Model Checking in Federated Learning-Based Smart Advertising

Abstract

As social networks continue to expand, smart advertising increasingly depends on machine learning to deliver personalized and effective advertisements. Federated Learning (FL) is a distributed learning paradigm that supports privacy-preserving advertising by training models locally while avoiding direct sharing of raw user data. However, ensuring the correctness, reliability, and operational robustness of FL-driven smart advertising systems remains a significant challenge, particularly in distributed and user-facing environments. In this study, we investigate the use of model checking as a formal verification technique for validating key properties of an FL-based smart advertising workflow in social networks. We combine a structured finite-state modeling approach with Linear Temporal Logic (LTL) specifications and model-checking tools to assess correctness, availability, and baseline privacy requirements. Using controlled simulation-based configurations, we show that, for a setup with 100 users and 20 edge servers, the system delivers advertisements to all users and the global model successfully processes 200 out of 200 requests. We further analyze verification overhead through detection-time measurements, observing an increase in average detection time from 10.05 s to 11.98 s as the number of users rises from 20 to 100. These results indicate that the proposed framework can provide practical assurance for FL-enabled smart advertising workflows, support more reliable deployment in distributed intelligent systems, and improve trustworthiness in real advertising applications.

1. Introduction

Model checking is a formal verification technique that systematically explores the state space of a system to determine whether specified properties hold under all reachable executions [1]. The approach requires (i) a formal model of the system, (ii) a specification of desired properties using temporal logic, and (iii) an automated verification engine that checks whether the model satisfies those properties. Widely used tools such as SPIN [2], NuSMV [3], and PRISM [4] support this process and have been successfully applied to hardware, software, and protocol verification. Their main strength lies in exhaustive analysis, which can reveal subtle design errors that may be missed by conventional testing. At the same time, model checking faces well-known challenges, including modeling effort and state-space explosion.

In this work, we apply model checking to Federated Learning (FL)-based smart advertising systems deployed over social-network-like settings. While FL offers a promising privacy-preserving foundation for personalized advertising, the correctness, availability, and reliability of such distributed workflows cannot be assumed a priori. This is particularly important in real applications, where failures in user detection, local training, aggregation, or advertisement delivery can affect service quality, trust, and operational performance. Except for a limited set of prior studies, including the work of Souri et al. on user relationships in social media [5], relatively little research has examined formal model checking in smart advertising systems and social networks, particularly when FL is involved. Our goal is therefore to provide a formal assurance framework that helps detect design flaws early, clarifies the system-level implications of FL deployment, and supports more dependable smart advertising infrastructures.

The primary goal of this research is to improve the reliability and operational trustworthiness of FL-based smart advertising systems by applying formal model-checking techniques. To achieve this goal, we use controlled simulation-based workloads that mimic key characteristics of large-scale deployment scenarios, including user profiles, advertisement interactions, and distributed edge–server processing. The evaluation focuses on correctness, availability, efficiency, and scalability under multiple configurations ranging from 20 to 100 users and from 5 to 20 edge servers.

This overarching goal can be broken down into the following specific objectives:

• Develop a formal specification framework for smart advertising in social networks.
• Integrate model checking with federated learning.
• Verify model properties and evaluate performance and reliability in a controlled, simulation-based setting.

This paper makes three main contributions. First, we develop a formal verification framework for FL-based smart advertising systems, focusing on correctness, availability, and baseline privacy properties. Second, we introduce a structured modeling and evaluation workflow that uses synthetic yet controlled scenarios to study ad delivery, global-model availability, and verification overhead across different operational settings. Third, we show how model checking can be used not only to verify system-level properties, but also to reveal bottlenecks and guide improvements relevant to real distributed advertising systems.

Beyond the reported metrics, the broader implication of this work is that formal verification can strengthen the practical deployment of FL-driven advertising services. By identifying violations, bottlenecks, and imbalance patterns before deployment, the proposed approach can help improve reliability, support safer scaling decisions, and enhance trust in user-centric advertising infrastructures.

This paper is arranged as follows: In Section 2, we provide background information on model checking and its relevance to federated learning-based systems. Section 3 reviews related work, highlighting existing approaches and identifying gaps in the literature. Section 4 details the proposed model checking approach, including the formal system modeling and the key properties we aim to verify. Section 5 presents the experimental results, focusing on the system’s correctness and efficiency, followed by a discussion in Section 6, where we analyze the results and offer insights into optimization opportunities. Finally, Section 7 wraps up the paper with a summary of findings and recommendations for future research.

