dimensional feature spaces or deep recommendation models [58]. Additionally, privacy must be considered: while explanations remain on the client side, the attribution patterns could inadvertently reveal sensitive preference information if not properly managed.

• Integrated Gradients

Integrated gradients are a method used to clarify model predictions by evaluating how each input feature contributes as the model progresses from a baseline to the actual input. In RS, this approach helps pinpoint which user attributes, item traits, or interaction signals had the most notable effect on a specific recommendation score [59]. Due to its reliance on gradients, integrated gradients often provide more consistent and accurate explanations of the model’s internal logic compared to basic perturbation methods. In FRS, integrated gradients are beneficial when clients can access model parameters, allowing them to calculate attributions without revealing raw data, thus supporting privacy objectives. However, a challenge arises because not all federated configurations allow clients to access gradients, and some devices may face difficulties with repeated gradient calculations. Despite these challenges, integrated gradients remain one of the most reliable methods to generate precise, model-specific explanations in federated settings that use deep learning RS.

• Path-Based Reasoning

Path-based reasoning examines the structure of the interaction graph or local KG to identify the most informative multi-hop connections, meta-paths, or similarity trails, which assist users in understanding why an item matches their preferences [60]. In federated systems, this independence is a significant advantage: clients can conduct path extraction exclusively on their local device, using only their local graph structure, without sharing raw user interactions or sensitive relational data with the server. Post-hoc path-based reasoning provides intuitive, human-readable explanations, has low architectural requirements, and is highly compatible with privacy-preserving federated systems. However, the approach has limits. Paths represent the underlying graph’s structure rather than the model’s genuine reasoning, resulting in a fidelity gap.

• Counterfactual Explanations

A key idea to understand is the counterfactual, which stands in contrast to the factual. While factual reasoning details events that actually took place, counterfactual reasoning examines what could have happened under different circumstances. This approach is particularly beneficial for evaluating situations in which the real-world settings of a treatment variable do not occur. Essentially, counterfactual inference predicts what the result would be if the treatment variable had been different from what was observed [61].

Within the conceptual framework described, counterfactual reasoning stands out as a promising avenue for improving the robustness of explanations. Although FRS ensure privacy through distributed training, they are often opaque and lack methods for simulating different user profiles. Existing work on counterfactual reasoning in federated settings appears limited, and evidence of a counterfactual explanation that preserves privacy specifically for FRS remains sparse. Existing research combines FL with counterfactual reasoning in other areas of application [62]. There is also work on counterfactual explanations for RS, but these approaches are not necessarily federated or explicitly privacy-preserving [63]. More generally, there is a wider body of research on privacy issues in explanations and on privacy-preserving explanations, including discussions related to the privacy of counterfactuals, but this has not been studied specifically in the context of FRS [64]. The proposed conceptual framework addresses this gap by describing how recommendations can be designed to be accessible, actionable, and interpretable within federated settings.

5. Federated Recommender System (FRS)

FL represents an essential paradigm within the broader domain of decentralized model training, facilitating collaborative learning across multiple distributed devices or nodes without necessitating the transfer of raw data to a centralized repository [65]. This approach is particularly advantageous for contexts characterized by sparse, heterogeneous, and privacy-sensitive data, such as those generated by mobile devices or within organizational silos. Using the computational capacities of distributed participants and minimizing data exposure, FL offers a scalable and privacy-preserving framework for collaborative model development in modern intelligent systems.

FRS represents a technology designed to deliver recommendation services while safeguarding user privacy. FRS offers a privacy-focused approach to personalized recommendations, allowing participants to collaboratively train a shared recommendation model by exchanging intermediate parameters such as gradients or model weights instead of raw user data [39,66]. This FL training model ensures that user data remain local, reducing privacy risks while maintaining recommendation performance comparable to that of centralized systems. FRS employs two primary communication architectures: the client-server model, which uses a central server to aggregate model updates, but may encounter risks such as single-point failures and privacy breaches; and the peer-to-peer model, which removes the central server to enhance resilience and privacy, though with increased communication and computational demands.

Traditionally, FRS can be divided into cross-device and cross-platform architectures based on the type of participant [18]. In cross-device FRS, numerous mobile devices with limited computational power collaboratively train models to provide personalized recommendations without collecting local data, facing issues such as device dropout and training efficiency. In cross-platform FRS, a smaller number of large-scale data platforms collaborate to boost recommendation performance while adhering to privacy and regulatory requirements, emphasizing fairness systems and trust management.

