Trustworthy Visual Privacy Auditing with Causal Governance and Resilient Federated Protection for NIST AI Risk Management Framework

Abstract

Our previous visual privacy framework leveraging Graph Convolutional Networks (GCNs) and Federated Learning (FL) has been shown to achieve state-of-the-art (SOTA) predictive performance. However, it neglects the systemic requirements of the National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF). To address this critical gap, this paper proposes the Trustworthy Visual Privacy Auditing (TVPA) system, which transitions conventional static detection models into a dynamic and secure governance ecosystem. We first establish system resilience against adversarial threats by proposing an active auditing mechanism called Resilient Federated Protection (RFP) to embed unique model parameter watermarks within client-side updates. The RFP mechanism enables the federated aggregator to verify node legitimacy and automatically isolate malicious clients attempting poisoning attacks. Then, to ensure strict accountability, we design an immutable audit log mechanism in the RFP mechanism that utilizes a Cryptographic Hash Chain (CHC) to record and verify the provenance of every model update, creating a transparent chain of custody. Furthermore, the prediction mechanism is enhanced by Causal Governance (CG) that integrates causal inference to provide counterfactual reasoning for explaining the root causes of privacy risks rather than merely flagging associations. Experiments on the VISPR dataset demonstrate that our TVPA system can synthesize high-performance recognition with robust security, auditability, and causal explainability to provide trustworthy AI governance.

1. Introduction

The rapid popularization of artificial intelligence (AI) has transitioned these systems from mere predictive tools to central components in human decision-making and institutional governance [1,2]. However, this has also created a crisis of trust regarding the accuracy of AI’s decisions. The emergence of Generative AI models has significantly exacerbated this crisis, as these technologies can be repurposed as ThreatGPT [3] to facilitate various malicious activities. Systemic risks have intensified through techniques such as jailbreaking and prompt injection. Exploiting these vulnerabilities, malicious clients systematically circumvent established ethical and security constraints. Such circumvention accelerates the automation of complex cyberattacks, encompassing highly personalized spear-phishing and detection-evading polymorphic malware. Ultimately, these advanced threats critically compromise data integrity and user privacy. Distrust is further deepened by the phenomenon of model hallucinations. In this, inaccurate or entirely fabricated information is presented as fact, alongside growing concerns over unauthorized data breaches. In response to these trust and privacy issues, both the U.S. National Institute of Standards and Technology (NIST) and the European Union (EU) have proposed corresponding regulations to manage these risks [4,5]. NIST has launched an Artificial Intelligence Risk Management Framework (AI RMF) [5], which states that model performance alone is insufficient to address risk.

According to the NIST AI RMF, a truly robust system must be “trustworthy,” characterized not only by accuracy but also by security, resilience, accountability, transparency, and explainability. This shift necessitates a transition from static privacy detection to dynamic, trustworthy privacy auditing. In this paper, a Trustworthy Visual Privacy Auditing (TVPA) system is proposed to align with the NIST AI RMF’s seven principles for trustworthy AI as follows: 1. Valid and Reliable; 2. Safe; 3. Secure and Resilient; 4. Accountable and Transparent; 5. Explainable and Interpretable; 6. Privacy-Enhanced; 7. Fair.

Our previous work [6] has proposed a framework for dynamic visual privacy governance, which uses Graph Convolutional Networks (GCNs) [7] to model the correlations between privacy attributes (e.g., the semantic link between “face” and “ID card”). Additionally, we also apply Federated Learning (FL) [8] to personalize user preferences without centralizing sensitive data. While that system achieved state-of-the-art (SOTA) predictive performance on the VISPR dataset, it primarily focuses on the “effectiveness” and “privacy enhancement” aspects of the NIST AI RMF. We suffer from three critical points regarding trustworthiness and systemic risk as follows.

• Vulnerability to Adversarial Threats: Our previous framework relied on a standard FL architecture without active auditing mechanisms. Consequently, the system cannot verify node legitimacy, leaving the global model vulnerable to poisoning attacks [9,10] where malicious clients inject corrupted updates to degrade overall performance.
• Lack of Accountability and Provenance: The absence of an immutable audit log mechanism in our previous framework disrupts the chain of custody [11]. Consequently, precluding the precise attribution of model modifications or adversarial errors to individual participants.
• Lack of Causality: Legacy models cannot explain the root causes of privacy risks. Specifically, these models fail to isolate whether a detected risk originates inherently from the sensitive object or is heavily influenced by the surrounding context.

To bridge the gap between our previous framework and the NIST AI RMF, we propose the TVPA system in this paper. It transforms our previous framework into a secure and explainable governance ecosystem. Table 1 summarizes how our TVPA system components map to the NIST AI RMF principles. Our main contributions are listed as follows.

• To protect distributed systems from poisoning attacks, we propose the Resilient Federated Protection (RFP) mechanism. It integrates a white-box watermarking system into the global model’s normalization layers. By actively verifying node legitimacy at the central server, the RFP mechanism automatically evicts malicious clients. This proactive architecture ensures tamper resistance and systemic resilience, strictly complying with the NIST AI RMF.
• To resolve chain of custody vulnerabilities in decentralized environments, we implement an audit log mechanism based on Cryptographic Hash Chains (CHC). The CHC audit log generates a tamper-evident, time-stamped record for every model update and policy modification. The system strictly fulfills the accountability requirements for post-incident forensic analysis.
• To solve the black box of machine learning [12], we propose the Causal Governance (CG) mechanism. Utilizing counterfactual reasoning, the CG mechanism isolates the true causal drivers of privacy risks from spurious statistical correlations. This approach explicitly differentiates whether a detected risk originates inherently from a sensitive attribute or is driven by contextual variables.

Table 1. Functional comparison between our previous framework and the proposed TVPA system components based on the NIST AI RMF principles.

The NIST AI RMF Principles	Our Previous Framework	The Proposed TVPA System Components
1. Valid and Reliable	GCN-based detection	GCN with Active auditing
2. Safe	Passive monitoring	Active node legitimacy check
3. Secure and Resilient	Vulnerable to poisoning	RFP (White-box Watermarking)
4. Accountable and Transparent	Lack of audit trails	CHC-based Immutable Audit Log
5. Explainable and Interpretable	Statistical correlation	CG via Structural Causal Models (SCM)
6. Privacy-Enhanced	Standard FL	FL with cryptographic auditing
7. Fair	RL-based personalization	Personalization via Federated Learning

Table 1. Functional comparison between our previous framework and the proposed TVPA system components based on the NIST AI RMF principles.

