Blockchain-Enabled Federated Learning: A Survey on System Design, Key Challenges, and Future Directions

Abstract

The rapid advancement of artificial intelligence relies on massive high-quality data, yet increasingly stringent data privacy regulations have exacerbated the problem of data silos. Federated learning enables collaborative training under privacy protection by exchanging model parameters rather than transmitting raw data. Nevertheless, its traditional centralized architecture still suffers from limitations such as single points of failure, lack of trust, and insufficient incentives. The integration of blockchain and federated learning opens new pathways for decentralized, auditable, and secure machine learning systems. This paper systematically reviews research progress in blockchain-enabled federated learning, analyzing technological evolution from three perspectives: system architecture, incentive mechanisms, and privacy enhancement. It further explores critical challenges including efficiency bottlenecks, storage overhead, and the inherent tension between transparency and privacy, while identifying key research directions for building scalable, efficient, and trustworthy decentralized learning systems.

1. Introduction

The rapid development of artificial intelligence, especially technologies like deep learning, relies heavily on large amounts of high-quality data to improve effectiveness and performance [1,2]. However, stricter data privacy protection laws have been introduced around the world, such as the General Data Protection Regulation in the European Union, the California Consumer Privacy Act in the United States, and China’s Personal Information Protection Law. These laws place various restrictions on the collection, storage, and cross-border transfer of personal data, aiming to better protect everyone’s privacy and data rights [3]. While such regulations are essential, they have also introduced a practical challenge. Due to increasing compliance requirements and legal risks, many organizations and enterprises have become reluctant to share data, leading to the fragmentation of data into isolated silos. As a result, conventional artificial intelligence approaches that rely on centralized data aggregation and processing are becoming increasingly difficult to deploy in a legally compliant manner.

Fortunately, Google proposed an innovative machine learning paradigm called Federated Learning (FL) [4,5]. Its core idea can be summarized as moving models instead of data. This approach eliminates the need to centralize raw distributed data on a central server [6]. Instead, the initial model is distributed to participants, who train it locally using their own data and upload only the updated model parameters. The server then aggregates these updates to optimize the global model and proceeds to the next iteration. Therefore, the advantages of federated learning lie in: (1) Privacy protection: raw data remains local, fundamentally preventing data leakage; (2) Breaking data silos: enabling cross organization and cross device collaboration to jointly improve model performance; (3) Efficiency: distributed training reduces the burden on the central server and lowers communication overhead. These features make federated learning a key technology for advancing AI while safeguarding data privacy [7].

Although federated learning provides a new pathway for protecting data privacy, its centralized architecture and inherent mechanisms still present significant limitations [8]. First, it relies on a single centralized server, which not only creates a single point of failure but also exposes the system to malicious server attacks and performance bottlenecks. Second, the absence of an intrinsic trust mechanism makes it difficult for participants to establish reliable relationships, resulting in a lack of effective incentives and fairness guarantees. This may lead to uneven client contributions and free-rider behavior, ultimately affecting the quality and sustainability of the model. Finally, although federated learning is designed to protect data privacy, model parameters remain vulnerable during transmission, as attackers may exploit reverse engineering to infer sensitive information. Together, these challenges highlight the shortcomings of federated learning in terms of security, fairness, and robustness.

To overcome these challenges, researchers have begun exploring the integration of blockchain technology with federated learning [9]. As a decentralized, tamper-resistant, traceable, and trustworthy distributed ledger, blockchain’s core strength lies in its ability to establish a collaborative environment without the need for trusted intermediaries. By leveraging cryptographic techniques and consensus mechanisms, blockchain ensures the transparency and immutability of transactions, effectively addressing issues of trust and security [10]. When deeply integrated with federated learning, blockchain can significantly enhance its security, transparency, and efficiency. For example, blockchain can replace the centralized server to achieve fully decentralized federated learning, thereby eliminating the risk of a single point of failure. Moreover, the immutability of blockchain guarantees the authenticity of model updates and contribution records. By building blockchain-based reputation and incentive mechanisms, we can fairly quantify and reward participant contributions. This will encourage more high-quality clients to participate. In addition, blockchain can provide an extra layer of privacy protection for model updates, and when combined with techniques such as homomorphic encryption, it further reduces the risk of privacy leakage. Therefore, blockchain-based federated learning (BC-FL) holds promise as an effective and forward-looking solution to address the current shortcomings of federated learning [11].

However, the integration of these two technologies is not without significant hurdles, as the converged architecture introduces inherent trade-offs and complexities. First, performance overhead and scalability remain the primary bottlenecks. The decentralized nature of blockchain relies on consensus mechanisms that often entail substantial computational and communication costs [12]. Especially when employing resource-intensive mechanisms like Proof of Work, the system struggles to support large-scale federated learning tasks involving massive numbers of clients, creating a conflict between maintaining security and reducing resource consumption [13]. Second, the paradox between privacy protection and blockchain transparency remains unresolved [14]. While the public ledger ensures immutability, its transparency may inadvertently expose sensitive model updates to inference attacks. Although cryptographic techniques such as homomorphic encryption and differential privacy can mitigate these risks, they further exacerbate the computational burden [15,16]. Finally, designing robust incentive mechanisms is critical yet challenging. Ensuring fair reward distribution while preventing free-riding or poisoning attacks requires sophisticated evaluation models that are difficult to implement efficiently without compromising system robustness [17].

Currently, research on blockchain-enabled federated learning has made significant progress in decentralized architecture, consensus mechanisms, incentive mechanisms, and privacy-enhancing technologies. However, as shown in Table 1, existing related studies [10,11,18,19] still exhibit clear limitations in their analytical perspectives. Firstly, they tend to focus on listing technical components or isolated modules, failing to reveal from a systems engineering perspective how the introduction of blockchain systematically reshapes the trust model, workflow, and performance bottlenecks of federated learning. Secondly, these studies often address challenges such as Security, Efficiency, and Scalability in isolation, lacking an in-depth analysis of the inherent contradictions and fundamental trade-offs among them. More importantly, existing surveys pay insufficient attention to the emerging and complex challenges faced by BC-FL as it transitions from laboratory prototypes to large-scale real-world deployments. These include issues such as cross-chain/off-chain data consistency in hybrid architectures, the feasibility of resource-constrained edge devices participating in consensus, and advanced defense mechanisms targeting the semantics of model updates rather than merely transaction formats. In particular, Ning et al. [20] provided a comprehensive overview of blockchain-based federated learning (BFL), focusing on architecture classification, incentive mechanisms, and general application scenarios. However, their investigation mainly regarded blockchain as a high-level enabler for FL, without deeply addressing the specific underlying security storage constraints and data sharing bottlenecks in resource-constrained environments. These shortcomings make it difficult for existing surveys to guide the design and optimization of BC-FL systems for complex, dynamic real-world scenarios.

Table 1. A Brief Summary of Related Surveys.

Comparison Dimension	Ours	Qu et al. [10]	Qammar et al. [11]	Issa et al. [18]	Al Asqah et al. [19]	Ning et al. [20]
System Architecture	✓	✓	✗	✓	✓	✓
Mechanism Design	✓	✗	✓	✗	✗	✓
Security Enhancement	✓	✗	✓	✓	✗	✓
Efficiency	✓	✗	✗	✗	✗	✓
Security & Privacy	✓	✗	✓	✓	✓	✗
Tables & Case Studies	Flowchart+Classification Table	A Few Charts	Technical Classification Table	Case Examples	Privacy Scheme Table	Flowchart+Comparison Application Form
Domain Coverage	General+IoT +IoV+Medicine	General	General	IoT security	IoT privacy	General+IoT +IoV+Medicine

To fill this gap, this paper not only provides a comprehensive classification summary of the technologies, but also aims to establish an analytical framework specifically tailored for practical implementation. Specifically, we systematically review the state-of-the-art architectures, analyze the trade-offs between security and efficiency, and highlight open challenges that require further investigation in future research. We list the technical components in isolation, but instead adopt a comprehensive perspective covering the entire chain from system architecture, mechanism design to security enhancement, to elaborate on the typical system form and evolution logic of BC-FL. Furthermore, the paper also explores the emerging complex challenges that BC-FL faces when transitioning from a laboratory prototype to a large-scale real-world environment. These challenges include cross-chain/off-chain data consistency in a hybrid architecture, the feasibility of resource-constrained edge devices participating in consensus, and advanced defense mechanisms that focus on the semantic updates of the model rather than just the transaction format. These topics have not been adequately addressed in existing reviews.

The contributions of this work are as follows:

• We comprehensively survey the fundamental components of BC-FL, detailing the typical system architecture which includes decentralized communication and incentive mechanisms, along with the reputation evaluation mechanism and various security enhancement mechanisms.
• We systematically categorize and analyze the major challenges in this interdisciplinary field, focusing on critical issues related to efficiency and expandability such as consensus overhead and scalability bottlenecks, storage issues like massive on-chain overhead and hybrid architectures, and security concerning identity anonymity.
• We provide a foundational framework for understanding the current landscape and future directions of BC-FL, highlighting how the integration of blockchain technology addresses security and trust issues and identifying key research gaps that pave the way for future exploration.

2. Background

2.1. Federated Learning

As a distributed machine learning paradigm, FL enables different data holders to collaboratively train a global model without sharing their raw data [21]. The standard training procedure for FL is depicted in Figure 1. The initiation of the federated learning task is carried out by the task initiator who selects a FL server and issues the training task to commence. Subsequently, relevant clients join the federated learning training, and the server initializes the global model. During each round of communication, the server selects a portion of clients to participate in the current round of training and distributes the current global model to them. After receiving the model, each client uses its local dataset to train the model, obtains the updated local model, and returns it to the server. The server aggregates these local models according to the established strategy to generate a new generation of the global model [22,23]. This process continues until the model converges.

Figure 1. Standard federated learning training methodology.

Federated learning can be categorized into three types based on the distribution of data across participants. Horizontal Federated Learning (HFL) [24,25] is suitable for scenarios where participants share a substantial overlap in feature space but have minimal overlap in user samples. An example of this would be banks in different regions possessing similar business data but serving different customer bases. In this case, participants have identical model structures and engage in joint training. Vertical Federated Learning (VFL) [26,27], on the other hand, is applicable when participants have significant overlap in user samples but limited overlap in feature space. An example of this would be a bank and an e-commerce platform in the same city, sharing a common customer base but holding distinct financial and consumer data. In such situations, participants must combine their respective features to train the model. Federated Transfer Learning (FTL) [28,29,30] offers greater flexibility by addressing the limitations of the first two approaches, which require high data overlap. By incorporating transfer learning techniques, FTL enables model training even in cases where both user and feature overlaps are minimal.