2. Research Background: Model Checking

Model checking is an automated formal-verification technique used to determine whether software and hardware systems satisfy their intended specifications. By systematically exploring the system state space, a model checker can determine whether desired properties hold across all reachable executions [6]. In practice, model checking is commonly used to establish safety and liveness requirements. These properties are typically expressed using temporal logics such as Linear Temporal Logic (LTL) and Computation Tree Logic (CTL). In this study, we use LTL to specify the key temporal requirements of the smart advertising workflow.

To use model checking for software correctness verification, the system is represented as a state machine M. The state machine M is formally defined as a tuple $(S,S_0,T,AP,L)$, where:

• S: A finite set of states representing all possible configurations of the system.
• $S_0\subseteq S$: The set of initial states where the system begins its execution.
• $T\subseteq S\times S$: The transition relation that defines how the system transitions from one state to another.
• $AP$: A set of atomic propositions that represent basic properties, which can be true or false in a state.
• $L:S\to 2^{AP}$: A labeling function that assigns a set of atomic propositions to each state, indicating which properties hold in that state.

This formalization specifies all the possible states and transitions concretely to formalize the system’s dynamic behavior. The state space S encompasses all potential system configurations, while T defines the permissible transitions between these states. The initial states $S_0$ indicate the system’s starting points, and the labeling function L evaluates the properties of each state.

The next step is to define the properties that the system must satisfy. These properties are expressed in a formal logic such as LTL or CTL. Let $\phi$ denote the property to be verified.

In LTL, properties are described using temporal operators to specify conditions over sequences of states. For example, a typical safety property may be expressed as $\phi =\mathrm{G}(\mathrm{request}\to \mathrm{F}\mathrm{grant})$, where:

• G (Globally): Ensures that the property holds in all states throughout the system’s execution.
• F (Finally): Asserts that the property will eventually hold at some future state.
• $\mathrm{G}(\mathrm{request}\to \mathrm{F}\mathrm{grant})$: Specifies that whenever a request occurs, a grant must eventually follow.

The formal specification $\phi$ defines the desired behavior of the system, providing a precise criterion for verification. Model checking determines whether the model M satisfies the property $\phi$, denoted as $M\vDash \phi$. If $M\vDash \phi$, the system is deemed correct according to the specification. Otherwise, the model checker produces a counterexample that demonstrates a situation where the property does not hold.

By rigorously formalizing both the system model and its properties, model checking establishes a robust framework for verifying the correctness of software systems. This approach enhances reliability by systematically identifying and addressing potential errors, ensuring the system performs as intended under all defined conditions.

3. Literature Review

Ref. [7] investigated the process of formally verifying a Lightweight Authentication and Key Exchange Protocol designed for federated Internet of Things (IoT) devices. The main elements encompassed are: security properties, verification tools, modeling challenges, and outcomes.

Ref. [8] introduced a new technique for testing distributed systems called model-checking-guided testing (Mocket). This approach seeks to connect the system’s specification with its real-world implementation. More specifically, the state space generated by formal model checking is utilized to direct the testing of the system implementation and identify defects in the target distributed system. To assess Mocket’s effectiveness and practicality, the authors implemented it on three widely used distributed systems, revealing three previously unknown software issues.

Temporal Network Logic (TNL) was introduced in ref. [9] as a means to specify social networks in which agents can post content and follow one another. This logic is employed to formalize different types of social bot behavior. These formulas hold within a network model containing bots and offer a straightforward algorithm for constructing a logical model from a real-world social network. The authors also show that TNL can be transformed into a subset of LTL that accounts for past events, highlighting the computational effectiveness of model checking in identifying social bots.

In addition to work on general model checking and social-network logics, federated learning (FL) has emerged as a key paradigm for privacy-preserving, distributed analytics. A widely cited overview [10] summarizes core FL settings, optimization challenges, and open problems, while large-scale system design considerations are discussed in ref. [11]. These surveys motivate the need for stronger assurance and verification methods when FL is deployed in user-facing applications such as advertising and recommendation.