Currently, various architectures are implemented globally (see Figure 10).

Figure 10. FRS architectures based on the type of participant.

1.

Cross-device FRS [67,68]—These systems develop recommendation models directly on users’ devices, with each device retaining the user’s interaction history locally and only transmitting model updates to the server.

2.

Cross-platform FRS [69]—Clients use various software stacks, operating systems, or cloud platforms, but they still become part of the same federation.

3.

Cross-silo FRS [70]—A limited group of stable organizations work together to build a shared RS without exchanging raw data. Cross-silo FL techniques typically rely on sharing model parameters to jointly train a global model using the small set of users who overlap across silos [71]. In practice, this overlap is often minimal, which restricts the ability of these methods to capture meaningful collaborative patterns. The requirement to transmit model parameters during training also leads to high communication costs and increases the risk of privacy leakage. Typical examples of cross-silo participants include banks, universities, job platforms, and enterprises seeking shared insights without revealing sensitive information.

4.

Horizontal FRS [16]—A horizontal FRS involves a configuration where each client maintains its own confidential users, items, features, and interaction data [72]. The primary condition is that the users associated with one client are not shared with any other client, ensuring that each organization has a unique set of users. Similarly, all clients are required to use the same feature types for users and items, thereby maintaining a consistent feature space across them, despite their data being stored independently. For example, several e-commerce platforms each maintain user–item interactions that share the same item features.

5.

Vertical FRS [73]—Clients have access to the same users, but each possesses distinct information regarding those users. For example, a bank knows the financial preferences, whereas a retailer understands the purchasing habits of the same consumers.

In a standard vertical FL task, there are four primary stages: entity alignment, where parties securely identify the users they have in common; training, where each party contributes its features to create a joint model without revealing raw data; inference, where the collaboratively developed model predicts outcomes using the divided features; and the final decision or purchase phase, where the advised action is executed based on collective information from all parties [74].

6.

Privacy-Enhanced FRS—Attention is given to secure training through the use of methods such as differential privacy, secure aggregation, homomorphic encryption, or split learning [75,76].

7.

Personalized FRS—FRS allow users to keep their personal data on their own devices and only share model parameters that have minimal privacy concerns for the purpose of global model training. This approach greatly enhances the system’s ability to safeguard privacy. In the context of distributed learning, the distinct non-IID (independent and identically distributed) nature of user behavior data poses new challenges for federated optimization. At the same time, the ability of FL to train multiple models simultaneously offers a chance for personalized user modeling. Therefore, advancing personalized FRS is essential and has significant importance [77].

Additionally, depending on the learning approach used, FRS can incorporate matrix factorization, deep learning, or meta-learning models, each offering distinct balances between personalization, scalability, and adaptability.

• Matrix factorization-based models
  Matrix factorization is a widely used model in FRS, capturing user–item interactions through latent features that characterize both users and items [78]. In this model, clients independently maintain and update their user feature representations, while only item-related parameters or their gradients are communicated to the central server for consolidation. This method enables the system to effectively learn user preferences while safeguarding privacy by not transmitting raw user data. However, despite its simplicity and efficiency, matrix factorization-based FRS encounters challenges such as data sparsity, where many possible interactions are absent, and the cold start issue, which occurs when new users or items lack sufficient interaction history [71].
• Deep learning-based models
  Deep learning models have been incorporated into the federated framework to enable the learning of richer and more nonlinear representations for users and items [79]. Clients conduct local deep model training and send masked or perturbed gradients and embeddings for secure aggregation. Although deep learning-based FRS architectures greatly improve accuracy and expressiveness, they also introduce significant computational and communication burdens due to the large number of parameters involved [80].
• Meta-learning-based models
  Meta-learning strategies in FRS are designed to address the issue of non-IID [81]. The server derives a shared parameter initialization from the updates provided by clients, allowing each client to locally fine-tune this model to suit its own data distribution. This process facilitates quick adaptation and enhances personalization compared to employing a universal model. However, despite their adaptability, meta learning-driven FRS techniques might still pose a risk of privacy breaches during parameter initialization and require a careful balance between personalization and communication efficiency [82].