To further enhance the privacy and security of federated learning, researchers have introduced various cryptographic techniques. Secure Multi-Party Computation (MPC) [31,32] allows multiple parties to collaboratively compute a common function without revealing their private data. In the context of federated learning, MPC can be used for secure aggregation of model parameters, ensuring that the central server cannot deduce any private client information from the uploaded parameters. Additionally, HE [16,33,34] offers robust privacy protection by enabling computations to be performed on encrypted data. The computed result is then transformed back into an encrypted form of the original data, and decryption yields the same result as if the computation had been performed on the plaintext data. This allows the server to perform aggregation on encrypted parameters without ever seeing the plaintext model parameters, significantly enhancing the privacy protection in federated learning. These methods are independent of each other and can enhance the privacy of federated learning systems [28,34]. However, they still have certain limitations, and related research is actively exploring new approaches that balance privacy requirements with practical utility. In practical deployment, federated learning relies on regulatory constraints or incentive mechanisms to promote multi-party participation. Collaborations within organizations or between enterprises often depend on rule-based drivers, while open collaborations typically use incentive mechanisms to attract data contributions. For example, Google Keyboard motivates users to share data by improving input prediction accuracy [35]. Nevertheless, designing reasonable and effective incentive protocols remains challenging [36,37].

Overall, federated learning still faces multiple challenges in privacy security, model performance, and incentive mechanisms. Existing encryption methods are insufficient to support large-scale deep learning applications, and breakthroughs are still needed in incentivizing data sharing, improving training efficiency, and strengthening privacy protection [38]. In recent years, blockchain technology has been introduced into the federated learning framework due to its inherent advantages, and some studies have attempted to use blockchain to address the above challenges.

2.2. Blockchain

Blockchain technology, as a decentralized and distributed ledger technology, ensures data immutability and traceability through cryptographic methods. These properties provide a technological foundation for building collaborative environments without the need for trusted third parties. It is not only the underlying technology for digital currencies, but also a powerful trust infrastructure. Through its unique consensus mechanisms, smart contracts, and scalability solutions, it offers a decentralized, secure, transparent, and efficient collaborative framework for federated learning, which forms the core of the BC-FL system.

The consensus mechanism is at the core of blockchain’s decentralization, security, and immutability, ensuring that all clients in a distributed network reach an agreement on the validity and order of transactions. The mainstream consensus mechanisms include Proof of Work (PoW) [39,40], Proof of Stake (PoS), Practical Byzantine Fault Tolerance (PBFT), and Delegated Proof of Stake (DPoS) [41]. While PoW offers high security, it comes with huge computational overhead and energy consumption, making it less suitable for the efficient training required in BC-FL. PoS, with lower energy consumption and faster processing speeds, is better suited for BC-FL scenarios that prioritize efficiency. PBFT reaches consensus quickly through multiple rounds of voting, offering high throughput and low latency, making it ideal for BC-FL systems that need rapid validation of model updates. DPoS selects a limited number of “delegates” through community voting to handle block production and validation, significantly improving transaction processing speed and scalability [42]. In BC-FL, choosing the appropriate consensus mechanism is critical. PoW is typically not used due to its performance bottlenecks, while PBFT and DPoS, with their high throughput and low latency, are more commonly employed in building efficient and secure decentralized federated learning platforms.

Smart contracts are programmable codes deployed on the blockchain that automatically execute contract terms once predefined conditions are met. In BC-FL, smart contracts play a critical role as the brain and execution engine, responsible for managing the entire lifecycle of federated learning. They define participants, data formats, model structures, aggregation rules, and reward mechanisms, ensuring transparency and automation of tasks. Additionally, smart contracts can automatically trigger aggregation algorithms after participants submit their locally trained model parameters, storing the aggregated global model on the blockchain. They can also perform initial legitimacy checks on the submitted models, filtering out malicious or invalid updates. More importantly, smart contracts can automatically allocate rewards based on participants’ contributions to the model and penalize clients that do not follow the rules, thus effectively incentivizing high-quality participation and maintaining the system’s healthy operation. Through smart contracts, BC-FL achieves automation and decentralization of the federated learning process, significantly reducing reliance on centralized servers and enhancing the system’s trustworthiness and robustness.

The inherent scalability bottlenecks of blockchain, such as low transaction throughput and high confirmation latency, pose significant challenges to the large-scale application of BC-FL. To address these issues, researchers have introduced various scalability solutions. One such solution is Sidechains, which are independent blockchains running parallel to the main chain. BC-FL can utilize sidechains to handle large-scale model updates and data exchanges, offloading most computational tasks from the main chain and only recording key aggregation results or participant information on the main chain. This dramatically enhances overall performance. Meanwhile, Sharding is a technique that divides the blockchain network into multiple subnets, with each shard independently processing transactions. This allows for parallel processing, significantly boosting the system’s throughput. BC-FL can leverage sharding to assign different training tasks or participants to different shards, improving training efficiency. State Channels enable participants to interact off-chain multiple times, with only the opening and closing of the channel recorded on-chain. This approach drastically reduces the number of on-chain interactions, cutting down transaction fees and latency, making it especially suitable for BC-FL scenarios where model parameters need to be updated frequently. These scalability solutions offer new ways to optimize performance for BC-FL and lay the technical foundation for building efficient, large-scale decentralized federated learning platforms.

2.3. Literature Selection Methodology

This section describes the search strategy, screening procedure, and inclusion criteria employed to identify relevant studies on BC-FL.

2.3.1. Search Strategy

Primary keywords: “blockchain”, “federated learning”, “blockchain-based federated learning”, “blockchain-enabled federated learning”.

Secondary keywords: “consensus mechanism”, “smart contract”, “incentive mechanism”, “reputation mechanism”, “privacy protection”, “homomorphic encryption”, “differential privacy”, “secure multi-party computation”, “scalability”, “decentralization”.

Boolean logic: (blockchain OR distributed ledger) AND (federated learning OR collaborative learning) AND (architecture OR incentive OR privacy OR security).

2.3.2. Screening Procedure

To ensure comprehensive coverage, we also performed backward reference tracking and forward citation tracking. The screening process consisted of three stages:

• Initial identification: We retrieved 1247 potentially relevant papers from the aforementioned databases based on keyword matching. After removing duplicates, 892 papers remained for initial screening.
• Title and abstract screening: Papers that propose, analyze, or evaluate BC-FL systems, including architectural designs, consensus mechanisms, incentive mechanisms, reputation systems, privacy-preserving techniques, or real-world applications; papers that focus exclusively on blockchain without FL, or FL without blockchain; papers that are not peer-reviewed unless they are influential preprints; and papers published in non-English languages.
• Full-text review: The 286 papers were read in full to assess their relevance and quality. Papers were included if they: (1) Present novel technical contributions to BC-FL; (2) Provide systematic evaluations or empirical results; (3) Offer comprehensive surveys or taxonomies relevant to the field; (4) Address critical challenges, trade-offs, or deployment considerations.

Papers that were tangential to the core scope or lacked sufficient technical depth were excluded. After this stage, 113 papers were selected as the primary sample for this survey.

3. Blockchain-Based Federated Learning

This section surveys BC-FL through a unified taxonomy that connects system design choices to their practical implications. Specifically, existing schemes are organized along three complementary layers. The first layer concerns system architecture, which defines the degree of decentralization, communication workflow, and the division of responsibilities between on-chain and off-chain components. The second layer focuses on mechanism design, including incentive and reputation evaluation mechanisms that regulate participation, contribution quality, and long-term cooperation under decentralized training. The third layer covers security and privacy enhancement, which leverages blockchain primitives and complementary defenses to strengthen integrity, auditability, and privacy protection. This taxonomy provides a structured lens for understanding how design decisions shape performance, storage cost, and security properties, and it also lays the foundation for the challenge discussion in the next section. Representative BC-FL frameworks are shown in Table 2.

Table 2. Summary of Blockchain-based Federated Learning Systems.

Research Work	Application Domain	Privacy Protection Mechanism	Blockchain Structure	Incentive Mechanism	Consensus Protocol
FBLearn [43]	Finance	Adaptive model aggregation & ensemble techniques	-	-	-
Narkedimilli et al. [44]	IoT	Differential privacy, Attribute-based encryption	Private/ Permissioned	-	-
Riahi et al. [45]	Theoretical Research	Reinforcement learning optimization	-	-	-
BCFTL [46]	Healthcare	Federated transfer learning	-	-	-
BPFL [47]	General	Paillier encryption, Threshold decryption	-	Contribution-based	-
InFEDge [48]	HFL	Contract theory, Smart contracts	-	Contribution-based	-
CDPFL [49]	Internet of Vehicles	Differential privacy	-	Token-based	PBFT
PoFL [50]	Theoretical Research	FL tasks replace hashing	-	Contribution-based	FLConsensus
FusionFedBlock [51]	Industry 5.0	Hashing, Distributed Hash Table	-	-	-
Biscotti et al. [52]	Multi-party ML	Cryptographic primitives	Public blockchain	-	-
TPE-BFL [53]	General	Paillier encryption, HE	-	-	-
Chen et al. [41]	IoT	-	Public blockchain	Incentive-based storage	DPoS
Wang et al. [15]	Internet of Vehicles	Privacy-preserving decentralized FL model	Public blockchain	-	-
Asqah et al. [19]	IoT	Privacy protection review	-	-	-
Kang et al. [54]	General	Proof of Training (PoT), PoC	-	Contribution-based	PoT/PoC
Tang et al. [55]	Cross-silo FL	Social efficiency, individual rationality	-	Game-theoretic incentive	-
He et al. [56]	Energy blockchain	Game theory-based incentive	-	Collaborative security incentive	-
Pokhrel et al. [57]	Vehicular networks	Renewal reward mathematical framework	-	-	-
Qu et al. [10]	General survey	Comprehensive review	-	-	-
Shen et al. [53]	General	Paillier encryption, additive homomorphism	-	-	-
Zhao et al. [58]	General	-	-	Contribution-based	PoC
Liu et al. [59]	General	Reputation-based consensus	-	Reputation-based rewards	PoR

Note: “-”indicates that the corresponding item was not reported or not applicable in the referenced work.

The system architecture layer defines the degree of decentralization, storage model, and network topology. The mechanism design layer encompasses incentive and reputation evaluation mechanisms that regulate participation, contribution quality, and long-term cooperation. The security and privacy enhancement layer leverages blockchain primitives and complementary defenses—such as homomorphic encryption, differential privacy, and zero-knowledge proofs—to strengthen integrity, auditability, and privacy protection. These layers are not isolated; design decisions at one layer directly affect the feasibility and effectiveness of mechanisms in other layers. Figure 2 presents a hierarchical summary of the classification system discussed in this paper in a visual manner.

Figure 2. BC-FL architecture classification system.