The NIST AI RMF Principles	Our Previous Framework	The Proposed TVPA System Components
1. Valid and Reliable	GCN-based detection	GCN with Active auditing
2. Safe	Passive monitoring	Active node legitimacy check
3. Secure and Resilient	Vulnerable to poisoning	RFP (White-box Watermarking)
4. Accountable and Transparent	Lack of audit trails	CHC-based Immutable Audit Log
5. Explainable and Interpretable	Statistical correlation	CG via Structural Causal Models (SCM)
6. Privacy-Enhanced	Standard FL	FL with cryptographic auditing
7. Fair	RL-based personalization	Personalization via Federated Learning

2. Related Works

Our work is situated at the intersection of visual privacy governance, trustworthy FL, and explainable AI. This section reviews the literature on visual privacy prediction, active auditing mechanisms in FL, and the increasing demand for causal interpretability.

2.1. From Static Recognition to Dynamic Governance

Previous methods relied primarily on hand-crafted features or standard Convolutional Neural Network (CNN) architectures to identify sensitive attributes. However, privacy risks are inherently contextual and semantically interlinked. These risks frequently manifest through the co-occurrence of specific objects, such as a financial card appearing alongside a personal receipt.

To address these complexities, our previous work [6] introduced a SOTA framework that leverages GCN to explicitly model the relational structure and semantic dependencies between privacy labels. This architecture integrated a GCN-based classifier head with a modern ConvNeXt backbone to function as a semantic consistency regulator. By utilizing structural priorities derived from Positive Pointwise Mutual Information, the GCN effectively suppresses semantically implausible predictions. Simultaneously, it amplifies logically coherent attribute combinations, thereby refining the initial high-recall features extracted by CNN. Furthermore, to accommodate the deeply personal and dynamic nature of privacy boundaries, the framework incorporated FL with Reinforcement Learning (RL) [13]. This integration enables secure, on-device personalization through a continuous feedback loop between a Deep Q-Network (DQN) agent and the user.

This prior framework established a superior performance baseline on the VISPR dataset. Compared to traditional attention mechanisms, it achieved a 6% increase in mean Average Precision (mAP) and a 10% improvement in the Overall F1-score. Beyond these quantitative gains, it transitioned visual privacy assessment into a user-centric governance paradigm. Localized training enabled highly personalized recommendations while maintaining robust data protection. However, this previous approach prioritized predictive accuracy and data localization. Consequently, it exhibits significant vulnerabilities regarding systemic resilience against adversarial threats and lacks the causal explainability required by the NIST AI RMF.

2.2. Trustworthy Federated Learning via Active Model Watermarking

As privacy governance shifts to edge devices via FL, safeguarding system resilience against malicious clients is paramount. The federated aggregates local updates to construct a global model, inherently exposing the system to poisoning attacks. In these scenarios, adversaries inject corrupted gradients to degrade model efficacy and halt convergence [9,14].

Initial countermeasures relied on statistical aggregation techniques, such as Median or Krum [15], to identify and exclude outlier updates. However, these passive defenses frequently fail against sophisticated poisoning strategies. Malicious updates mimic benign data distributions or involve colluding actors. Consequently, the paradigm has shifted toward active auditing mechanisms. Model watermarking, originally designed for Intellectual Property protection [16,17,18], has emerged as a robust security solution to detect unauthorized model alterations.

In the context of black-box active auditing, Zheng et al. proposed WMDefense [15], which embeds a backdoor trigger into the global model. During aggregation, the server evaluates client updates against a predefined trigger set; benign updates retain high accuracy, whereas malicious updates exhibit significant watermark degradation, facilitating their removal. Advancing beyond black-box dependencies, Chen et al. [19] introduced FedMLC, a white-box watermarking approach optimized for resource-constrained IoT environments. Instead of relying on external trigger datasets, FedMLC directly embeds watermark signatures into the parameters of Normalization Layers using a regularization term. This precise embedding achieves malicious client identification, data leakage tracking, and copyright verification. While maintaining robustness against model pruning and quantization.

Although these studies demonstrated the security benefits of watermarking, existing methodologies mainly concentrate on the detection phase. The active auditing mechanism is incorporated into a more comprehensive auditing system by our framework. Specifically, we extend the robust white-box embedding mechanism of FedMLC not only to reject anomalous updates but also to trigger an immutable audit log mechanism.

2.3. Cryptographic Audit Trails and Tamper-Evident Logging

In distributed governance systems, securing an immutable audit log is essential. A tamper-evident log detects unauthorized modifications to historical records by validating cryptographic links between sequential entries. The core of this security is the cryptographic hash function, mainly the hash chain structure. This connects the current data block to the hash of the block before it, creating a tamper-resistant, immutable sequence. Blockchain tech has significantly enhanced this idea, using distributed consensus mechanisms and Merkle Hash Trees to establish trust across a decentralized system. Early studies showed that the CHC audit log provides an effective and efficient means for ensuring tamper-resistant records without the overhead of complex architectures.

For instance, Xenya and Quist-Aphetsi [20] utilized the SHA-256 algorithm to verify forensic account audits. Their research confirmed that timestamped, hashed records effectively prevent unauthorized alterations to financial logs, demonstrating the validity of sequential cryptographic methods. To address trust deficits in centralized storage, Sumathi et al. [21] proposed a blockchain-based system to verify data integrity. It highlights that distributed ledgers provide a transparent, tamper-resistant history of data transactions against malicious providers. Similarly, Li et al. [22] introduced a public blockchain auditing framework that ensures non-repudiation for both data owners and cloud providers during third-party verification. To accelerate this verification in large-scale systems, Gangadharaiah and Shrinivasacharya [23] integrated Merkle Hash Trees with a hybrid AES-ECC cryptosystem, proving that hierarchical hash structures significantly enhance auditing efficiency while maintaining robust security.

In our audit log mechanism, we generate an immutable record of all governance decisions. This architecture ensures that every acceptance or rejection of a client model is cryptographically verifiable. Consequently, the CHC audit log delivers a rigorous, tamper-evident audit trail while bypassing the heavy computational overhead associated with full-scale blockchain deployments.