Ultimately, FRS combines privacy preservation, distributed learning, and personalized recommendation, representing a significant step forward in the development of trustworthy and collaborative intelligent systems.

6. Trustworthiness in FRS

Trust is crucial for the adoption of technology, as its absence would likely stop technological progress. Consequently, ensuring the reliability of technology is vital to fostering trust, which in turn strengthens the positive relationship between humans and technology. The increasing dependence on intelligent decision support systems has increased the need to ensure that RS are accurate and trustworthy [4]. Trustworthiness in RS is a complex concept that includes several essential dimensions (TD) (see Figure 11):

 TD1: 

Fairness ensures that the recommendations do not consistently privilege or disadvantage specific user groups, thereby fostering equitable outcomes [83].

In centralized RS, fairness methods require disclosure of sensitive attributes. However, in federated scenarios, users are not required to share such sensitive features. As a result, some studies address the challenge of demographic bias in FRS without forcing active users to disclose their sensitive attributes [84]. Consequently, relying solely on fair global models may continue to propagate bias due to personalized local training through matrix factorization MF, potentially leading to an overall biased model.

 TD2: 

Transparency involves making the decision-making process of the system clear and understandable to users and stakeholders [85]. Understanding the functioning of a RS and the process behind selecting a recommendation can be beneficial. The primary goal of XAI is to provide transparency, which is in opposition to the black-box notion.

The influence of FL on the explainability and explanation of models is still not well-understood, highlighting a need for research that measures this impact [14]. In-depth experimental and analytical research is necessary to athe impact of FL training on the structure of machine learning models, as well as its implications for explainability. Additionally, even though local explanations are frequently employed in FL contexts, there are currently no dedicated federated implementations for these techniques. The merging of local explanations to achieve global understanding often reduces client-specific patterns, and sharing local explanations might result in privacy concerns.

 TD3: 

Robustness refers to the ability of the system to maintain stable and reliable performance even when faced with data noise, manipulation, or adversarial conditions. As RS models rapidly advance, it is crucial to create libraries that enable researchers to easily replicate and evaluate various models and examine their resilience in the areas mentioned above [86].

The decentralized structure of FRS leads to two major challenges [87]. The first is that the limited amount of data available on each device reduces the effectiveness of FRS. Secondly, the system’s ability to resist challenges is compromised because it is vulnerable to model poisoning attacks by malicious users. Significant progress has been made, prompting many researchers to focus on verifying the security of FRS through the study of poisoning attacks. These attacks are typically categorized into targeted [88] and untargeted types [89], depending on their adversarial goals.

 TD4: 

Privacy protects user data by minimizing the exposure of sensitive or personal information through methods such as anonymization, encryption, or FL [90]. In RS, privacy involves protecting users’ personal data from unauthorized access, usage, or disclosure.

FL offers several benefits compared to traditional privacy protection methods: (i) eliminates the need for sharing individual data for collaborative learning; (ii) facilitates training on large datasets, enhancing the performance of recommendations and the efficiency of the system; and (iii) supports model training on devices with limited resources, increasing accessibility for users. The capability of FL models to keep user data on local devices makes them particularly suited for RS applications. This decentralization of data minimizes the risk of data breaches and unauthorized access.

Figure 11. Trustworthiness dimensions.

Figure 11. Trustworthiness dimensions.

Together, these dimensions form the ethical and technical base for creating a trustworthy RS, designed to gain user confidence while meeting broader social and regulatory standards.

7. Architectural Perspective

Our analysis offers insights into determining whether a system prioritizes explainability, distributed learning, knowledge integration, or efficiency. We illustrate the impact of various design choices on the behavior of the model and user interaction. Evaluating architectures through these perspectives helps situate current methodologies and guide the development of systems that are more closely aligned with specific application needs and research goals. In this context, the analysis is structured around three primary perspectives: centralized XRS, which integrates data and explanatory mechanisms within a single framework; FRS, which focus on data-decentralized training and privacy while lacking specific explainability features; and XFRS, which seek to combine transparency with decentralization by using hybrid explainability modules.

7.1. Centralized XRS

A centralized XRS is based on a unified data repository that consolidates all user profiles, interactions, and item metadata, thus removing any constraints related to locality [22,60]. This configuration (see Figure 12) allows for a unified end-to-end training process within a single computing cluster, providing the model with complete access to all necessary features for enhanced explainability. Explanations can be delivered quickly because of centralized computation, and the system ensures thorough auditability through centralized logging of explanation events and artifacts.