3.1. Typical System Architecture

Architecture: The typical architecture choices of BC-FL systems form the foundation for achieving these goals. Current system architectures are mainly classified along two dimensions: on-chain storage content and network topology. In terms of storage, to address the challenges of large model parameter sizes and high on-chain costs, the mainstream solution is the “on-chain proof of summary” architecture. In this design, only key metadata is recorded on the blockchain, while the actual model files are stored off-chain in IPFS or dedicated parameter servers [60]. This approach significantly reduces the storage and communication burden on the blockchain. In terms of topology, architectures have evolved from fully decentralized systems to more practical hybrid or layered architectures. In a hybrid architecture, heavy consensus tasks are handled by high performance dedicated clients, while clients participate as light clients. Layered architectures introduce edge or fog computing clients, forming a three tier cloud edge device collaboration. Local aggregation and preliminary consensus occur at the edge layer, further optimizing latency and scalability. These design choices jointly determine the trade-offs among decentralization, performance, and security.

Djolev et al. [43] introduces the FBLearn platform which integrates blockchain and federated learning to enable secure data collaboration through adaptive model aggregation and ensemble techniques that enhance model robustness and privacy in financial applications. Narkedimilli et al. [44] apply a novel decentralized federated learning framework to the IoT domain, facilitating secure and transparent model training across distributed devices while ensuring comprehensive data privacy through advanced cryptographic and ledger technologies. Riahi et al. [45] propose a decentralized and secure FL framework, reinforced by a blockchain-based protocol for trusted model exchange and optimized using Reinforcement Learning to balance the age of the learning parameter, the non-IIDness of the data and the BC transaction costs. Similarly, the blockchain-enabled multimodal federated transfer learning framework is presented by Myrzashova et al. [46], leveraging FL, Transfer Learning, and Blockchain to create a secure, transparent, and highly accurate collaborative model for Alzheimer’s disease diagnosis using decentralized clinical and MRI data. Balija et al. [61] proposes a novel, fully decentralized, BC-FL framework for Large Language Models that optimizes weight transfer paths and uses the PageRank method to eliminate anomalous clients, demonstrating a significant decrease in latency and an increase in accuracy for serverless environments.

The workflow of a typical BC-FL system is illustrated in Figure 3, which consists of seven sequential steps.

• Task initialization: Clients perform initialization negotiation according to the preset environment, covering model parameters and training hyperparameters. The blockchain facilitates this process by storing initialization parameters on-chain and invoking smart contracts that define the training task, aggregation rules, and reward mechanisms.
• Local training: Each participating client trains the global model using its local dataset, generating updated model parameters while keeping raw data locally.
• Model upload: Clients submit their local model updates as transactions to the blockchain network. To reduce on-chain storage overhead, typically only key metadata (e.g., model hash, gradients) is uploaded rather than the complete model parameters.
• Transaction broadcast: Upon receiving transactions, blockchain nodes validate the submitted model updates according to predefined rules—such as checking digital signatures, verifying format correctness, and performing preliminary anomaly detection. Valid transactions are added to the local transaction pool.
• Block generation: The consensus protocol selects a node as the block proposer for the current round. This node aggregates the validated local model updates to form a new global model, packages the aggregation result and related training information into a block, and initiates the consensus process.
• Block broadcast: The newly generated block is broadcast to all nodes in the network. Upon receipt, verification nodes validate the block according to the consensus rules. Once approved by a supermajority of nodes, the block is appended to the local blockchain, achieving network-wide consensus.
• Global model distribution: Clients retrieve the latest global model from the blockchain system. The system then evaluates whether the training termination conditions—such as target accuracy or maximum rounds—are met. If not, the process returns to Step 2 for the next iteration.

Figure 3. Workflow of a typical BC-FL system. The process starts with global model initialization and distribution to training nodes (①). Each node performs local training on its private dataset and generates a local model update (②), which is then uploaded to the blockchain as a transaction (③). Miners verify the transactions and reach consensus (④), after which validated updates are packed into blocks (⑤) and broadcast across the network (⑥). The confirmed updates are finally used for global model aggregation and redistribution for the next communication round (⑦).

Figure 3. Workflow of a typical BC-FL system. The process starts with global model initialization and distribution to training nodes (①). Each node performs local training on its private dataset and generates a local model update (②), which is then uploaded to the blockchain as a transaction (③). Miners verify the transactions and reach consensus (④), after which validated updates are packed into blocks (⑤) and broadcast across the network (⑥). The confirmed updates are finally used for global model aggregation and redistribution for the next communication round (⑦).

Smart Contracts: In BC-FL systems, smart contracts (SCs) serve as the central components of decentralized governance and automated coordination. They transfer the trust and logical functions of the traditional centralized parameter server in FL architectures to the tamper proof blockchain. Smart contracts are primarily responsible for task initialization and registration, defining the global hyperparameters of training tasks, the number of iterations, data security requirements, and model performance evaluation metrics. Moreover, SCs function as the key executors that ensure the trustworthy verification of model updates. When clients submit model updates, the SC triggers a series of verification processes, including checking the integrity of model hashes, verifying whether the updates satisfy the differential privacy budget, and executing Byzantine fault tolerant mechanism to identify malicious or low quality submissions.

Most importantly, SCs enable automated incentive and penalty mechanisms. Based on predefined contribution evaluation algorithms, such as improvements in model accuracy or proof of data volume, the contract automatically calculates and distributes cryptocurrency or token rewards to high-quality contributors while imposing economic penalties on detected poisoning or dishonest clients. Through this process, BC-FL systems establish an endogenous incentive and self regulating trust environment. Current studies focus on designing lightweight and efficient SC verification logic to reduce transaction gas costs and to enable the high performance on-chain verification of complex cryptographic proofs, such as zero knowledge proofs.

Consensus mechanism: The consensus mechanism serves as the security cornerstone of BC-FL systems, ensuring that all network participants reach a unique and irreversible agreement on each model iteration, client contribution record, and ledger state [62,63]. Within the BC-FL environment, consensus mechanisms face distinctive challenges: they must process a large number of model update submissions while accommodating the resource-constrained nature of FL clients. Consequently, researchers are actively exploring and applying a variety of optimized mechanisms.

In permissioned BC-FL networks, the PBFT mechanism and its variants are widely adopted due to their efficiency and finality guarantees, though their scalability remains limited by the number of participating clients [64,65]. To achieve better coupling with FL tasks, many frameworks introduce hybrid consensus mechanisms. Researchers generally agree that traditional energy intensive consensus mechanisms, such as PoW, are unsuitable for resource-constrained FL environments. Current BC-FL systems therefore tend to adopt the following types of mechanisms:

• PBFT and its variants: In permissioned BC-FL networks, PBFT is widely favored for its efficiency, low latency, and finality guarantees. However, its scalability remains limited by the number of participating clients, typically fewer than several dozen. To address this limitation, researchers have proposed optimized variants of PBFT to reduce communication complexity, making it more suitable for enterprise level federated collaboration scenarios with a limited number of participants.
• DPoS and federated chains: To enable large-scale deployment, some frameworks have adopted the idea of DPoS, allowing FL clients to delegate their voting power to a small number of high performance representative clients [41]. These delegates form the core blockchain network responsible for model verification and block generation, significantly improving consensus efficiency and scalability. This approach is well suited to scenarios involving thousands or even tens of thousands of participating edge devices.
• Proof of Contribution (PoC)-oriented mechanisms: PoC is one of the most innovative mechanisms in the blockchain domain [58,66]. It uses each client’s actual contribution to the global model, such as improvements in model accuracy or data quality, as the key factor determining its consensus weight. By tightly coupling incentive mechanisms with secure validator selection, PoC addresses the “rich-get-richer” issue inherent in traditional PoS systems. It ensures that only high-quality contributors gain greater consensus power, thereby enhancing system security and suppressing malicious behaviors.
• Model-Aware Consensus: The latest research trend focuses on developing model-aware consensus algorithms [67]. Instead of treating model updates as ordinary transactions, these algorithms leverage the intrinsic properties of FL to optimize the consensus process. For example, only the key changing portions of the model are verified, or aggregation characteristics are exploited to reduce on-chain data size [68]. This enables higher consensus efficiency and system throughput without compromising security.

In summary, the choice of consensus mechanism in BC-FL should align with the specific application context. PBFT is preferable in permissioned, enterprise-scale scenarios where the number of participants is limited but finality and efficiency are critical. DPoS is more suitable for large-scale edge or IoT environments that require high throughput and scalability while maintaining a lightweight client experience. PoC mechanisms offer a natural fit for open collaborative platforms where incentivizing meaningful participation is as important as security. Meanwhile, model-aware consensus represents an emerging direction for scenarios where training efficiency and on-chain overhead are primary concerns.

From the perspective of system architecture, the existing BC-FL framework shows significant differences in terms of decentralization degree, scalability, and communication overhead. The fully decentralized architectures represented by Biscotti [52] and BAFFLE [69] eliminate the reliance on central servers and achieve direct node interaction through P2P networks. However, such designs face higher communication complexity and consensus latency, and are suitable for scenarios with a small number of nodes but extremely high trust requirements. In contrast, systems with hierarchical or hybrid architectures, such as InFEDge [48] and FusionFedBlock [51], offload high-frequency verification tasks to high-performance nodes by introducing edge aggregation nodes or side-chain mechanisms, significantly improving scalability and enabling the participation of thousands of devices. However, this comes at the cost of weakened decentralization and reliance on intermediate nodes. In terms of consensus mechanisms, PBFT and its variants [65,66] provide deterministic finality and lower latency in permissioned chain scenarios, but their communication complexity grows quadratically with the number of nodes, limiting the application of massive devices, while DPoS [42] and PoC [58] achieve different trade-offs between scalability and security through election of representatives or distribution of accounting rights based on contributions. In summary, the choice of architecture essentially involves a trade-off between decentralization degree and system performance. Future research should conduct adaptive design based on the specific constraints of application scenarios.

3.2. Incentive Mechanisms

The reward mechanism in BC-FL systems is a core governance tool that ensures the sustainability of the ecosystem and high-quality model training. Its fundamental purpose is to address key challenges in traditional federated learning, such as insufficient client participation, data silo effects, and free-riding behavior, by designing a fair, transparent, and automatically enforceable set of economic rules. By leveraging the automation of blockchain smart contracts, the reward mechanism converts client contributions into quantifiable value. This mechanism distributes incentives through cryptocurrencies or tokens, establishing an endogenous contribution-for-reward cycle. The core functions of the reward mechanism include stimulating high-quality participation by encouraging clients with high-quality datasets and stable computational resources to continuously train models, ensuring faster convergence and improved final performance; countering free-riding behavior by effectively identifying and penalizing malicious or passive clients that only download models without uploading valid updates, thereby guaranteeing fair allocation of system resources [54]; and ensuring transparency and security, as all contribution assessments and reward distributions are executed and permanently recorded by on-chain smart contracts, with the system even capable of penalizing clients that submit malicious gradients, such as in data poisoning attacks, thereby enhancing the Byzantine fault tolerance of the system.