2.4. Causal Inference for Robust Representation Learning

Causal Inference Basics is a traditional statistical learning center on identifying associations or correlations in data by modeling conditional probability $P\left(Y\right|X)$. However, correlation does not imply causation. A model that only looks at links might capture spurious correlations caused by confounding factors instead of the true causal effects. Judea Pearl [24] formalizes this distinction with the SCM, which uses the Ladder of Causation to distinguish between observation (association), manipulation (intervention), and counterfactual reasoning. Central to this paradigm is $do$-calculus, enabling the isolation of authentic causal relationships by neutralizing the influence of external confounding variables.

The integration of causal inference into machine learning has emerged as a pivotal strategy for addressing spurious correlations. Deep learning models frequently rely on dataset biases or contextual shortcuts rather than isolating essential causal attributes. For instance, a model could misclassify an image based on the background instead of the object. Causal interventions systematically sever these non-causal pathways, compelling the model to learn invariant features that generalize robustly across diverse environments.

Furthermore, causal inference provides a robust framework for addressing the long-tailed distribution problem, which frequently occurs distinguishing sensitive personal data from complex visual backgrounds. In these cases, the training data introduces a bias where the model depends on majority class frequencies instead of distinguishing intrinsic attributes. To rectify this vulnerability, advanced methodologies such as the Momentum Causal Effect (MCE) framework by Tang et al. [25] are used. It uses counterfactual thinking to analyze the causal impact of statistical co-occurrence and suppress it from the overall result, which removes the bias. Similarly, causal interventions have been successfully applied in image retrieval [26] to ensure visual similarity separate from influence of statistical co-occurrence patterns. Our TVPA system mainly utilizes GCNs to model label co-occurrences as a structural starting point. Integrating these causal intervention strategies into the CG mechanism represents a significant direction for future work to enhance system reliability and ensure fairness when navigating highly imbalanced data distributions.

3. Proposed Methods

Our TVPA system is structured around three main components that follow the NIST AI RMF. As shown in Figure 1, a watermarked ConvNeXt-GCN pipeline for secure and accurate recognition, the CHC audit log for non-repudiable auditing, and the FL framework for personalized governance.

3.1. Valid, Reliable, and Privacy-Enhanced Recognition

According to the NIST AI RMF, a trustworthy system must fundamentally ensure Principle 1 and Principle 6. To achieve these statutory objectives, the TVPA system utilizes a ConvNeXt backbone [6] to extract high-fidelity visual features. Given an input image X, the backbone extracts a feature representation $Z=\varnothing \left(X\right)$. To capture the semantic dependencies between privacy attributes (e.g., the high correlation between “face” and “passport”), we utilize a GCN head. We construct a correlation graph $G=(V, E)$, where nodes $V$ represent the $C$ privacy attributes. The propagation rule for the GCN layer is defined as:

$$H^{(l+1)}=\sigma (\widehat{A}{H}^{\left(l\right)}{W}^{\left(l\right)})$$

(1)

where $H^{\left(l\right)}$ is the feature matrix of the layer $l$, $W^{\left(l\right)}$ is the learnable weight matrix, $\sigma$ is the non-linear activation function, and $\widehat{A}$ is the normalized adjacency matrix. This graph propagation mechanism explicitly enforces semantic consistency across predictions.

More importantly, both feature extraction and graph propagation execute entirely on the client side within an FL paradigm to fulfill Principle 6. This decentralized architecture enforces strict data minimization; raw images remain localized on the user’s device, while only sanitized model updates are transmitted to the central server.

3.2. Safe, Secure, and Resilient Active Auditing

Regular FL can be attacked through poisoning [27], wherein malicious clients inject corrupted gradients to compromise the global model. To ensure the system is safe, we propose the RFP mechanism, which employs white-box model watermarking for active auditing. Rather than relying on passive data filtration, the central server embeds a cryptographic signature directly into the global model’s parameters, establishing a robust verification protocol. A trustworthy system must actively audit against adversarial threats to fulfill Principle 2 and Principle 3 of the NIST AI RMF.

Specifically, the RFP mechanism leverages the scale parameters $\left(\gamma \right)$ of the Batch Normalization (BN) layers for watermark embedding. These parameters exhibit high sensitivity to data distribution shifts [28,29,30,31] while maintaining resilience against standard compression techniques. Algorithm 1 illustrates the operation of the active auditing mechanism. Let $\theta \in {\mathbb{R}}^N$ denote the flattened vector of all BN layer parameters. The server generates a unique binary signature $S\in {\{-1, 1\}}^K$, where $K$ represents the watermark length (e.g., 256 bits). During local training, the standard objective function is augmented with a watermark regularization term $\left(L_{reg}\right)$. This term enforces alignment between the signs of selected model parameters and the target signature $S$. The total loss function $L_{total}$ is formulated as:

$$L_{total}=L_{task}\left(y,\widehat{y}\right)+\lambda \sum _{k=1}^{K}ReLU(\delta -S_K\times {\theta }_{idx\left(k\right)})$$

(2)

where $L_{task}$ is the multi-label classification loss (BCEWithLogitsLoss), $\lambda$ controls the penalty strength, $S_K$ is the $k$-th bit of the target signature, ${\theta }_{idx\left(k\right)}$ is the model parameter mapped to the $k$-th bit. The margin $\delta$ enforces a minimum distance from zero, securely encoding the watermark sign within the RFP mechanism.

This regularization essentially penalizes the model whenever the sign of a parameter ${\theta }_{idx\left(k\right)}$ disagrees with the watermark bit $S_K$. During the federated aggregation phase, the server calculates the Watermark Detection Rate (WDR) to verify each client’s update:

$$WDR={\displaystyle \frac{1}{K}}\sum _{k=1}^K\mathsf{{\rm I}}(sign\left({\theta }_{idx\left(k\right)}^{client}\right)=S_K)$$

(3)

Unlike passive auditing, which focuses on retrospective forensic analysis, active auditing acts as a preemptive gatekeeper. The server evaluates the WDR of every client update before model aggregation occurs. By enforcing a strict verification threshold (e.g., 95%), the RFP mechanism automatically evicts compromised nodes and integrates only legitimate updates. This proactive auditing neutralizes malicious gradients at the entry point, fulfilling Principle 3 of the NIST AI RMF [5].