Figure 12. Centralized XRS architecture.

The system operates as outlined below: (1) Users (User 1…User N) interact with the platform, creating interaction data (such as clicks, ratings, and profile information), which are sent to (2) a centralized data storage layer. This storage component collects and manages all user–item interaction logs together with contextual features. The accumulated data are subsequently used by (3) the central recommender model, which is responsible for both training and inference, producing personalized $Top$-N recommendation lists. These recommendation results are then passed to (4) a server-side explainability module, which generates human-interpretable explanations for each recommended item. Finally, (5) the system presents to each user both the $Top$-N recommendations and their corresponding explanations, thus closing the loop from data collection to transparent recommendation delivery.

A centralized XRS includes the following core components (see Figure 13):

• Central data repository—All user profiles, interactions, and item metadata are held in a central location, with no restrictions on data location.
• Unified model training pipeline—The entire training process, from beginning to end, is executed within one cluster. Comprehensive access to all features facilitates detailed explainability.
• Explainability layer—Various XAI techniques for computations with complete feature transparency.
• Explanation serving—Rapid delivery is possible since explanations can be generated directly on central resources. All explanation artifacts can be centrally logged and audited for accountability.

Figure 13. Centralized XRS core components.

Figure 13. Centralized XRS core components.

To clarify the architectural organization, we explicitly describe the data flow and interaction mechanisms among the components, detailing how the information is propagated, aggregated, and transformed throughout the system.

In an XRS, all components operate within a single computational and data boundary. This makes data flow linear and easy to control. The central data repository stores all user profiles, interaction logs, and metadata in a single unified database. Within the interaction mechanism, synchronization between nodes is unnecessary, as model optimization is conducted using globally accessible data, and the training pipeline retains unrestricted access to the complete database. After or during the training process, the model parameters learned are forwarded to the explainability layer. The interaction mechanism enables the explainability layer to access all features or complete information without any communication constraints. Explanations are computed on centralized resources and then sent directly to users through the serving infrastructure. The explanation module produces explanations according to the defined scope.

7.2. Federated RS

FRS are a class of models where the recommendation learning process is carried out collaboratively across many distributed clients, while user data remains stored on their local devices [69,70,71]. The main goal is to improve privacy while maintaining the predictive capabilities of centralized RS. Although these methods offer privacy benefits, they generally provide limited understanding of how recommendations are generated, as the focus of model training and inference is solely on accuracy rather than transparency. Consequently, FRS serve as the foundation for privacy-preserving RS research, but leave a significant gap in user trust and explainability (see Figure 14).

Figure 14. FRS architecture.

The federated recommendation workflow proceeds in several stages: (1) the server first initializes a global model and distributes it to all participating clients. Next, each client (2) independently optimizes this model using its own on-device data, adjusting the model parameters without revealing any raw user records. Once local training is complete, (3) the clients send their updated parameters back to the server in an encrypted or otherwise privacy-preserving manner. The server then (4) aggregates these local updates to produce a refined global model. This procedure (5) is iterated over multiple communication rounds until a convergence condition is met. In the final stage, (6) the trained global model is used to generate personalized $Top$-N recommendations, which are delivered to users while preserving the locality of the data and ensuring privacy requirements.

A FRS includes the following core components (see Figure 15):

• Federated client–server—Data remains on user devices or within enterprise nodes, with only gradients or model updates being transmitted to the server.
• Federated optimization loop—There is no explainability available during training or inference. There is minimal information exchange, and no feature-level or attribution data is communicated.
• Privacy and security layer—Confidential aggregation and protected channels.

Figure 15. FRS core components.

Figure 15. FRS core components.

To clarify the architectural structure in more detail, we present a precise description of the data flow and the interactions among components, indicating how information is passed, integrated, and transformed throughout the system.

An FRS replaces centralized data processing with a distributed client-server learning paradigm. The federated client-server architecture specifies where data are stored and how computational tasks are distributed. An important aspect is that the interaction data reside on users’ personal devices or within institutional infrastructure. In these configurations, raw interaction data is not transmitted to the central server. In the federated client-server setup, the server initializes a global model and distributes it to all clients. Each participating client then trains this model locally on its own private dataset. After completing local training, the clients send their updated models back to the server.