Recent research has also highlighted that baseline privacy assumptions in FL require careful threat modeling. For example, gradient/embedding leakage can enable partial reconstruction of training data [12], and model poisoning/backdoor attacks can manipulate the global model without degrading nominal accuracy [13]. More recent surveys systematize backdoor threats and defenses in FL and emphasize evaluation challenges [14]. These studies motivate verifying not only functional correctness but also security- and privacy-relevant properties under realistic assumptions.

Table 1. Comparison of representative related studies and the position of the proposed work.

Study	Application Domain	Uses FL	Uses Model Checking/Formal Verification	Privacy/Security Consideration	End-to-End Workflow Verification	Main Contribution/Limitation
[7]	Federated IoT authentication	Partial	Yes	Yes	No	Verifies protocol-level security properties for federated IoT settings.
[8]	Distributed systems testing	No	Yes	No	No	Connects model checking to implementation testing, but not to FL or advertising.
[9]	Social-network logic/bot behavior	No	Yes	Partial	No	Formalizes social-network behaviors, but not FL-based advertising workflows.
[10,11]	General FL systems	Yes	No	Partial	No	Provide FL foundations and systems perspective, but not formal verification.
[12,13,14]	FL privacy/security threats	Yes	No	Yes	No	Analyze leakage, poisoning, and backdoor risks, but without end-to-end verification.
[15,16]	Formal methods for FL-enabled systems	Yes	Yes	Partial	Partial	Show the relevance of formal assurance in FL, but not in smart advertising.
This work	Smart advertising with FL	Yes	Yes	Baseline privacy + broader threat-model discussion	Yes	Verifies an end-to-end FL-driven smart advertising workflow using temporal properties and model-checking tools.

summarizes representative related studies and positions the proposed approach with respect to the literature.

Finally, there is growing interest in applying formal methods to FL-enabled systems. Established model-checking toolchains such as SPIN and its specification language PROMELA remain standard for verifying concurrent and distributed systems [2]. More recent work has explored formal verification of generic FL algorithms using process calculi and model checking [15], as well as model-checking-based assurance of federation correctness in cyber–physical deployments [16]. Overall, the literature shows important progress in three related directions: FL foundations and deployments, privacy and security risks in FL, and formal verification of distributed systems. However, relatively few studies connect these directions in a single end-to-end setting. In particular, prior work rarely addresses smart advertising workflows that jointly involve distributed user interactions, edge-based FL updates, and temporal properties related to service correctness, availability, and privacy. This gap motivates the present study, which positions model checking as a practical assurance mechanism for FL-driven smart advertising systems rather than for isolated protocol components alone.

4. Proposed Model Checking Approach

In this section, we describe the application of model checking to verify the correctness of our smart advertising system (which is based on the architecture introduced in ref. [17]) using federated learning. Model checking provides a rigorous approach to ensuring that the system adheres to specified properties, such as correctness, efficiency, and privacy. Linear Temporal Logic (LTL) is the temporal specification formalism used in this study. Below, we briefly introduce only the LTL concepts needed for our specifications and then present the properties used to verify the smart advertising workflow.

4.1. Linear Temporal Logic (LTL)

LTL is a formalism used for specifying and reasoning about the temporal properties of systems. It extends classical propositional logic by introducing temporal operators, enabling the expression of how system states evolve over time. LTL is particularly useful in the context of model checking, where it provides a means to define and verify system properties such as safety, liveness, and fairness.

LTL introduces several temporal operators to describe sequences of states. The most commonly used operators include:

• G (Globally): A property must hold in all states of the execution. For instance, $G\left(p\right)$ means that p is true at every point in the execution.
• F (Finally): A property must eventually hold at some future state. For example, $F\left(p\right)$ means that p will be true at some point in the future.
• X (Next): A property must hold in the next state. $X\left(p\right)$ indicates that p is true in the next state of the execution.
• U (Until): One property must hold until another property becomes true. $pUq$ signifies that p holds continuously until q becomes true.

In model checking, LTL is used to specify the properties that a system must meet. The system is represented as a state machine, and the LTL formulas are evaluated across all possible state sequences (executions) of this machine. If the system model satisfies the LTL formula, it is considered correct with respect to the specified property. Otherwise, model checking tools provide counterexamples illustrating how the property can be violated.