Current research on BC-FL reward mechanisms primarily focuses on designing optimal incentive strategies and maintaining long-term trust to ensure that clients, while pursuing their own interests, also maximize the performance of the global model. Game theoretic approaches play a significant role in this context. Researchers often model the FL collaboration process as a strategic interaction among rational clients seeking to maximize their own benefits, with the goal of designing an incentive function such that choosing high-quality training becomes a dominant strategy for clients. Specific applications include contract theory, which designs differentiated reward contracts to minimize costs while incentivizing clients with varying capabilities and data quality to exert high effort [48]; and auction mechanisms, which are used for optimized resource allocation. Long-term trust maintenance is another key focus of incentive strategy research. Reputation-based mechanisms dynamically evaluate clients’ historical behaviors and performance to determine their reward weights and priority in subsequent training rounds [56]. Reputation scores integrate factors such as the quality of model updates, submission timeliness, and detection of malicious behavior. Smart contracts are responsible for storing and maintaining these immutable reputation values, thereby providing a reliable trust foundation for economic strategies.

The practical implementation of incentive mechanisms ultimately relies on accurate contribution quantification techniques, which directly measure the actual value a client adds to the global model and serve as the cornerstone for reward distribution. The most common approach is to evaluate the decrease in model loss or the improvement in accuracy on a public validation set resulting from a client’s submitted update. While simple and straightforward, this method struggles to distinguish the intrinsic value of the data from the client’s computational capability. Consequently, more advanced studies have introduced sophisticated algorithms, such as SHAP values or Truncated Monte Carlo approximate Shapley values, to precisely assess the marginal contribution of a client’s dataset to the final model performance [70]. These methods are theoretically fairer and effectively address the quantification challenges caused by data heterogeneity; however, their high computational complexity presents a key technical challenge for BC-FL systems in both off-chain verification and on-chain recording. In real-world deployments, Shapley value-based contribution estimation is typically implemented in an off-chain manner to avoid excessive on-chain computation. For instance, a server or a designated committee can approximate Shapley values using sampling techniques, such as randomly selecting subsets of clients to evaluate the marginal improvement brought by each client’s model update on a public validation set. The resulting contribution scores are then recorded on-chain via smart contracts to determine reward distribution. This hybrid off-chain computation with on-chain recording approach balances fairness and practical feasibility, though it still requires careful design to prevent manipulation by malicious aggregators. In summary, the latest research trends in BC-FL reward mechanisms focus on integrating game theory, reputation management, and precise contribution quantification techniques to establish an incentive ecosystem that is both efficient and fair.

The InFEDge mechanism [48] is proposed as a blockchain-based incentive mechanism for Hierarchical Federated Learning, designed to balance system overhead and model performance by modeling multi-dimensional individual properties, utilizing a contract game to solve incomplete information problems, and deploying smart contracts to create a credible, transparent, and secure resource trading system. Similarly, Tang et al. [55] propose a blockchain-empowered incentive mechanism framework or cross silo FL to motivate efficient, decentralized cooperation among mutually distrusting organizations by utilizing a distributed algorithm that achieves social efficiency, individual rationality, and budget balance without private information, while also incorporating a transaction minimization algorithm to reduce blockchain overhead. A game theory-based incentive mechanism implemented via smart contracts is introduced to secure FL within the energy blockchain environment [56], specifically designed to deter data poisoning and deception attacks by energy departments and the supervisory committee, provably leading the system to a collaborative security Nash Equilibrium. Moreover, the CDPFL [49] combines differential privacy, blockchain, and PBFT tolerance for handling malicious clients in IoV. It leverages blockchain for transparent and immutable data sharing, employs differential privacy with Gaussian noise to prevent privacy leakage, incorporates PBFT consensus and BFT aggregation for Byzantine tolerance, and utilizes a token-based incentive mechanism to encourage active, quality data contributions. These papers integrate FL with blockchain/incentive mechanisms to enhance trust, efficiency, and security in decentralized environments.

The above incentive schemes have significant differences in design goals and implementation paths. The InFEDge [48] based on contract theory designs differentiated reward contracts to motivate heterogeneous devices to participate under conditions of information asymmetry. Its advantage lies in handling multiple individual attributes, but it assumes strong assumptions about the behavior of participants. In contrast, the incentive framework proposed by Tang et al. [55] based on game theory emphasizes social efficiency and individual rationality, and achieves budget balance without private information through distributed algorithms, making it more suitable for inter-island federated learning where organizations with mutual distrust collaborate. The reputation-based incentive mechanism [56,59] uses historical contributions as the basis for reward distribution and realizes long-term fairness through dynamic adjustment of reputation values, but it faces risks of cold start for new clients and reputation collusion attacks. From the perspective of contribution quantification, the simple method based on model accuracy improvement [71] has low computational cost but is difficult to distinguish between data value and computing power. The precise method based on Shapley value [69,72] is theoretically more fair, but its computational complexity poses a challenge for on-chain execution, usually requiring approximate calculation off-chain and only the results being uploaded to the chain. Current research trends indicate that a single incentive dimension is difficult to adapt to heterogeneous dynamic environments. Future design should move towards the direction of integrating multiple indicators, adaptive adjustment, and further reducing the computational cost of contribution quantification.

3.3. Reputation Evaluation Mechanisms

The Reputation Evaluation Mechanism is a key security and incentive component in BC-FL systems, designed to quantify the trustworthiness and historical contribution quality of clients. Although federated learning can achieve collaborative model training while protecting user privacy, it still needs to solve the problem of how to fairly incentivize participants to contribute data and computing power. Without reasonable incentives, the willingness of all parties to participate may be insufficient, thereby restricting the scalability of the federated learning system. Introducing a transparent and efficient economic incentive design based on blockchain is expected to significantly enhance the collaborative enthusiasm of participants. In practice, the incentive mechanism can be implemented by a centralized server [73] or a blockchain [50,74]. Among them, building an incentive scheme based on blockchain provides a promising approach to promoting collaborative training in federated learning. For example, Lu et al. [50] present a novel Proof of Federated Learning consensus algorithm that recycles computational energy by substituting wasteful hashing processes with federated learning training tasks, thereby achieving a sustainable and secure blockchain environment for distributed artificial intelligence. Pokhrel et al. [57] introduces an autonomous blockchain-based federated learning framework for vehicular communication networking that employs a renewal reward mathematical framework to minimize end-to-end delay and optimize system parameters during the decentralized verification of on-vehicle machine learning updates. Currently, research has also explored platform-independent sharing mechanisms. Qu et al. [50] propose a platform-free Proof of Federated Learning consensus mechanism that promotes blockchain sustainability by repurposing computational power from energy-intensive hashing to collaborative model training while ensuring framework independence across decentralized environments.

Reputation evaluation in BC-FL is a dynamic and multi dimensional scoring system, with its technical focus on accurately and fairly assessing contribution quality and behavioral reliability. The evaluation factors typically include the quality of model updates, submission timeliness and stability, consistency of historical contributions, and the detection of any malicious behavior such as data poisoning or gradient manipulation [75,76]. At the technical quantification level, beyond directly observing validation performance, more refined mechanisms often employ gradient norm checks or Kullback–Leibler divergence-based statistical methods. The former is used to detect whether gradient values exceed a reasonable range, directly filtering out anomalous or malicious updates; the latter measures the statistical heterogeneity or parameter divergence between a client’s local model and the global or peer models, thereby indirectly assessing update reliability. In earlier studies, many systems adopted a multi weight subjective logic model to integrate multi party evaluations of clients. However, this approach is vulnerable to malicious rating attacks and tends to be unfair to newly joined clients [72,77]. Consequently, recent research has shifted toward developing more robust evaluation models based on decentralized verifiable claims, aiming to enhance fairness and resilience in reputation assessment.

The current research frontier of reputation evaluation mechanisms in BC-FL focuses on enhancing their attack resistance, fairness, and integration with other system components. To address the cold start problem for new clients, researchers have introduced the Dynamic Initial Reputation mechanism, which replaces fixed zero tolerance starting values to provide a more accommodating evaluation environment for newly joined clients with potentially high contributions [59,78]. In terms of system integration, PoR is emerging as a novel consensus mechanism that incorporates reputation scores directly into the selection and validation rights of block validators. This design enables high reputation clients to be more likely selected as consensus clients, ensuring that network security and activity are positively correlated with model training quality.

At the technical level, contribution quantification methods, such as marginal contribution-based model quality assessment and Shapley value approximation, are employed to measure a client’s actual improvement to the global model and directly convert this quantified contribution into a reputation score [79]. For instance, the novel fine-grained FL concept is introduced for mobile edge computing [80], which decentralizes shared ML models on edge servers to enable personalized prediction services and proposes a blockchain-based reputation aware approach to ensure trustworthy collaborative training while defining the system’s core requirements. Moreover, reputation systems are increasingly integrated with economic incentive strategies. For instance, in reverse auction-based mechanisms, only clients whose reputation exceeds a minimum threshold are eligible to participate in bidding, while high reputation clients enjoy competitive advantages to ensure that system efficiency is achieved without compromising model quality [71,76].

The current reputation evaluation mechanisms have different focuses in terms of evaluation dimensions and calculation methods. Early works, such as Kang et al. [54], used a multi-weighted subjective logic model to form the reputation value by integrating evaluations from multiple sources. Its advantage lies in simplicity of implementation, but it is vulnerable to malicious evaluation attacks and not friendly to new clients. Subsequent research shifted to evaluation models based on verifiable statements [73,79], enhancing fairness through immutable behavior evidence recorded on the chain, but it placed higher requirements on the storage space on the chain. In terms of evaluation factors, most schemes take model update quality as the core indicator, quantifying contributions through performance improvement on the validation set [76]; while some studies further incorporate submission timeliness, consistency of historical behavior, to identify strategic participation behaviors. In terms of integration at the consensus level, the PoR and PoC mechanisms directly link the reputation value to the accounting rights, making it easier for high-reputation nodes to obtain consensus rewards. To address the cold-start problem, dynamic initial reputation mechanisms [76] provide fair opportunities for new high-quality nodes by setting reasonable initial values and quickly adjusting them. Overall, the reputation evaluation mechanism is evolving from a single dimension and static weights to dynamic and adaptive, and its collaborative design with incentive mechanisms and consensus protocols will become the key to improving the robustness and fairness of the system.

3.4. Security Enhancement Mechanisms

The security enhancement mechanisms in BC-FL are built upon the decentralized trust and immutability of blockchain, combined with advanced privacy enhancing Technologies, to defend against the inherent security and privacy threats in federated learning. These mechanisms work collaboratively to ensure that data remains local, model updates are trustworthy, and the entire collaborative process is highly transparent and auditable.