The purpose of the federated optimization loop is to orchestrate the collaborative learning process among distributed clients. Training follows a conventional pipeline: broadcasting the model, performing local training, sending back updates, and aggregating them. In a standard FRS, there is no built-in explainability component.

The privacy and security layer is responsible for maintaining data confidentiality and protecting communications. Its main function is to secure the aggregation process so that raw data cannot be reconstructed, since the server is unable to examine individual updates.

7.3. Explainable Federated RS (XFRS)

We introduce a unified conceptual framework for XFRS that employs a structurally hybrid architecture, in which explainability operates under privacy constraints. Within this setup: (i) explanation signals are generated hierarchically, (ii) training can incorporate explainability-oriented objectives, and (iii) the resulting rationales integrate user-level personalization with system justification. As described in [91], XFRS can be interpreted as combining the explainability features of XRS with the privacy-preserving and distributed architecture of FRS. The architectural explanation should emphasize the integration of these two perspectives. Figure 16 presents the proposed conceptual framework for XFRS, which integrates federated optimization, privacy-preserving techniques, and multi-level explainability into a single decentralized architecture.

Figure 16. XFRS architecture.

The extended XFRS workflow unfolds as follows: (1) the server initializes the process and distributes a global recommendation model to all participating clients. The client then (2) optimizes this model locally using its own interaction data, ensuring that the raw data never leave the device. Once local training is complete, (3) the clients securely send their updated model parameters back to the server. The server (4) aggregates these updates on the client-side to form a refined global model. This FL loop (5) is repeated over multiple communication rounds until the model converges. After training has stabilized, (6) local explainability components generate user-specific explanations based on the locally fine-tuned model and the current interaction context. Subsequently, the system (7) provides each user with personalized recommendations $Top$-N along with their associated explanations. In parallel, (8) a global explainability module on the server side produces system-wide explainability insights, thereby promoting transparency and facilitating auditing across the entire decentralized recommendation ecosystem.

Building on the extended XFRS workflow, the proposed framework can be formalized as a layered model in which each layer corresponds to a distinct phase of the FRS and explainability process. This formalization clarifies the roles of the system components, their interactions, and their associated trust-related objectives. Table 3 formalizes the proposed XFRS framework as a layered architecture derived from the extended workflow, clarifying the roles and responsibilities of each component.

Table 3. Layered formalization of the XFRS framework.

Layer	Workflow Steps	Description and Role
Model initialization and coordination	Steps 1, 4–5	The server initializes the global recommendation model, coordinates communication rounds, and aggregates client updates to produce refined global models.This layer manages convergence, scalability, and the overall resilience of the system.
Local training and personalization	Steps 2–3	Clients refine the global model on-device using their own private interaction data and send only the resulting model updates back to the server. This layer supports personalization while maintaining data locality and protecting user privacy.
Local explainability	Step 6	Local explainability components generate user-specific explanations based on locally fine-tuned models and contextual information. This layer is responsible for explanation quality properties such as faithfulness, fidelity, and stability.
Recommendation delivery	Step 7	The system delivers personalized $Top$-N recommendations together with their associated explanations to end users, directly affecting user trust, transparency, and perceived usefulness.
Global explainability	Step 8	A server-side explainability module produces system-level explainability insights to support transparency, monitoring, and auditing across the federated recommendation ecosystem.

Core components of an XFRS (see Figure 17):

• Dual-layer explainability architecture—Explainability is required at two distinct levels. On the client side, explainability involves using only local features. On the server side, it involves the use of aggregated signals that comply with privacy standards. It is important to detail which explanations are generated locally, which are processed centrally, and how these are combined to form a coherent rationale.
• Privacy explanation flow—Explainability needs to comply with the privacy constraints of federated systems. Documents should address which explanation signals can be shared and which signals should be kept private.
• Hybrid model components—XRS deploy techniques that produce signals that are understandable to humans, for example, observable model behaviors or decision justifications that can be summarized to end users—typically grounded in structural reasoning, relational dependencies, or attention-based analyzes. By contrast, FRS focus on FL, where model training is distributed across clients and only aggregated model updates are exchanged, thereby preventing direct access to local data. For example, in paper [15] the authors investigate deep learning-based FRS, comparing different model architectures and federated aggregation strategies under privacy-preserving constraints. XFRS aim to combine these approaches by generating interpretable signals within federated constraints, for example, via explanation procedures executed locally on user devices or via system-wide summaries inferred from aggregated model behaviors, while still preserving communication-efficient training.
• Federated explainability pipeline—The local explainability module produces explanations that are privacy-safe. The server can perform justifications, then it combines global and local explanations. The final explanation is sent to the client.
• Explainable federated training loop—Discuss the impact of explainability on training. The aggregation process might involve maintaining consistency in explainability. The server generates global importance maps that provide guidance for local models.
• Explanation Serving Architecture—Show how explanations are delivered.