Algorithm 1. Active Auditing Mechanism.
$\mathbf{Require}\mathbf{:} \mathrm{Global} \mathrm{model} \mathrm{parameters} {\theta }_G,$ $\mathrm{Signature} \mathrm{key} {S=\{S}_1,\dots , S_K\}$ $\mathrm{where} S_K\in \{-\mathrm{1,1}\},$ $\mathrm{Target} \mathrm{layers} L_{BN},$  $\mathrm{Regularization} \mathrm{strength} \lambda ,$  $\mathrm{Margin} \delta ,$  $\mathrm{Detection} \mathrm{threshold} \tau ,$  $\mathrm{Client} \mathrm{dataset} D$
$\mathbf{Ensure}\mathbf{:} \mathrm{Verified} \mathrm{local} \mathrm{update} {\theta }_{new}$  $\mathrm{or} \mathrm{Rejection} \mathrm{signal} \varnothing$
1:	$\mathrm{Initialize} \mathrm{local} \mathrm{model} {\theta }_L\leftarrow {\theta }_G$
2:	$\mathbf{for} \mathrm{each} \mathrm{training} \mathrm{batch} \left\{x,y\right\}\in D$  do
3:	$\mathrm{Compute} \mathrm{task} \mathrm{loss} L_{task}\leftarrow CrossEntropy(f\left(x;{\theta }_L\right),y)$
4:	$L_{wm}\leftarrow 0$
5:	$\mathbf{for} k=1 to K$  do
6:	$\mathrm{Retrieve} \mathrm{parameter} \mathrm{chunk} C_K$  $\mathrm{from} {\theta }_L$  $\mathrm{corresponding} \mathrm{to} \mathrm{bit} S_K$
7:	${penalty}_k\leftarrow RELU(\delta -S_K\times C_K)$ // Enforce sign alignment
8:	$L_{wm}\leftarrow L_{wm}+mean\left({penalty}_k\right)$
9:	end for
10:	$L_{tatal}\leftarrow L_{task}+\lambda \times L_{wm}$
11:	$\mathrm{Update} {\theta }_L$ $\mathrm{by} \mathrm{minimizing} L_{tatal}$ via gradient descent
12:	end for
13:	$\mathrm{Send} {\theta }_L$ to Server for Verification
14:	$\mathrm{Initialize} \mathrm{match} \mathrm{count} M\leftarrow 0$
15:	$\mathbf{for} k=1 to K$  do
16:	${\mu }_k\leftarrow mean(C_K\in {\theta }_L)$ // Calculate mean of the chunk
17:	$\mathbf{if} sign\left({\mu }_k\right)==S_K$  then
18:	$M\leftarrow M+1$ // Count correct bits
19:	end if
20:	end for
21:	$\mathrm{WDR}\leftarrow M/K$ // Calculate Watermark Detection Rate
22:	$\mathbf{if} \mathrm{WDR}<\tau$  then
23:	$\mathbf{return} \varnothing$ // Reject malicious update
24:	else
25:	$\mathbf{return} {\theta }_L$
26:	end if

3.3. Accountable and Transparent Audit Trails

In decentralized federated environments, establishing a robust chain of custody is critical for post-incident forensic analysis [32,33]. Since standard system logs are susceptible to unauthorized modifications, they cannot provide non-repudiable accountability. To satisfy Principle 4 of the NIST AI RMF, we propose an immutable audit log mechanism based on the CHC audit log to cryptographically record temporal model modifications.

The audit log mechanism is structured as a sequential cryptographic ledger. In our TVPA system, each model update event $E_t$ at time $t$ captures the Timestamp $\left(T_t\right)$, the Node ID $\left(N_t\right)$, the Event Type (e.g., “Local Update” or “Aggregation”), and a hash of the model parameters $\left(h\right({\theta }_t\left)\right)$. To ensure immutability, these records are securely chained using a hashing protocol.

$$H_t=SHA-256(H_{t-1}\parallel T_t\parallel N_t\parallel {Type}_t\parallel h({\theta }_t\left)\right)$$

(4)

where $H_t$ is the current Audit Hash, $H_{t-1}$ is the Audit Hash of the previous record and creating the cryptographic link, $\parallel$ denotes the string concatenation operation, and $h\left({\theta }_t\right)$ is the SHA-256 hash of the local gradient vector.

The CHC audit log ensures the avalanche effect; any malicious attempt to alter a past record $H_{t-k}$ (e.g., to hide a poisoning attempt) alters its respective hash, thereby invalidating all subsequent hashes $H_{t-k+1}$. Consequently, the CHC audit log delivers a tamper-evident, transparent ledger that enables auditors to trace the precise provenance of every model iteration, fully satisfying the accountability requirements of Principle 4 in the NIST AI RMF.

3.4. Explainable, Interpretable, and Fair Governance

The final component of the TVPA system governs the interaction between the algorithmic framework and the human user. This module is designed to impartially accommodate highly individualized privacy preferences while ensuring transparent decision-making.

3.4.1. Causal Explanations via Counterfactual Reasoning

While conventional deep learning models, including our previous framework, are expert at identifying statistical associations. They frequently lack the capacity to elucidate the fundamental causal mechanisms underlying privacy risks [34,35,36]. To address this limitation, we propose the CG mechanism based on SCM [37,38]. $X$ denotes the input visual features. $O$ represents the target sensitive object. $B$ signifies the surrounding background context. $Y$ indicates the final privacy risk prediction. The underlying causal graph is structurally defined by the GCN adjacency matrix. The nodes represent individual privacy attributes. The edges represent the structural causal dependencies learned during training.

Standard predictive models merely estimate the conditional probability $P\left(Y\right|X)$. Conversely, our objective is to determine whether $O$ inherently causes $Y$ independent of $B$. To operationalize this, we define the structural intervention $do(O=0)$. This operation mathematically severs the incoming edges to the object node $O$ within the adjacency matrix, forcing its state to null. By comparing the factual prediction $P\left(Y\right|X)$ with the interventional prediction $P\left(Y\right|do(O=0), B)$, we compute the TCE leveraging do-calculus [39]. This differential explicitly quantifies the isolated contribution of the sensitive object $O$ to the overall risk $Y$, strictly controlling for the confounding influence of the background context $B$.

$$TCE=\mathbb{E}\left([Y\right|do\left(O=1\right),-\mathbb{E}\left[Y\right|do\left(O=0\right),B\left]\right)$$

(5)

The CG mechanism estimates counterfactual scenarios by simulating the impact on the privacy risk score as if a specific sensitive attribute (e.g., a face) were visually ablated from the input image. The TVPA system conclusively identifies whether the identified attribute is the primary impact of the detected privacy risk. Consequently, the TVPA system evolves beyond merely flagging associations to provide actionable, root-cause explanations, satisfying Principle 5 and assisting users in making CG decisions.