3.4.1. Foundational Security Defense and Fault Response Provided by Blockchain

Blockchain primarily addresses the centralized trust crisis and data integrity failures inherent in traditional FL [18,81]. Qu et al. [10] comprehensively summarized the problems such as centralized processing, data tampering, and the lack of incentive mechanisms, and evaluated the existing variants of blockchain-enabled federated learning, a rapidly developing field that offers theoretical and technical solutions to overcome these challenges and enhance FL performance, while also pointing out emerging research directions in this area. By leveraging its immutability, BC-FL creates a non repudiable audit trail for all model updates, client reputation scores, and incentive transactions. This fundamentally ensures transparency and traceability, allowing any malicious model tampering or unfair reward distribution to be promptly detected. For example, a malicious miner could exploit the entire BC-FL system to amplify its mining power and thereby gain control of a miner group, enabling it to tamper with data blocks [81]; adversaries could also launch Sybil style attacks to perform double spending, greatly reducing mining efficiency.

To counter Sybil attacks and Byzantine failures, BC-FL employs REM and PoR consensus schemes for layered defense. the REM leverages smart contracts to establish a dynamic and tamper-proof defense system. This approach centers on utilizing smart contracts to automatically compute, store, and maintain a reputation score for each participant, which forms the core of the countermeasures. (1) Countering Sybil Attacks: The system mitigates Sybil attacks by requiring newly joined clients to accumulate reputation progressively over time through reliable contributions [76,82]. This design, enforced by smart contracts, significantly raises the cost for an attacker to manipulate the global model using a swarm of fake identities, as building high-reputation entities is a slow and observable process. (2) Mitigating Byzantine Faults: REM protects against Byzantine faults, which include malicious behaviors like data poisoning [83,84] and model poisoning [85,86]. The reputation score serves as a critical weighting factor during model aggregation. Smart contracts automatically assign lower weights or filter updates that exhibit anomalies (e.g., aberrant gradients or poor validation performance), thereby diluting the impact of malicious or faulty clients and ensuring the robustness and accuracy of the training process.

In summary, by translating long-term behavior into quantifiable reputation via smart contracts, REM creates a security barrier that autonomously deters Sybil attacks and suppresses Byzantine activities. Furthermore, this mechanism naturally fosters a constructive incentive framework, as consistent and reliable contributions are directly linked to higher reputation and rewards, promoting active and trustworthy participation.

3.4.2. Deployment of Attack and Defense Techniques Against Privacy Leakage

Sharing federated learning model parameters still faces risks of privacy leakage, primarily including membership inference attacks and model inversion attacks [31,87,88]. To mitigate these threats, BC-FL integrates core cryptographic and statistical techniques. Homomorphic Encryption (HE) is a powerful cryptographic tool that allows aggregation computations to be performed on encrypted model updates, effectively addressing the privacy risks of intermediate data exposure during aggregation. Complementing HE, secure multi-party computation enables secure aggregation, allowing multiple clients to collaboratively compute aggregation functions without revealing their raw input values, thereby preventing gradient information leakage between clients [89]. For example, a Training Parameter Encryption scheme for BC-FL is proposed [53], utilizing the Paillier encryption algorithm, which supports additive homomorphism to secure the transmission of training parameters among clients, validators, and miners against malicious clients, achieving significant privacy enhancement and demonstrating improved model accuracy 92% compared to baseline decentralized FL frameworks. Guduri et al. [90] introduces a blockchain-based lightweight encryption strategy integrated with FL to enhance the scalability and trust of Electronic Health Records, utilizing active smart contracts and an efficient proxy re-encryption mechanism to ensure secure, third party free data transfer and full encryption throughout the conversation, validated by deployment on an Ethereum testbed. Additionally, a framework integrates blockchain to reduce communication costs, mitigate data falsification, and provide incentives for B5G driven edge computing. Additionally, it utilizes DP, a statistical defense that protects privacy by injecting controlled random noise into parameters uploaded by clients [91]. Specifically, Wasserstein generative adversarial networks enabled DP is used to generate and inject optimized noise into model parameters, achieving a superior trade-off between privacy protection and data utility. Moreover, a novel privacy and blockchain-empowered UAV-enabled decentralized graph federated learning framework is proposed for disaster response, addressing the challenges of distributed graph learning and data leakage [92]. The framework secures model training through differential privacy, ensures model integrity via blockchain authentication, and uses a DPoS consensus mechanism for efficient and secure weights aggregation. Extensive simulations confirmed the framework’s effectiveness in balancing privacy, accuracy, and efficiency.

Meanwhile, numerous studies have leveraged hashing and encryption of local models to ensure the security of private information. A scheme called FusionFedBlock has been proposed to address challenges such as privacy, latency, and security in Industry 5.0 environments [51]. This framework enables industrial sectors to perform local learning updates privately through federated learning, which are subsequently verified by miners within a blockchain layer, while a distributed hash table provides decentralized and secure storage. This approach achieves an accuracy of 93.5% even when 50% of the clients are active. Similarly, Biscotti et al. [52] is proposed as a fully decentralized, peer-to-peer approach to multi-party machine learning, utilizing blockchain and cryptographic primitives to coordinate a privacy-preserving process without a trusted central infrastructure. This system is demonstrated to be scalable, fault-tolerant, and effective at defending against poisoning attacks, successfully maintaining global model performance even with 30% adversaries present. Ren et al. [47] propose BPFL to address malicious behavior and privacy leakage in FL. BPFL constructs a blockchain-based incentive mechanism to supervise and punish malicious participants, and employs the Paillier cryptosystem with threshold decryption to protect the privacy of local and aggregated models. Poisonous data is detected by computing the cosine similarity between gradients, enabling BPFL to effectively resist poisoning attacks and significantly improve model accuracy.

Although this mechanism may introduce some accuracy degradation, its key advantage lies in effectively preventing attackers from inferring a specific client’s training data features through analysis of the global model parameters, making it an effective countermeasure against model reconstruction and membership inference attacks.

3.4.3. Assessment of Privacy-Enhancing Techniques

Although HE, MPC and DP provide the necessary privacy protection for blockchain-based financial systems, their practical applications are constrained by inherent limitations. Specifically, HE enables computation on encrypted data but incurs significant computational overhead. Fully homomorphic encryption (FHE) is orders of magnitude slower than plaintext operations, making it impractical for large-scale deep learning models. Even partially homomorphic schemes like Paillier [52] cause substantial ciphertext expansion and computational burden. Additionally, HE often assumes a trusted key authority, reintroducing a central point of trust that partially undermines the decentralization goals of BC-FL. Secure MPC allows multiple parties to jointly compute aggregation without revealing individual inputs. However, MPC protocols typically require multiple communication rounds with complexity scaling linearly or quadratically with participant count, creating a major bottleneck for systems with hundreds or thousands of clients. Many MPC variants also assume semi-honest adversaries and struggle to guarantee security under Byzantine behavior without additional overhead. DP provides statistical privacy guarantees by injecting controlled noise into model updates. This introduces a fundamental privacy–utility trade-off: meaningful privacy guarantees often require noise levels that degrade model accuracy [90]. Furthermore, DP noise can obscure malicious gradients, complicating the detection of poisoning attacks [93]. Privacy budget composition across multiple rounds also requires careful accounting.

Table 3 compares these technologies. In practical applications, many blockchain-based federated learning systems adopt hybrid approaches, such as using dynamic programming for lightweight protection, combining it with hash encryption or multi-party computation for critical aggregation rounds, or transferring heavy computational tasks to side chains. However, such designs introduce additional consistency and coordination complexities. A key insight is that no single technology can simultaneously optimize security, efficiency, and scalability. This choice must be made based on the specific threat model, performance requirements, and resource limitations of the target deployment.

Table 3. Comparative analysis of privacy-enhancing techniques in BC-FL.

Criterion	HE	MPC	DP
Privacy Guarantee	Cryptographic	Cryptographic	Statistical
Computational Overhead	Very high	Moderate to high	Low
Communication Overhead	Low to moderate	High	Low
Impact on Accuracy	None	None	Accuracy degradation
Scalability	Limited by computation	Limited by communication	Good
Primary Limitation	Computational cost	Communication cost	Privacy–utility trade-off

3.5. Trade-Off Analysis

In the design of BC-FL systems, decentralization, communication overhead, scalability, and energy consumption are not independent variables; rather, they exist in a complex dynamic balance. This section provides an in-depth analysis of the interdependent constraints among these four core dimensions.

3.5.1. Decentralization vs. Communication and Energy

A fully decentralized architecture eliminates single points of failure and maximizes trust, but at the cost of significant communication redundancy and energy consumption.

• Energy Consumption: High decentralization often relies on computation-intensive consensus mechanisms (such as PoW) to ensure security, leading to extremely high energy usage, which is unsuitable for resource-constrained IoT devices. Transitioning to PoS or DPoS can significantly reduce energy consumption, but this also implies that trust is partially dependent on large stakeholders or elected representative nodes, thereby weakening the theoretical ideal of full decentralization.
• Communication and overhead: In a fully decentralized setting, each model update transaction must be broadcast to the entire network and undergo multiple rounds of consensus validation, causing communication complexity to typically grow with the number of nodes. In contrast, introducing hierarchical structures or designating edge aggregators as lightweight nodes can reduce communication overhead, but this essentially comes at the cost of sacrificing some degree of decentralization.

3.5.2. Scalability vs. Consistency and Decentralization

As the number of devices participating in federated learning scales to the millions, storage and synchronization bottlenecks in blockchain systems become increasingly prominent.

• Storage and Synchronization: To maintain global consistency, full nodes must store the complete ledger. As the number of nodes increases, synchronization delays grow, directly slowing down the aggregation process in federated learning.
• Trade-offs in Solutions: Techniques such as sharding or sidechains can process transactions in parallel, significantly improving throughput and scalability. However, sharding partitions the network into smaller groups, weakening the global decentralized security perspective. Additionally, cross-shard communication introduces new complexity and latency. Therefore, system designers must choose between high decentralization with strong global consistency and horizontal scalability with weaker local consistency.

3.5.3. Security/Privacy vs. Efficiency

• Privacy Computation Overhead: Integrating techniques such as DP, MPC, or HE can significantly enhance privacy protection. However, these methods substantially increase gradient size and computation time. For example, aggregation over encrypted data may take tens of times longer than plaintext computation.
• Cost of Defense Mechanisms: Complex reputation evaluation mechanisms or additional verification transactions designed to defend against poisoning attacks can improve robustness, but they also increase the system load in each training round.

Table 4 summarizes the comparative characteristics of representative BC-FL architectures in key design dimensions. These dimensions include: architecture type, consensus mechanism, degree of decentralization, scalability, communication overhead, as well as main advantages and limitations. These characteristics highlight the inherent trade-offs that system designers must address when choosing or designing BC-FL solutions for specific application scenarios.