Figure 17. XFRS core components.

Figure 17. XFRS core components.

To clarify the architectural organization in more detail, we give a precise description of the data flow and the interactions among components, indicating how information is passed, integrated, and transformed throughout the system.

An XFRS extends the standard federated recommender architecture by introducing module-aware of explainability that operate under strict privacy constraints. In XFRS, the explainability functions on two separate, yet synchronized layers: a client-side explainability at the local level and a server-side explainability at the global level. The local layer relies solely on locally available interaction data, and its explanations are generated after performing local inference. In contrast, the global layer works with aggregated model parameters and provides high-level structural explanations. The ultimate explanation presented to the user can integrate locally personalized justifications with broader, global insights about the overall structure.

The flow of explanations for privacy is central to achieving explainability while complying with federated privacy constraints. The system’s design should define a restricted channel for communicating explanations and explicitly define which explanatory details remain local, which aggregated or summary information can be shared, and how the chosen aggregation techniques mitigate the risk of reconstructing sensitive data.

XFRS combines key aspects of both paradigms: from XRS, it incorporates interpretable modeling techniques, and from FRS, it adopts local training, secure aggregation, and privacy guarantees. These modules produce interpretable signals while preserving locality across federated importance-alignment layers, incorporating privacy-aware explanations, and enforcing consistency constraints between local and global explanations.

The explanation pipeline proceeds in an ordered sequence: local inference → generation of a local explanation → optional production of explanation-safe summary signals → server-side aggregation / global justification → combination of local and global rationales → delivery of the explanation to the client. The essential point is that explanation generation is fundamentally local, whereas global reasoning serves as a complementary and privacy-preserving component. Explainability can affect how training unfolds. The server might calculate global importance indicators and distribute them to steer the local models. In this way, explainability is integrated directly into the optimization loop.

The final delivery of the explanations takes place on the client side. The overall process is as follows: the model’s prediction is computed locally, followed by the generation of local explanations. When desired, these can be augmented with globally derived justifications. The resulting explanations are then presented to the user, and the corresponding explanation logs are stored locally or in a privacy-compliant manner.

To synthesize the findings of the taxonomy analysis, Figure 18 illustrates the conceptual evolution toward XFRS.

Figure 18. Conceptual evolution toward XFRS.

8. Framework Application and Evaluation

8.1. Implications of the Proposed Conceptual Framework

The proposed conceptual framework provides several implications for the development of FRS.

• System design implications
  The proposed conceptual framework has important implications for the design of FRS. By organizing the system into distinct components such as local client models, global aggregation mechanisms, and communication protocols, the framework supports a modular and scalable system architecture. In this design, user information is kept on individual devices, while recommendation models are jointly trained by sharing model updates instead of transmitting raw data. This strategy minimizes the reliance on centralized data storage and strengthens privacy protection. In addition, the framework emphasizes important design aspects, including communication efficiency, variability among clients, and model synchronization, all of which are crucial to preserve performance and scalability in large federated settings. Consequently, the framework offers a systematic basis for building a distributed RS that is sensitive to privacy.
• Practical deployment implications
  From a practical deployment perspective, the conceptual framework facilitates the implementation of privacy-aware recommendation services in real-world environments. Since user interaction data remain on local devices and only model updates are shared during the training process, the framework aligns well with privacy regulations and data protection requirements. This characteristic makes FRS particularly suitable for applications such as mobile services, e-commerce platforms, and social media systems where sensitive user data is involved. Furthermore, the framework supports distributed learning between multiple clients or organizations, enabling collaborative model training while preserving data ownership and confidentiality.
• Research implications
  The framework also provides several implications for future research in FRS. By highlighting the interactions between decentralized data sources, model training processes, and aggregation mechanisms, the framework identifies several open challenges that require further investigation. These include the development of robust evaluation methodologies for decentralized environments, the mitigation of security threats, and the design of communication-efficient training strategies. In addition, the framework encourages research on handling data heterogeneity and improving personalization in FRS scenarios.