3.4.2. Federated Reinforcement Learning for Personalized Fairness

Privacy boundaries are inherently subjective and highly individualized [40]. To accommodate this diversity, we integrate an FL architecture [13]. A DQN agent deployed on the edge device operates as a localized privacy manager. It utilizes the risk probability vector (State $s$, from GCN) to determine a masking approach ($a$). The agent receives interactive feedback from the user on whether they confirm or reject a specific masking suggestion. The system learns what each user prefers by training on their device and sharing what they learn via FL.

4. Experimental Section

In this section, we utilize the VISPR (Visual Privacy) dataset, which is a benchmark with 22,167 images labeled with 68 privacy attributes [6,41]. This dataset is hard to work with because it has a long-tailed distribution and semantic overlap.

Imbalance Analysis: Data preprocessing revealed an extreme class imbalance within the VISPR dataset. For instance, the labels like “a4_gender” and “a16_race” appear in over 45% of the samples. Conversely, critical privacy attributes, including “a7_fingerprint” and “a21_full_nudity”, account for less than 0.3% of the data. Consequently, the TVPA system must exceed general accuracy benchmarks; it is imperative to prioritize the detection of rare, high-risk attributes.

4.1. Valid, Reliable, and Privacy-Enhanced Recognition Evaluation

Satisfying Principle 1 and Principle 6 necessitates high predictive accuracy on decentralized edge devices despite heterogeneous data distributions. To validate the reliability of our federated approach, we examined the model performance metrics that changed over the course of the decentralized training process. Figure 2 shows that the Recall@N metric improves consistently across successive communication rounds. This enhancement signifies the system’s increasing proficiency in reliably retrieving high-risk privacy attributes, thereby minimizing critical false negatives. This trajectory demonstrates the global FL agent’s capacity to optimize client selection effectively. Consequently, the federated architecture guarantees data localization and privacy without sacrificing task dependability.

Furthermore,

Table 2. Performance comparison of embedding capacity.

Backbone	Indices Layer	Embedding Capacity (Bits)	mAP (%)	OP	OR	OF1
[6]	Original ConvNeXt + GCN		52.88	0.713	0.873	0.770
	25%	Chunk size	50.19	0.698	0.816	0.753
	25%	64	50.31	0.704	0.822	0.758
	25%	256	50.21	0.703	0.822	0.758

assesses baseline recognition validity by comparing the mAP across various watermark embedding capacities. Our previous ConvNeXt-GCN baseline achieved 52.88% mAP. Integrating a 64-bit chunk-based watermark into 25% of the layers yields a highly stable mAP of 50.31%. This minimal performance trade-off enables the system to enforce robust security governance and reliable visual privacy detection within a decentralized environment.

4.2. Safe, Secure, and Resilient Active Auditing Evaluation

Prior to evaluation, we explicitly define the system threat model. We assume adversaries possess white-box access to their local model parameters and local training data. Their objective is to execute poisoning or fine-tuning attacks to degrade global model utility or eradicate the embedded watermark. We assume the central server and the federated aggregation protocol remain secure and uncompromised.

Securing shared models in FL presents significant challenges. There are always malicious clients attempting parameter manipulation to compromise the global model. To address these vulnerabilities, we integrate the FedMLC (Federated Machine Learning Copyright) mechanism into the ConvNeXt-Base framework. This integration structurally modifies the network to embed a robust cryptographic watermark, establishing undeniable provenance and tamper-evident security. We subsequently evaluate the system’s defensive efficacy against diverse active adversarial attacks. This comprehensive assessment verifies FedMLC’s capacity to guarantee model reliability and systemic fairness in decentralized environments.

4.2.1. Implementation of the FedMLC Strategy

Conventional watermarking methods frequently depend on “overfitting” the model to particular trigger set images, which is easily removed by fine-tuning. However, our system makes use of a Group Mean Strategy (Soft Constraint) that is directly incorporated into the model’s normalization layers (LayerNorm and GroupNorm) [42].

Embedded layer selection: The RFP mechanism targets the last block section of the ConvNeXt backbone, comprising the top 25% of its layers. Deeper Convolutional Neural Network (CNN) layers systematically extract high-level, semantic features critical to the core classification process [43,44]. Embedding the watermark within these terminal layers intertwines security with the fundamental decision-making architecture [30]. Consequently, malicious parameter manipulations altering classification outcomes inherently disrupt the embedded security signature. This structural interdependency transforms the watermark into a highly reliable sentinel against unauthorized modifications.

Group Mean Strategy: Strict parameter constraints significantly reduce the model’s ability to acquire new privacy attributes. To maintain utility, the TVPA system encodes 64 bits within selected layers, which are divided into parameter segments. The optimization process employs a Hinge Loss formulation:

$$L_{wm}=max(0,margin-mean\left(chunk\right)\times key)$$

(6)

where $L_{wm}$ denotes the watermark regularization loss for a specific group of parameters, margin is a pre-defined threshold that ensures the embedded signal is sufficiently robust against perturbations, $chunk$ represents the subset of model weights selected to encode a single bit, and $key\in \left\{-1, 1\right\}$ indicates the target watermark bit assigned to that group. This soft constraint approach adjusts the mean of each chunk to correspond with its assigned sign-based key. By allowing this flexibility, it reduces potential negative effects on mAP while maintaining a relatively high WDR.

We conducted an empirical validation of this security configuration by employing a composite loss function. This function integrates BCEWithLogitsLoss to address privacy detection alongside the previously described hinge-based penalty term, defined as $max(0, 0.05-{\mu }_{w,i}\times k_i)$ for watermark retention. As shown in

Table 3. Comparison of robustness and fidelity under fine-tuning attacks with different embedding capacities.

Embedding Scheme (Bits)	OF1	Begin WDR (%)	Under Attack WDR (%)
Chunk-based	0.678	84.13	56.76
64	0.682	84.54	84.30
256	0.682	86.19	84.75

, averaging parameter groups provides superior WDR stability during adversarial FL updates than normalized alternatives. This averaging mechanism reduces the impact of fluctuations in RL policies on watermark states, thereby integrating visual privacy detection with a more stable form of intellectual property protection.