Consider a smart advertising system that should ensure whenever a user requests an ad, an appropriate ad is eventually displayed. This requirement can be expressed in LTL as:

$$G(\mathrm{request}\to F\mathrm{display\_ad})$$

This formula states that globally, whenever a request occurs, there will eventually be a state where an ad is displayed. By verifying this LTL property, one can ensure the correctness of the advertising system’s behavior over time.

LTL provides a compact and expressive way to specify temporal requirements in advertising systems. When combined with model checking, it supports rigorous verification of the behavior and reliability of complex FL-based smart advertising workflows against explicit correctness and performance requirements.

4.2. LTL for Smart Advertising

To formally verify the smart advertising system, we represent it as a state machine M, defined as $M=(S,S_0,T,AP,L)$, where:

• S is a finite set of states representing the different configurations of the system.
• $S_0\subseteq S$ is the set of initial states where the system begins its execution.
• $T\subseteq S\times S$ is the transition relation, specifying how the system moves from one state to another.
• $AP$ is a set of atomic propositions that denote basic properties in each state.
• $L:S\to 2^{AP}$ is a labeling function assigning a set of atomic propositions to each state.

The components and state variables of our system include:

• Edge Servers: $E_1,E_2,\dots ,E_n$
• Users: $U_1,U_2,\dots ,U_m$
• Local Models: $M_{L1},M_{L2},\dots ,M_{Ln}$ on each edge server
• Global Model: $M_G$
• Advertisements: $A_1,A_2,\dots ,A_k$
• User Data: $D_U$ (profiles, history, mood, location)

The state transitions within the system are as follows:

• User Detection: When a user $U_i$ enters the range of an edge server $E_j$, their data $D_{U_i}$ is detected and processed.
• Local Model Training: Each edge server $E_j$ trains its local model $M_{Lj}$ using the data from users within its range.
• Model Aggregation: The global model $M_G$ is updated by aggregating the local models $M_{L1},M_{L2},\dots ,M_{Ln}$.
• Advertisement Selection: The global model $M_G$ selects the most relevant advertisement $A_k$ for user $U_i$ based on their data $D_{U_i}$.

These transitions can be formally expressed in temporal logic. For example, in LTL, we describe state changes as:

• $\mathbf{G}(\mathrm{UserDetected}\to \mathbf{F}\mathrm{LocalModelTraining})$
• $\mathbf{G}(\mathrm{LocalModelTraining}\to \mathbf{F}\mathrm{ModelAggregation})$
• $\mathbf{G}(\mathrm{ModelAggregation}\to \mathbf{F}\mathrm{AdvertisementSelection})$

To verify the smart advertising system, we specify the properties it must satisfy and then run a tool-supported verification workflow. We focus on three key categories of properties: correctness, efficiency/availability, and privacy (baseline).

4.2.1. Verified Properties

• Correctness (ad relevance and delivery). Each detected user should eventually receive an advertisement that is relevant to the user profile.
  • Formal specification:

    $$\mathbf{G}(\mathrm{UserDetected}\left(U_i\right)\to \mathbf{F}\mathrm{RelevantAdvertisement}(U_i,A_k))$$
• Efficiency/Availability (timely completion). After user detection, the advertisement selection/delivery should complete within an acceptable bound.
  • Formal specification (bounded eventually):

    $$\mathbf{G}(\mathrm{UserDetected}\left(U_i\right)\to {\mathbf{F}}_{\le T}\mathrm{AdvertisementSelected}\left(U_i\right))$$
• Privacy (baseline data-locality constraint). User raw data should remain local to the edge server that serves the user; only model updates/aggregates are shared.
  • Formal specification (abstracted):

    $$\mathbf{G}(\mathrm{UserDataUsed}\left(U_i\right)\to \mathrm{LocalServer}\left(E_j\right))$$

4.2.2. Tool-Supported Verification Workflow

We follow a standard model-checking workflow with SPIN/NuSMV:

• Model encoding. We encode the system as a finite-state transition system (users, edge servers, training/aggregation states, and message events).
• Property encoding. We encode the above requirements as LTL formulas over atomic propositions derived from model variables/events.
• Verification run. The model checker exhaustively explores reachable states to determine whether each LTL property holds; if a property fails, a counterexample trace is produced.
• Analysis and refinement. We analyze counterexamples (when present) to pinpoint violating transitions and refine the model/specifications accordingly.