8.2. Illustrative XFRS Scenario

To make the proposed conceptual framework more concrete, we outline an illustrative XFRS scenario in a job-matching platform that provides personalized job recommendations to candidates while preserving the privacy of sensitive user data (e.g., work history, applications, and interaction logs). In this setting, candidate devices or employer-side systems act as clients that retain private interaction data locally, whereas the platform coordinates federated training and provides both user-facing and system-level explainability.

The XFRS workflow unfolds as follows: (1) the server initializes the process and distributes a global job recommendation model (e.g., a ranking model for candidate–job matching) to all participating clients. The client then (2) optimizes this model locally using its own interaction data, such as viewed job postings, saved roles, applications, and contextual preferences, ensuring that raw behavioral data never leave the device. Once local training is complete, (3) the clients securely send their updated model parameters back to the server. The server (4) aggregates these updates to form a refined global model. This FL loop (5) is repeated over multiple communication rounds until the model converges.

After training has stabilized, (6) local explainability components generate user-specific explanations based on the locally fine-tuned model and the current interaction context. In practice, explanations may be presented as user-understandable rationales, computed locally so that sensitive profile attributes are not exposed. Subsequently, (7) the system provides each user with personalized recommendations $Top$-N along with their associated explanations. In parallel, (8) a global explainability module on the server side produces system-wide explainability insights derived from aggregated model behavior, thus promoting transparency.

8.3. Evaluation Dimensions

Table 4 provides an overview of the evaluation dimensions, aspects, representative metrics, and example approaches used for XFRS.

Table 4. Representative measures and methods for XFRS.

Evaluation Dimension	Aspect	Measures/Approaches	Methods
Utility	Recommendation accuracy	Precision, Recall, NDCG, MAP	Matrix factorization, neural recommenders
	Ranking quality	Hit Rate, AUC	Learning-to-rank models
Explanation Quality	Fidelity	Agreement between explanations and model behavior	LIME, SHAP, gradient-based attribution
	Stability/ Consistency	Sensitivity to input perturbations, consistency across runs	Feature-attribution stability analysis
	User understanding	User studies, task completion, perceived usefulness	Counterfactual explanations, example-based explanations
Privacy Risk	Information leakage	Membership inference, attribute inference attacks	Attack simulation frameworks
	Communication exposure	Gradient leakage analysis, update sparsity	Secure aggregation, update compression
	Robustness	Differential privacy guarantees, attack success rate	Differential privacy mechanisms, noise injection

8.4. Operationalizing Tradeoffs

A key feature of XFRS is that it naturally involves tradeoffs among objectives that are in competition with one another.

• Tradeoff between Privacy and Explainability
  Providing more detailed explanations can enhance transparency, but it may simultaneously introduce additional privacy risks by exposing sensitive feature attributions or specific facets of model behavior. Consequently, evaluation should consider how explanation techniques modify the privacy attack surface relative to conventional FL.
• Tradeoff Between Explainability and Communication Cost
  Incorporating explanation mechanisms into federated training workflows can raise both communication overhead and overall system complexity. Evaluations should determine whether explanations are produced on individual devices, on a central server, or through a collaborative process, and analyze how these design choices influence communication costs and scalability.
• Tradeoff between Personalization and Fairness
  Although stronger personalization can increase the benefits for individual users, it may also worsen inequalities between different user groups. As a result, evaluations should account for fairness effects in addition to improvements in personalization and explainability.

Table 5 summarizes the dimensions of the proposed evaluation and the associated tradeoffs, providing a compact checklist that can support a more systematic assessment of XFRS approaches.

Table 5. Key evaluation dimensions, associated tradeoffs, and evaluation focus for XFRS.

Dimension	Tradeoff	Evaluation Focus
Explanation Quality	Explainability vs. privacy	Faithfulness, fidelity, and stability versus potential leakage risk
Communication	Explainability vs. efficiency	Communication overhead, scalability, and synchronization cost
Personalization	Personalization vs. fairness	Group-level disparity and consistency of recommendations and explanations

8.5. Key Technical and System Challenges

Table 6 provides an overview of the key technical challenges involved in implementing the proposed XFRS framework, emphasizing those that emerge at the intersection of FL, explainability, and trustworthiness.