4.2.2. Robustness Against Fine-Tuning Attacks

To verify the tamper resistance of the TVPA system, we evaluated the sentinel mechanism’s efficacy in identifying malicious clients. A critical requirement for this auditing mechanism is structural sensitivity. The embedded watermark must exhibit sufficient robustness to withstand benign local training yet remain fragile enough to degrade significantly under adversarial parameter manipulations, such as poisoning attacks. Table 3 compares the robustness and fidelity of three embedding configurations under fine-tuning attacks.

High-Capacity Embeddings: The 64-bit and 256-bit schemes proved excessively robust. Their WDR remained high (approximately 87%) despite active adversarial modifications. While suitable for post-incident copyright verification, this excessive persistence precludes real-time anomaly detection. Consequently, these high-capacity configurations failed to distinguish between benign and malicious model updates, resulting in critical false negatives.

Chunk-based Sentinel: Conversely, the chunk-based architecture exhibited the optimal semi-fragile characteristics necessary for an active sentinel feature. Under benign conditions, it maintained a robust WDR of 84.13%. However, under adversarial manipulation, the WDR dropped precipitously to 56.76%. This substantial quantitative margin establishes a definitive threshold for anomaly detection.

Therefore, the TVPA system deploys the chunk-based configuration, prioritizing tamper-evident security over long-term watermark persistence. Any unauthorized manipulation of the global model immediately triggers a sentinel violation, strictly fulfilling Principle 3 of the NIST AI RMF. Figure 3 and Figure 4 show the dynamic evaluation of client trustworthiness across different behavioral personas and presents the analysis of total system rewards and client participation levels.

Within federated architectures, malicious poisoning attempts function essentially as adversarial fine-tuning attacks. Evaluating defensive robustness requires assessing threat mitigation under extreme data heterogeneity, where attacks remain heavily camouflaged. Highly skewed Non-IID data distributions compel benign clients to generate divergent local gradients deviating significantly from the global objective. This variance induces a masking effect, obscuring the distinction between malicious fine-tuning and benign client drift. To evaluate our system’s robustness against such camouflaged fine-tuning attacks, we compared its performance across three environments: IID, moderate Non-IID ($\alpha =0.5$), and extreme Non-IID ($\alpha =0.05$). In all scenarios, a malicious Client-5 continuously executed adversarial fine-tuning attacks.

As shown in Figure 5, the framework demonstrates exceptional resilience. Under IID conditions, the system seamlessly isolates malicious updates from uniform benign gradients, rapidly rejecting the attacker and converging to a high Recall@N ($\approx$0.70). However, in the extreme Non-IID setting ($\alpha =0.05$) masks the attack within divergent benign updates, severely suppressing early performance (Recall@N $\approx$ 0.25) and inducing a temporary vulnerability to privacy leakage. Despite this extreme stress, our sentinel mechanism proved highly robust. It successfully disentangled the adversarial fine-tuning gradients from the benign-but-skewed updates without causing a system collapse. By iteratively rejecting the malicious Client-5 while carefully aggregating the fragmented benign knowledge, the system orchestrated a remarkable recovery around Round 25. Ultimately, the global model trained under extreme $\alpha =0.05$ successfully neutralized the fine-tuning attack and matched the optimal IID performance ceiling (Recall@N $\approx$ 0.70). The results show validating the framework’s autonomous recovery and continuous privacy-preserving reliability.

4.2.3. Resilience Against Malicious Gradient Attacks

To evaluate the resilience of the TVPA system and the effectiveness of the sentinel mechanism, we simulated a malicious client scenario employing four distinct gradient manipulation strategies: Gradient Flip Attack, Targeted Watermark Removal, Random Noise Injection, and Gradient Scaling Attack. These experiments aim to verify the system’s ability to maintain data integrity and non-repudiation when an adversary possesses white-box access to the watermarked layers. The multi-metric evaluation is shown in Figure 6, the relationship between the WDR and the mAP demonstrates a consistent and expected utility-security trade-off. The results are analyzed as follows.

Intrinsic Resistance: The system demonstrated complete immunity to Gradient Flip Attack and Gradient Scaling Attack, maintaining a 100% WDR and a stable mAP of approximately 51.14%. This resilience is inherently reasonable due to our sign-based embedding strategy; since the watermark is tied to the polarity (positive/negative) of parameter group means rather than absolute magnitudes, directional scaling or simple gradient negation without crossing bit-flipping boundaries fails to compromise the integrity of the security signature.

Adversarial Unlearning Cost: The Targeted Watermark Removal represents the most stringent test, where the adversary incorporates an adversarial regularization term ($L_{total}=L_{task}-\lambda \times L_{wm}$) to actively unlearn the watermark. While the WDR successfully decayed to 75.31% after 20 iterations, this removal was accompanied by a significant degradation in model utility, with the mAP dropping to 39.51%. This synchronized decline confirms that the watermark is deeply integrated into the high-dimensional parameter space, making targeted removal a computationally prohibitive task where the adversary cannot suppress the watermark without severely damaging the model’s primary task performance.

Stochastic Perturbation Limits: In the Random Noise Injection scenario, Gaussian noise across various scales ($\sigma \in [0.001,1.0]$) was injected into the target weights. The results show that while the WDR remains robust at 100% due to sign-stability, the mAP collapses to 10.46% at higher noise levels $(\sigma =1.0)$. This outcome validates the embedding strategy; the perturbation intensity required to disrupt the sign-based watermark substantially exceeds the threshold, functionally paralyzing the neural network’s feature extraction capabilities.

In the context of digital forensics, a WDR exceeding 70% is statistically sufficient to establish ownership verification with high confidence. The slow decay and high utility cost observed in our experiments indicate that the security signature cannot be erased without rendering the copied model worthless. This robust persistence fulfills Principle 3 of the NIST AI RMF, ensuring the sentinel mechanism provides a reliable auditing trail even under intentional gradient-level manipulation.

While our evaluation demonstrates resilience against standard removal attempts, sophisticated adversaries might employ adaptive attacks. In such scenarios, an attacker dynamically scales their adversarial regularization term or utilizes advanced pattern-matching to systematically infer and bypass the static chunk-based sentinel. Although our current threshold mechanism successfully detects these anomalies before catastrophic forgetting occurs, evaluating the boundary of adaptive evasion presents an ongoing systemic challenge for static watermarking architectures.

4.3. Accountable and Transparent Audit Trails Evaluation

To ensure Principle 4 of the NIST AI RMF, our TVPA system must record all governance decisions, both accepting benign updates and rejecting malicious ones, where they are clear, permanent, and traceable. We propose the audit log mechanism based on the design in Section 3.3.