Table 4. Comparative characteristics of representative BC-FL frameworks.

Framework	Architecture	Consensus	Decentralization	Scalability	Comm. Overhead	Primary Strength	Primary Limitation
Biscotti [52]	P2P	—	High	Low	High	Byzantine resilience, no central server	Communication cost, node limit
InFEDge [48]	Hierarchical	—	Medium	High	Low	Edge-friendly, contract-based incentive	Trust in edge aggregators
CDFFL [49]	Hybrid	PBFT	Medium	Medium	Medium	Byzantine tolerance, privacy	PBFT scalability
PoFL [50]	Fully decentralized	PoFL	High	Medium	Medium	Energy recycling, incentive alignment	Contribution quantification
FusionFedBlock [51]	Hybrid	—	Medium	High	Low	Storage efficiency, robustness	Off-chain storage dependency
BAFFLE [69]	Fully decentralized	—	High	High	Medium	Aggregator-free, smart contract coordination	Smart contract complexity
BPFL [47]	Permissioned	—	Low	Medium	Low	Strong privacy (Paillier), poisoning resistance	Computational overhead

4. Challenges and Open Issues

4.1. Efficiency and Scalability Challenges

Efficiency and scalability are the core obstacles preventing BC-FL from moving beyond the laboratory stage to large-scale real world applications. The decentralized nature of blockchain comes at the cost of the efficiency inherent in traditional centralized architectures, making the performance bottlenecks of BC-FL systems particularly evident when handling massive numbers of clients and high frequency training tasks. As discussed in Section 3.1 (typical system architecture), these bottlenecks largely stem from placing coordination, logging, and verification of training events on the critical path of on-chain consensus, making the overall system performance sensitive to consensus throughput and network dynamics.

4.1.1. Computational and Communication Costs of Consensus

The consensus protocol is the primary source of inefficiency. In BC-FL systems, each round of model aggregation must undergo complex consensus verification to ensure the integrity and immutability of model updates. High energy consumption and latency in PoW: Early design attempts deployed the model aggregation process on blockchains based on PoW. However, PoW requires clients to compete for block generation rights by solving numerous irrelevant cryptographic puzzles, which not only consumes enormous computational resources but also causes severe transaction delays. For example, a 3 to 10-fold increase means that a training round originally taking 5 s in a conventional FL system may take approximately 15 to 50 s after introducing PoW-based blockchain consensus. As a result, the duration of each training round is greatly prolonged, making the system incapable of handling high frequency model updates.

Currently, the research paradigm is gradually shifting toward introducing mechanisms such as Proof of Stake (PoS) or DPoS into BC-FL to alleviate the high computational overhead caused by traditional consensus algorithms. Furthermore, more innovative research directions attempt to integrate the consensus process with the federated learning task itself. For example, Kang et al. [54] proposed mechanisms such as Proof of Training (PoT) and PoC, where a client’s contribution to model training serves as the basis for obtaining consensus privileges. Lu et al. [94] proposed a secure data sharing architecture for the industrial Internet of Things, which combines permissioned blockchain and federated learning technology. By integrating the model training process into the consensus mechanism, it can protect privacy and improve system resource utilization in a decentralized environment. The significant advantage of such mechanisms lies in their ability to incentivize clients to provide higher quality participation in training. However, the key challenge lies in designing a contribution quantification algorithm that is both resistant to Sybil attacks and difficult to manipulate, thereby ensuring fairness in the consensus process and maintaining overall system security.

4.1.2. Scalability Bottlenecks and System Architecture Limitations

The ultimate vision of federated learning is to support the participation of millions of edge devices in training [95]. However, there exists an order of magnitude gap in transaction processing performance between mainstream public blockchains and traditional payment systems. For instance, the Bitcoin blockchain processes an average of about four transactions per second, while Ethereum handles around twelve. In contrast, traditional payment networks such as VISA can process thousands to tens of thousands of transactions per second. This significant performance disparity constitutes a major bottleneck for the application of blockchain technology in high frequency transaction scenarios.

Specifically, the bottleneck of on-chain operations arises mainly because traditional blockchains can handle far fewer transactions per second than centralized servers. When a large number of clients concurrently upload model updates, transactions containing model parameters can quickly accumulate, leading to severe network congestion. Zhang [96] explicitly pointed out in their study on the DFL architecture that, when dealing with non-independent and identically distributed (non-IID) datasets, the limited throughput of traditional blockchains becomes the key bottleneck restricting the scalability of BC-FL systems. Moreover, the limitations introduced by layered and hybrid architectures. To overcome the aforementioned constraints, many studies have proposed layered or hybrid architectures. For example, Jin et al. [97] introduced a lightweight BC-FL framework based on sidechains, where model training and high frequency validation operations are offloaded to high performance sidechains, while only the final aggregated model summaries and key incentive records are stored on the main chain. This architecture significantly improves system throughput. However, it also introduces additional security risks associated with cross-chain communication and increases the complexity of ensuring data consistency. Empirical evaluation further clarifies this gap within the context of BC-FL. When training a convolutional neural network on a MNIST dataset containing 100 clients, the centralized FL server can complete a round of aggregation in less than 2 s, while the blockchain implementation based on PBFT, due to consensus overhead, takes approximately 15 to 20 s per round. As the number of participants increases, this performance disparity becomes more pronounced. Meanwhile, inspired by high performance public blockchains, some studies have attempted to introduce sharding technology into BC-FL. In this approach, clients are divided into different shards, each performing consensus and aggregation independently, with cross shard communication occurring only at specific intervals. The sharding solution proposed by Lin et al. [98] aims to process multiple model updates in parallel, thereby significantly improving system scalability. However, the key challenge of sharding lies in ensuring secure cross shard communication and maintaining global model consistency, which is difficult due to data isolation among shards.

These challenges have driven the research focus of BC-FL to shift from “whether to adopt blockchain” toward “how to use blockchain technology selectively and lightweightly” in order to achieve a practical balance between decentralization and system performance.

4.2. Storage Challenges

The storage overhead analyzed here is a natural consequence of the auditability and traceability goals emphasized in Section 3, where blockchain is used to persist training evidence such as model updates, metadata, and verification records. As highlighted in the typical system architecture and security and privacy enhancement discussions, maintaining verifiable histories on-chain improves trust but can rapidly inflate on-chain state, motivating hybrid or off-chain storage designs.

4.2.1. Massive On-Chain Storage Overhead and Capacity Limitations

The storage challenge is a core issue that must be addressed for BC-FL to achieve long-term sustainability and large-scale deployment. The immutability of blockchain, while serving as its foundation of trust, also means that every full client in the network must store and synchronize the entire transaction history. This becomes a significant burden when dealing with data intensive objects such as deep learning models.

To ensure transparency and auditability of model updates, the local model parameters uploaded by clients after each training iteration are typically recorded on-chain. A complex deep learning model may contain millions or even billions of floating point parameters, and after hundreds of federated learning iterations, the amount of on-chain data can grow exponentially. For example, if a model contains 10 million parameters and each parameter is stored as a 32-bit floating-point value, a single model update already requires about 40 MB of storage. If 100 clients each upload one such update per training round, one round alone would generate about 4 GB of data. After 100 training rounds, the cumulative storage demand would reach about 400 GB, even without considering additional metadata or replication overhead. Tian et al. [99] explicitly pointed out that this on-chain storage mode can rapidly exhaust the storage capacity of blockchain full clients, making it difficult for new clients to synchronize and severely hindering the system’s decentralization capability. Ma et al. [100] similarly pointed out that combining a permanently growing ledger with frequently updated large-scale model parameters would lead to an explosive growth in storage space. To address this issue, they proposed the TORR framework, which effectively reduces redundant data on the chain by designing a dedicated storage protocol, thereby lowering the storage load. However, this approach also sacrifices the characteristic of full historical traceability of the blockchain, potentially leading to the risk of data loss when the system performs model backtracking.

More critically, this mechanism makes it nearly impossible for resource-constrained edge devices to bear the cost of maintaining a full ledger, effectively excluding them from full client verification. This contradicts the original intention of federated learning—to leverage distributed computational resources. To address this issue, some researchers have attempted to optimize model representation, such as using model quantization techniques to compress gradient files. However, such compression often comes at the expense of model accuracy, making it difficult to achieve an ideal balance between performance and storage efficiency.

4.2.2. On-Chain–Off-Chain Hybrid Storage Architectures

To alleviate the storage pressure and capacity limitations of the main chain, researchers have widely adopted hybrid storage architectures. This approach decouples data-intensive model update parameters from the blockchain and stores them in off-chain storage systems, while only recording their hash values or metadata on-chain to ensure data integrity. A common solution is the use of decentralized storage networks such as the InterPlanetary File System (IPFS). Asad et al. [101] proposed a scheme that integrates IPFS with blockchain, offloading large model files to IPFS. This significantly reduces the storage burden on the blockchain and enhances overall system scalability. For example, if a model update is 40 MB, storing only its hash value on-chain would require only a few dozen bytes rather than the full model file, reducing the on-chain storage cost by several orders of magnitude. This simple comparison illustrates why hybrid storage architectures are attractive for large-scale BC-FL systems.

However, such hybrid architectures also introduce new challenges in terms of security and consistency. The first issue concerns data availability: off-chain storage depends on the reliability of storage service providers. If off-chain clients fail or go offline maliciously, the corresponding model updates may become inaccessible, thereby undermining the robustness of global model aggregation. The second issue involves ensuring synchronization and consistency between on-chain and off-chain data. Although hash values can verify data integrity, achieving efficient on-chain data validation remains difficult. Heiss et al. [102] and others have attempted to enhance off-chain data verification through the integration of zero-knowledge proofs. Nevertheless, these cryptographic protocols introduce significant computational overhead, transforming the storage problem into a multidimensional trade-off among decentralized storage dependency, hybrid system consistency, and cryptographic verification costs.

4.3. Security Challenges

Although blockchain’s immutability and decentralization mitigate single points of failure and reduce reliance on a trusted central server in traditional federated learning, blockchain-based federated learning systems still face new and complex security challenges in decentralized settings. As discussed in Section 3, existing designs commonly combine incentive and reputation mechanisms with security and privacy enhancement strategies to regulate participant behavior and improve trustworthiness. However, these mechanisms do not fully prevent learning-specific threats, and poisoning attacks that directly manipulate model updates remain particularly difficult to detect and defend against.