By following these steps, we systematically verify the proposed federated-learning smart advertising workflow with respect to correctness, efficiency/availability, and baseline privacy requirements.

5. Results

The evaluation of our FL-based smart advertising system was conducted through a comprehensive set of experiments designed to assess its correctness, efficiency, and scalability under varying conditions. The system operates within a distributed network, where edge servers process user interactions locally, update local models, and contribute to a global model that optimizes ad selection and delivery. To rigorously assess the system, we used model checking to examine whether the modeled workflow satisfies predefined correctness, efficiency, and baseline privacy requirements under different operational configurations.

The experimental setup included simulated user interactions across multiple configurations, ranging from 20 to 100 users and from 5 to 20 edge servers, reflecting a realistic deployment of an FL-based advertising framework. The synthetic dataset was designed to approximate realistic user behaviors, including preferences, engagement patterns, and response times to advertisements, while remaining reproducible and tractable for formal verification. Our analysis focused on key indicators such as successful ad delivery, ad-selection latency, and the system’s ability to maintain consistent service behavior across configurations.

Figure 1 illustrates the network architecture, where users (represented as green nodes) are dynamically connected to edge servers (blue nodes), simulating real-world ad delivery conditions. This setup allows for an accurate assessment of how the system detects user requests, processes relevant data, and delivers targeted advertisements. The following subsections present the correctness, availability, and scalability results and highlight the main implications for robustness and optimization.

5.1. Correctness

In the context of FL-based smart advertising, correctness is a critical property that ensures the system’s behavior aligns with its intended specifications. Correctness verification involves examining whether the system accurately performs tasks such as selecting and displaying relevant advertisements to users based on their profiles. This subsection delves into the methodologies employed to verify correctness in our smart advertising system (detailed in ref. [17]). By employing formal model checking techniques, we rigorously evaluate the system’s compliance with predefined correctness criteria (such as ensuring the accuracy of ad targeting, adherence to user privacy constraints, timely delivery of advertisements, and avoidance of bias in ad selection), identifying potential discrepancies and ensuring that the advertisements presented to users are contextually appropriate and timely. This systematic approach not only enhances the reliability of the advertising system but also fosters user trust by consistently delivering accurate and relevant content.

Model checking is used to verify the interaction between user requests and edge services in the FL-based smart advertising system. The workflow is modeled as a state machine M that captures user detection, local model training, aggregation, and advertisement selection. For example, the property $G(\mathrm{Request}\to F(\mathrm{AdDelivered}\left)\right)$ states that each user request must eventually result in successful ad delivery.

Tools such as SPIN and NuSMV can be used to verify these properties, identify bottlenecks, and assess scalability trends. The results in

Table 2. Users’ Received Ads.

Total Users	5 Edge Servers	10 Edge Servers	20 Edge Servers
20	20	20	20
50	48	48	50
100	97	96	100

highlight successful ad delivery across configurations, while

Table 3. Global Model Availability.

Total Users	5 Edge Servers	10 Edge Servers	20 Edge Servers
20	40 of 40 requests	39 of 40 requests	40 of 40 requests
50	98 of 100 requests	98 of 100 requests	99 of 100 requests
100	199 of 200 requests	197 of 200 requests	200 of 200 requests

shows that the global model maintains high availability. Together, these findings indicate robust behavior under varying loads.

Table 2 and Figure 2 summarize the number of users who received advertisements across different edge–server configurations. The configurations are based on varying the total number of users (20, 50, 100) and the number of edge servers (5, 10, 20). The results indicate that ad-delivery performance remains consistent as the number of edge servers increases, with almost all users receiving advertisements in each scenario. For 100 users, the system still achieves near-perfect delivery, indicating robust behavior even under higher loads.

Table 3 illustrates the availability of the global model in terms of the number of requests successfully handled. Similar to Table 2, the configurations vary by the number of users and edge servers. The data shows high availability, with the system managing almost all requests in each configuration. For instance, with 100 users, the system handles nearly all 200 requests across different edge server configurations, demonstrating the reliability and efficiency of the global model in supporting user requests.

Figure 3 visualizes the distribution of users across 20 edge servers in the most imbalanced state observed during model checking. This figure highlights potential load imbalances, which can impact system performance. Understanding these imbalances is crucial for optimizing resource allocation and ensuring consistent user experience. The figure helps identify edge servers that may require adjustments to balance the load more effectively, enhancing overall system performance and reliability.