Cryptographic Chain Integrity Verification

To validate the structural integrity of the CHC audit log and the avalanche effect, we simulated a 40-round federated environment comprising four benign nodes and one malicious client. Employing the SHA-256 algorithm, each governance decision is cryptographically bound to its predecessor. Consequently, altering a specific log record ($E_t$) inherently necessitates altering the preceding sequence ($E_{0\dots t-1}$) to remain undetected. We conducted a post hoc forensic analysis on the generated audit trail, automatically recalculating the CHC audit log from the Genesis Block in Round 1 through the final transaction in Round 40.

Table 4. Forensic excerpt of the audit log mechanism confirming chain integrity.

Round	Client ID	Audit Score	Action	$\mathbf{Previous} \mathbf{Hash} ({\mathit{H}}_{\mathit{t}-1}$)	$\mathbf{Current} \mathbf{Hash} ({\mathit{H}}_{\mathit{t}}$)
1	Client-1 (Techie)	0.82	Accept	0000…0000 (Genesis)	4404…0780 ↓
	Client-2 (Social)	0.6037	Reject	4404…0780	027d…a44e ↓
	Client-3 (Family)	0.02	Reject	027d…a44e	728b…98d0 ↓
	Client-4 (Financial)	0.6342	Reject	728b…98d0	14e1…4949 ↓
	Client-5 (Malicious)	0.0612	Reject	14e1…4949	e3b7…fe0e ↓…

excerpts the critical transition phase of the initial round, capturing both benign and malicious updates. For conciseness, truncated hashes with downward arrows (“↓”) denote the cryptographic linkage transferring the current hash of transaction $t$ to the previous hash of transaction $t+1$.

As shown in Table 4, the Current Hash of Client-1 seamlessly becomes the Previous Hash for Client-2, preserving structural integrity. We ran our script to verify the entire chain, achieving a 100% success rate across all 200 transactions, confirming the absence of broken links or orphaned blocks. It provides mathematical consistency guarantees to ensure absolute non-repudiation of past governance actions. The malicious Client-5 exemplifies this protocol in practice. Operating below the initial safety threshold of 0.10, Client-5 registered an audit score of 0.0612, immediately triggering a malicious classification and update rejection. In real-world deployments, an adversary might attempt to deny this rejection. However, the “Reject” status is permanently encoded into the SHA-256 calculation (e.g., hash “e3b7…fe0e”). Any subsequent attempt to alter this status to “Accept” fundamentally modifies the hash, triggering the avalanche effect to invalidate the entire subsequent chain. This architectural rigidity proves the TVPA system delivers a fully transparent, verifiable, and tamper-proof governance record.

4.4. Explainable, Interpretable, and Fair Governance Evaluation

To verify the explainability of our TVPA system, we utilize a computational intervention pipeline to separate contextual correlations from actual privacy risks. Generating precise, context-sensitive explanations directly fulfills Principle 7, actively preventing the enforcement of biased, one-size-fits-all privacy governance policies.

4.4.1. Computational Causal Intervention Pipeline

To empirically demonstrate the transition from correlation-based auditing to causal inference, we design a computational causal intervention pipeline. Traditional associative models frequently conflate statistical co-occurrence with causation. This conflation leads to suboptimal or erroneous mitigation strategies. To overcome this limitation and provide a functional proof of concept, our system employs counterfactual analysis to isolate the true causal drivers of privacy risks from spurious correlations. For accurate object ablation, we utilize an automated intervention script incorporating the GraphCut algorithm. The experimental procedure is formulated as follows.

Area Definition: The system leverages bounding box coordinates predicted by the detection head to delineate the Region of Interest (ROI) for each image flagged with a specific privacy attribute (e.g., a31_passport).

Causal Intervention (Visual Ablation): To simulate the counterfactual scenario without introducing out-of-distribution artifacts, we apply a texture-synthesis inpainting technique. This structural intervention effectively eliminates the sensitive object to simulate the $do(Object=0)$ operation. Concurrently, it strictly preserves the natural statistics of the surrounding context, ensuring the background remains constant.

TCE Estimation: The inference engine processes the intervened image to calculate the Risk Score Delta. This metric represents the quantitative difference between the factual prediction and the post-intervention probability. This calculation evaluates the Total Causal Effect, definitively distinguishing authentic causal dependencies from mere statistical associations. We execute this counterfactual protocol on high-risk samples from the VISPR dataset to classify the source of model decisions. The empirical results presented in

Table 5. Empirical analysis of causal impact on privacy attributes.

Image ID	$\mathbf{Original} \mathbf{Risk} \left(\mathit{P}\right(\mathit{Y}\left|\mathit{X}\right)$)	Face Detection Drop	Risk Score Delta $\left(\mathit{P}\right(\mathit{Y}\left|\mathit{d}\mathit{o}\right(\mathit{F}\mathit{a}\mathit{c}\mathit{e}=0\left)\right)$)
2017_18209388	0.999	−95.58% (Success)	−0.02% (Negligible)
2017_80380458	0.975	−98.97% (Success)	−8.61% (Moderate)
2017_58091627	0.999	−98.13% (Success)	0.16% (Low)

show whether the true risk driver is the surrounding context or the object itself.

Table 5 shows that the CG mechanism successfully identifies and mitigates privacy risks that traditional associative models overlook. In sample 2017_18209388, a purely correlation-based system observes a high predictive confidence. Due to the high statistical co-occurrence of facial features and passports in the training distribution, an associative model would erroneously attribute the risk to the face attribute. Conversely, our counterfactual analysis reveals that despite a successful ablation of the facial features with a face detection drop of 95.58%, the overall risk score remains virtually unchanged with a negligible risk score delta of 0.02%. This result explicitly confirms that our framework leverages the surrounding context, including document borders and text layout, to infer privacy risks rather than relying on the spurious correlation of a single object.

4.4.2. Structural Modeling via Causal Graph Intervention

To further substantiate the CG mechanism and address the necessity of structural modeling, we conduct a Causal Graph Intervention within the GCN architecture. Figure 7 shows the quantitative results of the structural causal graph intervention. While visual ablation demonstrates causality at the input level, graph intervention directly isolates the structural dependencies learned by the model. We perform targeted graph cuts on the adjacency matrix of the GCN to simulate the counterfactual scenario of severed neural pathways. Specifically, we intervene on the edges connecting the target risk attribute (passport) to various candidate causes, including a spurious associative variable (face) and true contextual variables (Nationality and Birth Date). By manually zeroing out these specific edges, $do({Edge}_{cause\to effect}=0)$, we isolate and quantify the pure structural causal effect each attribute contributes to the final privacy risk prediction.