4.3.1. Identity Anonymity in Decentralized Environments

In BC-FL systems, the most significant security threat still arises from malicious model updates uploaded by clients, also known as model poisoning attacks [103]. Malicious clients may deliberately upload invalid or falsified gradients, or craft gradients containing backdoors, with the intent to degrade the performance of the global model or implant hidden attack triggers. Although blockchain provides strong auditability, its verification capability remains limited. It can only validate the legitimacy of transactions, such as correct digital signatures or proper transaction formats, but cannot verify the semantic correctness or quality of model updates. As emphasized by Wei et al. [93], blockchain ensures the existence and integrity of data but cannot determine whether the uploaded model parameters are beneficial or honest contributions to the global model. Consequently, even if malicious gradients are successfully recorded on-chain, they cannot be easily identified.

In decentralized environments without a central authority, attackers can exploit network anonymity by creating numerous fake identities [104]. As a result, they may gain disproportionate influence over the consensus process or overwhelm the contributions of honest clients during aggregation. Such Sybil attacks represent a critical vulnerability in BC-FL, as a single malicious entity can control multiple clients. The experimental results show that in a federated learning system, if only 10% of the clients act as malicious attackers, after several training rounds, the accuracy of the global model may drop from over 95% to below 50%. In the Sibel attack scenario, a single attacker controlling multiple false identities can amplify this effect [86]. When the number of Sibel identities reaches 20% of the total number of clients, the attacker’s impact on the aggregated model may increase by three to five times. Zhou et al. [105] discussed this threat in the context of privacy-preserving BC-FL for healthcare data, emphasizing the need for effective identity authentication and deduplication mechanisms to prevent manipulation of the consensus process. Malicious clients may submit seemingly normal gradients that contain hidden triggers. These attacks are highly stealthy and cannot be easily detected through conventional statistical or norm-based gradient checks. Guo et al. [106] proposed a blockchain-based defense mechanism leveraging Trusted Execution Environments (TEEs) to secure the verification of model updates. However, integrating TEEs introduces additional hardware dependencies and trust assumptions. Due to these sophisticated and covert attack forms, the security model of BC-FL must extend beyond traditional cryptographic protections and evolve toward new defense paradigms based on behavioral analysis, reputation evaluation, and multi-party verification.

4.3.2. Abuse of Decentralized Authority

Blockchain-based federated learning systems, while enabling decentralized governance, may also face risks of power abuse. Although blockchain technology generally provides trustworthy guarantees for interactions and parameter exchanges among participants, it remains vulnerable to 51% attacks. In such scenarios, consensus mechanisms that rely heavily on computational power are susceptible to centralization, where the system becomes dominated by a few powerful mining operators who control consensus generation and ledger maintenance. These security risks are particularly pronounced in public blockchains like Ethereum and Bitcoin, whereas private or consortium blockchains are comparatively less affected due to pre-established consensus rules and identity restrictions among participating clients.

5. Datasets and Evaluation Metrics

To enhance the reproducibility and fair comparison of BC-FL research, this section systematically reviews the widely adopted benchmark datasets and core evaluation metrics in the field of blockchain-enabled federated learning research.

5.1. Benchmark Datasets

BC-FL research typically selects datasets based on application scenarios and deliberately partitions them into non-independent and identically distributed (Non-IID) settings to simulate real-world edge computing environments. The main datasets can be categorized as follows:

• General image classification datasets: In the domain of image classification, MNIST [107] and CIFAR-10/100 [108] are commonly used to validate the convergence and basic accuracy of new algorithms due to their simple structure and fast training speed. FEMNIST [109], with its natural partitioning by writer, has become the preferred dataset for simulating user data heterogeneity. For more complex scenarios, some studies have also begun to use subsets of ImageNet [110].
• Healthcare datasets: Due to the highly sensitive nature of medical data, such datasets are a core application area for BC-FL. MIMIC-III [111] is often used for patient outcome prediction; ChestX-ray14 [112] is used for lung disease image classification; and datasets such as Harvard FAIR’s brain tumor data are also frequently adopted. In these scenarios, data is typically partitioned vertically or horizontally by hospital or by patient.
• IoT and time-series data: For edge device scenarios, the UCI Human Activity Recognition dataset [113] is used to recognize user activities captured by smartphone sensors; NSL-KDD [114] and CIC-IDS2017 [115] are widely used for FL-based network intrusion detection systems; and Smart Grid-related datasets are used for load forecasting and energy management.
• Financial and text datasets: The Credit Card Fraud Detection dataset [116] is commonly used for fraud detection model training; sentiment analysis datasets (such as IMDB Reviews [117]) are used for distributed sentiment analysis tasks.

5.2. Evaluation Metrics

Since BC-FL integrates machine learning and blockchain technologies, its evaluation framework must cover performance across two dimensions:

5.2.1. Machine Learning Performance Metrics

• Model Accuracy and F1-Score: These measure the model’s predictive performance on the test set and are the most intuitive indicators.
• Convergence Rate: Defined as the number of communication rounds required to reach a specified accuracy threshold. In BC-FL, due to consensus delays, convergence time is often more important than the number of rounds.
• Robustness: The degree of accuracy degradation when the model faces poisoning attacks or Byzantine nodes.

5.2.2. Blockchain System Performance Metrics

• Throughput: The number of model update transactions the system can process per second.
• Latency: The average time from submitting a model update to its confirmation on-chain and participation in aggregation, including network propagation time and consensus confirmation time.
• Scalability: The trend of system throughput and latency as the number of participating nodes increases.

5.2.3. Resource and Overhead Metrics

• Communication Overhead: The total amount of data (in MB) uploaded/downloaded per training round, including model parameters, gradients, and blockchain proof data.
• Storage Cost: The growth of data that nodes must store to maintain ledger consistency.
• Computation and Energy Consumption: The CPU/GPU utilization and energy consumption of nodes during local training and participation in consensus processes.

6. Practical Application Scenarios

Although BC-FL is still in a stage of rapid development, it has already demonstrated significant potential across multiple real-world application domains. This section provides an overview of BC-FL deployments in typical scenarios, with a focus on the key challenges faced in each domain and the corresponding solutions.

In the smart healthcare domain, data privacy and regulatory compliance requirements are extremely stringent, making traditional centralized data solutions difficult to implement. BC-FL enables cross-institutional collaborative training without sharing raw data, providing a viable approach for medical diagnosis. For example, the BCFTL framework [46] leverages blockchain and federated transfer learning for multi-center collaborative diagnosis of Alzheimer’s disease, ensuring that patient imaging data and clinical records remain local. BPFL [47] combines Paillier encryption with blockchain-based incentive mechanisms to protect model privacy while effectively defending against malicious attacks. In practical deployment, particular attention must be paid to compliance with regulations such as HIPAA and GDPR, as well as clinical requirements like model interpretability.

In IoT and edge computing scenarios, devices are resource-constrained and often operate in untrusted environments. BC-FL enables secure training under an end–edge–cloud collaborative paradigm through lightweight consensus mechanisms and on-chain incentive schemes. InFEDge [48] employs contract theory to design differentiated reward mechanisms, effectively incentivizing heterogeneous edge devices to participate in federated learning. The sidechain architecture proposed by Jin et al. [97] offloads high-frequency validation operations to sidechains, significantly reducing the storage burden on the main chain and adapting to the constraints of resource-limited devices. Furthermore, the role of blockchain in achieving secure storage and trusted data sharing in the Internet of Things has been explored in the work of Pawar et al. [118] This study demonstrates how a decentralized architecture can eliminate the reliance on third-party auditors and support dynamic trust management through a reputation mechanism. The key challenges in this field include the heterogeneity of devices, intermittent connectivity, and energy efficiency. Key challenges in this domain include device heterogeneity, intermittent connectivity, and energy efficiency.

For vehicular networks and intelligent transportation, the environment is characterized by high mobility, low latency requirements, and stringent security demands. BC-FL supports real-time collaborative learning among vehicles through decentralized trust mechanisms. CDFFL [49] integrates differential privacy with PBFT consensus to protect vehicle data privacy while defending against malicious nodes. The framework proposed by Pokhrel et al. [57] optimizes end-to-end latency and model validation efficiency to accommodate the highly dynamic nature of vehicular networks. Practical deployment must address issues such as low-latency consensus and frequent node joining and leaving.

In the context of Industry 5.0 and smart manufacturing, which emphasizes human-centric, sustainable, and resilient production, BC-FL provides secure and reliable support for cross-factory collaboration. FusionFedBlock [51] integrates federated learning with blockchain, allowing each production unit to train models locally and only submit updates to the blockchain layer for verification. It achieves a model accuracy of 93.5% even with only 50% active nodes, demonstrating strong robustness.

Similarly, financial and cross-institutional collaboration scenarios benefit from BC-FL. Financial institutions operate under strict regulatory constraints and face significant barriers to data sharing. BC-FL enables joint modeling without exposing sensitive customer information, supporting applications such as fraud detection and credit scoring. The FBLearn [43] platform addresses trust issues among competing institutions through adaptive model aggregation and blockchain-based auditing mechanisms.

In summary, BC-FL shows promising application prospects in smart healthcare, IoT, vehicular networks, industrial manufacturing, and financial services. However, domain-specific challenges remain and require further targeted optimization in future research to drive BC-FL from theoretical exploration toward large-scale real-world deployment.

7. Future Directions

7.1. Closed-Loop Joint Defense Against Sybil and Poisoning Attacks

In open or weakly permissioned BC-FL environments, Sybil attacks and poisoning attacks often do not occur in isolation. Adversaries are more likely to exploit mass identity fabrication to amplify their influence in aggregation and governance, while persistently injecting subtly malicious updates to steer the global model over time. Existing studies have initially explored defense mechanisms targeting a single type of attack. For instance, Jiang et al. [93] analyzed the witch attack threat in differential privacy federated learning, pointing out that a single statistical threshold is insufficient to effectively distinguish normal noise from malicious behavior; Tolpegin et al. [82] systematically evaluated the impact of data poisoning attacks on federated learning models, revealing the limitations of traditional anomaly detection methods. However, research on jointly modeling these two types of attacks and constructing a unified defense mechanism is still relatively scarce. Therefore, a valuable future direction lies in integrating identity management, reputation evolution, and robust aggregation into a unified closed-loop mechanism, rather than optimizing them individually. One feasible design example is to introduce a Proof-of-Long-Term-Contribution or Long-Horizon Reputation Proof scheme, where the effective weight of an identity must be accumulated through multiple rounds of verifiable, genuine contributions. This weight can then be directly tied to both the model aggregation process and the reward distribution. Such a design substantially raises the marginal cost for large-scale Sybil-based manipulation and prevents short-term identity camouflage from gaining significant influence or profit [119], thereby enhancing system resilience at the protocol level. From a feasibility perspective, this direction can be expanded based on existing reputation mechanisms (such as PoR [58]) and contribution quantification methods (such as the approximation of Shapley value [78]), and there are feasible paths. At the practical level, this direction is of great significance for building a sustainable and attack-resistant open federated learning platform, especially in scenarios where devices frequently enter and exit, such as in the Internet of Things and edge computing.