Table 6. Technical challenges in implementing XFRS.

Challenge	Description
Privacy leakage from explanations	Explainability techniques can create new pathways for information leakage, which may reveal sensitive user characteristics or details about model behavior, even when FL is in place.
Explainability–communication tradeoff	Generating and aggregating supporting explanations can add communication overhead, which may run counter to the objective of maintaining communication-efficient federated training.
Local–global explanation consistency	Achieving consistency between user-level local explanations and system-wide global explainability insights is challenging when data and model updates are heterogeneous.
Client and data heterogeneity	Variations in client capabilities, data distributions, and interaction behaviors influence not only federated optimization but also the practicality of implementing local explainability modules.
Evaluation under federated constraints	Conventional explainability metrics are usually formulated for centralized environments, making them hard to calculate or verify when access to the model is distributed or decentralized.
Integration of trust dimensions	Adding fairness and robustness on top of explainability makes the architecture more complex and brings in further tradeoffs.
Expanded attack surface	Explainability components and aggregated explainability summaries may increase vulnerability to inference or reconstruction attacks.

RS deployed in FL environments inherit challenges from both traditional recommendation models and distributed learning systems. These challenges include issues related to data heterogeneity, communication efficiency, privacy preservation, security, and system evaluation. Table 7 summarizes the main challenges and their implications.

Table 7. Key Challenges of FRS within the XFRS.

Challenge	Description	Implications for RS
Data Heterogeneity	User data varies widely across clients and is often non-IID, representing distinct preferences, patterns of interaction, and degrees of activity.	May affect model convergence and reduce recommendation accuracy if global models fail to capture local user preferences.
Communication Overhead	FL requires repeated exchange of model updates between clients and the aggregation server.	High communication cost may limit scalability in large systems with many users or devices.
Privacy Risks	Although raw data remains local, sensitive information may still leak through gradients or shared model parameters.	Requires privacy-preserving mechanisms such as differential privacy or secure aggregation.
Security Threats	Malicious clients may attempt to manipulate training through poisoning or adversarial updates.	Robust aggregation and anomaly detection mechanisms are needed to ensure trustworthy recommendations.
Evaluation Complexity	Decentralized and private data make it difficult to perform standardized evaluation and benchmarking.	New evaluation protocols are required to assess model performance in federated environments.

9. Conclusions

Although there are few studies explicitly merging explainability with FL in RS, certain trends can be identified. Initial research highlights transparency for users and explanatory interfaces, whereas more recent studies incorporate privacy-preserving features. A limited number of models address both these aspects at once, often giving precedence to privacy and decentralization over explainability. This suggests that explainability is still seen more as a secondary aim rather than a primary element in contemporary FRS. In general, these trends indicate that the integration of explainability into FRS is still in its infancy and requires coordinated research efforts to ensure personalization that is trustworthy, transparent, and protects privacy.

The gaps found in the existing literature suggest numerous promising paths for future research in XFRS. Current methods only partially address the combined requirements of privacy, transparency, and the quality of personalized recommendations, leaving many design questions unanswered. As the domain progresses, researchers must explore more integrated frameworks that improve explainability and FL, establish standardized evaluation protocols, and develop models that operate efficiently in real-world conditions such as data heterogeneity and communication difficulties. These aspects form the basis for the future research directions described in the following.

• This study introduces a new research avenue by integrating path-based reasoning, explainable recommendation techniques, and FL. Given that current path-based RS are largely confined to centralized architectures, a key direction for future work is to adapt them to privacy-preserving federated settings.
• The combination of counterfactual reasoning and RS within FL has received limited attention so far, especially regarding the development of explanations that are simultaneously actionable and privacy-preserving.
• FRS offer only limited capabilities for counterfactual reasoning and what-if analysis, because user representations and interaction data stay local and thus cannot be arbitrarily modified. Future research needs to develop privacy-protective systems which should create controlled changes in user data to deliver better explanations and enhance personalization options.
• The development of integrated systems that combine path-based reasoning with counterfactual explanations and other explainability methods for federated learning systems while keeping privacy intact stands out as a key research path for the future.