Severing the causal link from the facial feature to the passport risk ($do({Edge}_{face\to passport}=0)$) resulted in a negligible mean causal effect, with a predictive score drop of merely 0.000034. In stark contrast, interventions on true contextual pathways produced significantly larger score reductions. For instance, severing the structural links from the Nationality and Birth Date attributes resulted in score drops of 0.002119 and 0.002982, respectively. These reductions reflect a causal magnitude approximately 60 to 80 times exceeding the facial attribute’s impact.

It definitively demonstrates that the TVPA system does not passively rely on the superficial correlation between faces and identity documents. Instead, the framework structurally encodes and utilizes true contextual dependencies, ensuring that the mitigation strategies generated by the CG mechanism are both explainable and operationally reliable.

Figure 8 shows models make decisions using Occlusion Sensitivity heatmaps. When given an image marked as a passport risk, the model focuses on the face, as seen in the face heatmap. Concurrently, the passport heatmap reveals distributed activation across the document’s text and physical borders. This visual evidence corroborates why facial ablation yielded a negligible impact on the overall privacy risk score.

4.5. Overall System Evaluation

4.5.1. Comprehensive Performance and Security Comparison

As shown in

Table 6. Quantitative performance and security comparison between our previous framework and the proposed TVPA system.

Evaluation Metric	Our Previous Framework	The Proposed TVPA System	Improvement
Recognition mAP	52.88%	50.31%	Maintains high utility with security
Poisoning Detection (WDR)	N/A	>95.0%	Automated malicious node rejection
Audit Chain Integrity	N/A	100%	Full transparency and non-repudiation
Risk Attribution Accuracy	Statistical only	Causal Impact Score	Root-cause identification (e.g., 0.02% delta)
Resilience (Targeted Attack)	Vulnerable	74.7% WDR	Hardened ownership verification

N/A: not applicable or not available for comparison.

, while the TVPA system maintains a comparable recognition mAP to the previous framework, it introduces critical systemic safeguards. Specifically, TVPA transforms a passive detection tool into a resilient governance ecosystem capable of identifying over 95% of malicious updates. It provides 100% auditable proof of all governance decisions.

To evaluate the joint effectiveness of the unified framework, we analyze the end-to-end system pipeline. Table 6 demonstrates this continuous synergy. The feature extraction phase first maintains high operational utility with a 50.31% mAP. Subsequently, the RFP mechanism actively filters incoming client updates to achieve a >95.0% WDR. Every filtering decision generated by the RFP mechanism is immediately recorded by the CHC audit log, guaranteeing 100% chain integrity. Finally, the CG mechanism processes the secured model parameters to attribute the root cause of risks, yielding highly specific insights such as a 0.02% risk score delta for face ablation. This sequential flow from decentralized detection to auditable explanation validates the system-level synergy of the TVPA system.

4.5.2. Quantitative Analysis of Computational Overhead and Latency

All performance benchmarks were conducted on a desktop computer (ASUSTeK Computer Inc., Taipei, Taiwan) with the following specifications: Intel i5-9400F CPU, RTX 3060 12 GB GPU, and 32 GB RAM. To evaluate deployment feasibility on resource-constrained edge devices, we quantified the computational overhead and latency of the governance and federation layers. We benchmarked the isolated execution time of each architectural component over 100,000 iterations to ensure statistical stability. The local DQN agent’s personalized privacy prediction imposes a negligible +1.63% overhead on baseline inference, strictly preserving edge device efficiency. On the server side, calculating the WDR and securing the update via the CHC audit log takes a combined delay of only 1.786 ms per client update. Furthermore, the space required to store these records is highly predictable and minimal, taking up only about 64 bytes of hash data per entry, and embedding the white-box watermark directly into existing normalization layer parameters requires zero additional communication bandwidth payload. The granular latency measurements yielded the following results.

• Edge Baseline Inference: 13.335 ms/image.
• Edge Causal Governance (DQN): 0.218 ms.
• Server Active Audit Verification: 1.780 ms/update.
• Server Immutable Audit Log: 0.0058 ms/transaction.

Overall, the server-side governance operations introduce a combined delay of only 1.786 ms per client update. Crucially, embedding the white-box watermark directly into existing normalization layer parameters requires zero additional communication bandwidth payload. These empirical findings conclusively prove that the audit log and active audit mechanisms add robust security and non-repudiable accountability to high-performance computing environments without causing operational bottlenecks or slowing the system down.

5. Conclusions and Future Works

This paper introduced the TVPA system, bridging the critical gap between automated visual privacy detection and robust AI governance. By structurally embedding the seven principles of the NIST AI RMF into a decentralized architecture, our system transcends conventional, performance-centric models. Extensive empirical evaluations on the VISPR dataset validated the system’s comprehensive efficacy. The GCN-enhanced feature extraction achieved a stable mAP of 50.31% while preserving strict data localization. To ensure systemic security and accountability, the RFP mechanism neutralized adversarial poisoning attacks through active white-box watermarking. The CHC audit log established a 100% tamper-evident, non-repudiable audit trail. Furthermore, the integration of SCM and FL successfully disentangled spurious correlations from authentic privacy risks, delivering explainable and highly personalized governance strategies without imposing biased, one-size-fits-all policies.

Looking ahead, our primary focus centers on enhancing the framework across three pivotal dimensions to address emerging systemic challenges. First, to enhance decentralized accountability, we will transition the current centralized hash chain validator to a permissioned blockchain architecture. Distributing the cryptographic ledger systematically eliminates single points of failure, thereby cultivating paramount systemic trust. Second, regarding explainability, while current interventions successfully demonstrate proof-of-concept via single-object ablation, our primary focus involves integrating multi-object causal graphs. This advanced structural modeling explicitly disentangles complex confounding factors within densely populated visual environments. Finally, to proactively counter the adaptive evasion strategies identified in our security evaluation, our future work will focus on dynamic active auditing mechanisms. We will investigate dynamic watermark allocation tactics and advanced cryptographic protocols. These approaches aim to continuously shift the sentinel embedding locations to neutralize persistent gradient leakage threats. We will simultaneously preserve the ultra-low computational footprint mandated by resource-constrained edge devices.