Moreover, future studies should incorporate mechanisms such as differential privacy into the modeling of joint Sybil and poisoning threats. This is important because the addition of differential privacy noise can systematically reduce the separability of outlier detection, which may be exploited by adversaries as a means to conceal stealthy poisoning behaviors. A more effective design would explicitly account for noise intensity and uncertainty in the processes of reputation adjustment and threshold calibration. This allows the system to distinguish between fluctuations caused by privacy-preserving noise and those caused by malicious deviations, even under privacy constraints. Furthermore, from a baseline security perspective, it is important to address both data poisoning and model poisoning threats simultaneously. Covering both categories ensures that the defense mechanisms are not narrowly focused, which would otherwise result in resilience against one attack type but vulnerability to the other. This comprehensive treatment will make future research directions more practically applicable and engineering-ready.

7.2. On-Chain Implementation of Verifiable Aggregation and Auditable Evidence

The advantages of BC-FL should go beyond generating tamper-proof logs, its deeper potential lies in enabling verifiability and auditability of training outcomes on-chain, thus turning suspicion of malicious behavior into evidence-based adjudication. Regarding the direction of verifiable federated learning, Zhou et al. [119] proposed the VDFChain framework, which achieved the correctness proof of the aggregated results on the blockchain through the committee mechanism and verifiable delay function; Keshavarzkalhori et al. [120] and Xing et al. [121] respectively explored the verification schemes of federated learning based on zk-SNARKs, demonstrating the feasibility of zero-knowledge proof in protecting privacy while verifying the compliance of model updates. Future research can focus on combining two complementary forms of verifiability. The first is cryptographic verification of aggregation correctness, which ensures that aggregators or committees cannot covertly manipulate aggregation results. Techniques such as polynomial commitment schemes provide mathematical guarantees for integrity, as shown by [120], which presents a verifiable committee-based aggregation approach. The second is compliance proofs for client-submitted updates, where zero-knowledge proofs (ZKPs) can enforce that each update satisfies predefined security or consistency constraints without revealing the original data. Representative approaches, including those outlined in [121,122], have demonstrated the feasibility of on-chain verifiable federated training via ZKPs. However, the verification carried out entirely on the blockchain would incur extremely high computational and storage costs.

To address the scalability challenges inherent in full on-chain execution, a promising research trajectory involves the development of hybrid paradigms that synergize off-chain evaluation with on-chain proof submission. In such architectures, computationally intensive verification tasks are offloaded to off-chain environments, while only compact, non-repudiable proofs and final adjudication outcomes are committed to the blockchain. This separation of concerns strategy significantly reduces on-chain storage and execution overhead, enhancing system scalability without compromising the root of trust. By bridging off-chain efficiency with on-chain transparency, these hybrid models offer a practical pathway for deploying robust, verifiable federated learning systems at scale.

7.3. Co-Design of Consensus Mechanisms and Training Protocols

Currently, BC-FL systems face dual bottlenecks when advancing toward large-scale deployment. On one hand, the latency of consensus protocols significantly slows down the overall training cycle. On the other hand, the limited on-chain throughput struggles to accommodate the high-frequency gradient updates from a large number of clients. To address this dilemma, future developments should move beyond treating the blockchain merely as a training log anchoring layer, and instead aim for a deep co-design of consensus mechanisms and federated training processes. A particularly promising direction is to transform the computational effort invested in consensus into meaningful contributions to FL model training. This can be achieved through proof of useful work (PoUW), which replaces traditional hash-based mining with tasks that serve actual learning objectives. As demonstrated in [50], embedding model training within the consensus process allows the system to reuse computing resources that would otherwise be wasted, while also reducing additional communication and verification overhead. The PoFL mechanism proposed by Qu et al. [123] is a representative work in this field. This mechanism replaces the hash calculation in the traditional PoW with meaningful federated learning training tasks, achieving the reutilization of computing resources. Zhao et al. [58] proposed a long-term contribution proof mechanism, which further links the consensus weight with the historical contributions of the client. This not only improves efficiency but also enhances fairness. Additionally, Zhao et al. [68] proposed a context-aware consensus algorithm, which effectively reduces unnecessary communication costs by dynamically adjusting the set of verification nodes. As a result, these approaches can overcome current efficiency bottlenecks without compromising the security of the system.

Another key trajectory lies in architectural reconfiguration that reduces reliance on a central aggregator by delegating aggregation and verification responsibilities to peer-to-peer networks (P2P) or by automating them through smart contracts. PoFL has preliminarily verified the feasibility of this approach, but how to further reduce the consensus delay and support asynchronous training while ensuring security remains an issue that needs to be addressed. This lightweight, on-chain coordination paradigm aims to enable aggregator-free or multi-aggregator collaborative topologies. Early feasibility has been demonstrated from different perspectives, such as P2P interactions and decentralized aggregation designs, as illustrated in [52,69]. However, as the system architecture becomes more decentralized, its sensitivity to network conditions increases significantly. Future research must therefore systematically investigate system behavior under realistic and adverse network conditions, including asynchronous participation, node dropout, retransmissions, and network partitioning. The primary challenges include ensuring consensus in model training and maintaining convergence guarantees under unreliable communication. These robustness metrics should be formally incorporated into the design principles and evaluation benchmarks that guide the next generation of decentralized federated learning protocols.

7.4. Evaluation Benchmarks for Realistic Threats and Practical Deployment

Future research must move beyond static defense paradigms and aim to establish a more forward-looking and system-level comprehensive evaluation benchmark. Current research has begun to focus on this direction. For instance, Shayan et al. [51] evaluated the Biscotti framework in an experiment for a 30% malicious node scenario, demonstrating the system’s robustness under attacks; Zhou et al. [119] also systematically evaluated the trade-off between verification overhead and model performance in the experimental part. However, these evaluations are still mostly limited to a single attack type or an ideal network environment, and thus are unable to reflect the complexity of real deployments. Specifically, security threat models should evolve from isolated snapshot-style attacks to long-term, adaptive, and dynamic adversarial interactions. During prolonged federated training, the system must not only handle concept drift in data distribution and the instability caused by frequent participant churn, but also withstand increasingly stealthy attacks as on-chain governance strategies evolve over time. As emphasized in [83], poisoning attacks are no longer confined to single-round gradient perturbations but have developed into multi-phase, strategy-driven long-term games. When adversaries combine such poisoning tactics with Sybil-based collusion, traditional single-round anomaly detection metrics based on statistical deviation can be easily circumvented. Moreover, Ref. [119] further reveals that cooperative identity attacks can disrupt the structural integrity of the training topology and trust relationships at a deeper level. Therefore, evaluation benchmarks must go beyond assessing robustness at the model parameter level and instead focus on holistically evaluating a system’s survivability and governance effectiveness under multi-round, non-independent and identically distributed (Non-IID) data conditions and collusive adversarial behavior.

In response to the aforementioned challenges, developing a standardized and unified evaluation framework has become an urgent priority. This framework should possess cross-architecture reproducibility capabilities and be able to support a wide range of blockchain infrastructures, from Proof of Authority (PoA) to hybrid committee-based chains. It should also be compatible with heterogeneous federated learning settings, including synchronous, asynchronous, and cross-domain deployments. The systematic efforts presented in [52,120] have already provided key reproducible components and experimental paradigms that can serve as a solid foundation in this direction. With respect to evaluation metrics, the research community should move beyond an exclusive focus on final model accuracy. A more comprehensive assessment framework should be adopted, incorporating additional dimensions such as on-chain storage cost, end-to-end training throughput, and convergence time under adversarial conditions. Looking further, it is recommended to integrate techniques such as hardware-in-the-loop simulation and edge computing testbeds. These methods can help capture the influence of real-world variables, including network latency variation, device heterogeneity, fluctuations in computational resources, and injection of real-time adversarial behaviors. Through this kind of full-stack evaluation approach, system deployability can be emphasized as a central concern that is equally important as algorithmic effectiveness, thereby facilitating a realistic assessment of the engineering feasibility of BC-FL systems under practical constraints.

To provide a structured overview of the promising research avenues identified in this survey, Table 5 summarizes four key future directions for BC-FL. For each direction, the table highlights the current gaps that limit existing approaches and the corresponding opportunities that warrant further investigation. As shown, the field needs to move beyond isolated defenses toward closed-loop mechanisms that jointly handle Sybil and poisoning attacks. It also requires efficient on-chain verifiable aggregation that balances transparency with computational cost. Deep co-design between consensus protocols and training pipelines remains an open challenge, and the lack of realistic, standardized evaluation benchmarks calls for multi-dimensional metrics that reflect real-world adversarial conditions. Together, these directions chart a path from laboratory prototypes to scalable, trustworthy decentralized learning systems.

Table 5. Summary of future directions and current gaps in BC-FL.

Future Direction	Current Gap	Key Opportunities
Closed-loop joint defense	Separate defenses; DP noise hides poisoning	Proof-of-long-term-contribution; unified identity-reputation-aggregation
Verifiable aggregation on-chain	High cost of full on-chain verification	ZKPs for compliance; hybrid off-chain eval + on-chain proof
Co-design of consensus & training	Consensus as bottleneck, not integrated with FL	PoUW/PoFL; context-aware consensus; aggregator-free P2P
Realistic evaluation benchmarks	Single attacks, ideal networks; no standard benchmarks	Multi-round adaptive attacks; cross-arch framework; beyond-accuracy metrics

8. Conclusions

This paper has presented a systematic survey and comprehensive overview of the latest advances in the BC-FL, with a particular focus on technical implementation pathways and developmental trends. Our analysis highlights that blockchain effectively enhances the security of federated learning systems by eliminating single points of failure and supporting robust reputation and incentive mechanisms, thereby addressing several core limitations of traditional federated learning. Beyond theoretical advances, BC-FL has begun to demonstrate practical value across several domains. In healthcare, frameworks like BCFTL [46] and BPFL [47] enable secure multi-institutional collaboration for tasks such as Alzheimer’s diagnosis without centralizing sensitive patient data. In IoT and edge computing, solutions such as InFEDge [48] and lightweight architectures [97] address resource constraints by combining hierarchical FL with on-chain incentives. In vehicular networks, systems like CDFFL [49] support real-time collaborative learning under Byzantine threats. These emerging applications highlight the transition of BC-FL from conceptual research to deployment-driven development.

Despite these advantages, our comparative analysis reveals that the BC-FL architecture is still in a nascent stage. While blockchain introduces new opportunities for secure collaboration, it also imposes practical challenges regarding efficiency, storage overhead, and system scalability. We critically examined key technical components such as decentralized architecture design, consensus protocols, and privacy-preserving mechanisms, and found that substantial hurdles persist, particularly in balancing privacy protection with smart contract execution efficiency. Ultimately, this study aims to serve as a foundational reference for researchers and practitioners, fostering further exploration and innovation in this promising interdisciplinary domain.