Taken together, these tables and figures show that the system handles user requests consistently across a range of user loads and edge–server configurations. The analysis therefore complements the formal verification results by showing that the modeled workflow preserves reliable service behavior under different operational scenarios.

5.2. Efficiency

The detection-time experiment, together with model checking, is intended to evaluate how quickly users are detected and served by edge servers in the smart advertising system. Here, detection time refers to the elapsed time between a user interaction and the selection of the appropriate advertisement. The formal verification perspective is used to assess whether this part of the workflow remains consistent with the required temporal properties under varying loads.

Table 4. Average Detection Time (s).

Total Users	5 Edge Servers	10 Edge Servers	20 Edge Servers
20	10.05	10.43	10.60
50	10.31	10.54	11.06
100	10.78	11.57	11.98

presents the average detection time for users across different configurations of edge servers, examining setups with 5, 10, and 20 edge servers while varying the total number of users from 20 to 100. The results show a slight increase in detection time as the number of users rises. For example, with 5 edge servers, the detection time increases from 10.05 s for 20 users to 10.78 s for 100 users, a 7.3% increase. Similarly, for 10 edge servers, the detection time rises from 10.43 s to 11.57 s (10.9%), and for 20 edge servers, from 10.60 s to 11.98 s (13%). These results indicate minor performance degradation (up to 13%) under higher loads, primarily due to increased processing demands and potential network congestion.

Figure 4 illustrates the distribution of detection times for a scenario with 20 edge servers and 100 users. The distribution reveals that most detection times fall within a relatively narrow range, indicating consistent performance for the majority of users. However, there are notable outliers where detection times are significantly longer. These outliers could be attributed to network delays, processing bottlenecks, or specific server issues. Understanding this distribution is crucial for identifying and addressing the causes of these longer detection times to ensure a more uniform user experience.

Figure 5 provides a heatmap of detection times for 20 edge servers and 100 users, visually representing the spatial distribution of detection efficiency. The heatmap clearly identifies areas with faster detection times (lighter colors) and slower detection times (darker colors). This visualization is particularly useful for pinpointing specific edge servers or regions experiencing higher loads or inefficiencies. By analyzing these patterns, system administrators can optimize resource allocation, potentially redistributing users or enhancing server capacities in regions where detection times are slower. This targeted approach can significantly improve overall system performance and reliability.

The combined evidence from Table 4 and Figure 4 and Figure 5 provides a comprehensive view of system behavior. Although the system remains efficient, moderate degradation appears as the number of users and edge servers increases. The heatmap and detection-time distribution highlight opportunities for optimization, particularly in load balancing and bottleneck mitigation. Addressing these factors can further improve the efficiency and reliability of the FL-based smart advertising system.

6. Discussion

The analysis of the FL-based smart advertising system provides several useful insights into performance, reliability, and scalability. This discussion synthesizes the results presented in Table 4 and Figure 4 and Figure 5, focusing on robustness, efficiency, and optimization opportunities.

The data show that the FL-based smart advertising system maintains robust performance across varying edge–server configurations and user loads. The relatively narrow range of detection times, as shown in Figure 4, indicates consistent handling of user requests and advertisement delivery. This consistency is important because dependable user experience is a core requirement in practical smart advertising systems.

However, the results also indicate a slight degradation in performance as the number of users increases. Specifically, the average detection times presented in Table 4 gradually increase across all configurations as user load rises. This trend is expected due to the additional processing demands and potential network congestion associated with higher user volumes. Despite this, the performance degradation is relatively minor, suggesting that the system is well-designed to scale efficiently up to a certain threshold.

Figure 5 provides a detailed heatmap of detection times, highlighting areas where the system performs optimally and regions where performance lags. The presence of outliers with significantly longer detection times suggests that certain edge servers or network segments may experience higher loads or inefficiencies. These outliers can be attributed to factors such as network delays, processing bottlenecks, or specific server issues. Understanding and addressing these anomalies is crucial for optimizing the system’s overall performance and ensuring a more uniform user experience.

The insights from the detection time heatmap and distribution data point to areas where optimization efforts can be focused. For instance, improving load balancing across edge servers and addressing identified bottlenecks can enhance system efficiency. Potential strategies include redistributing user loads more evenly, enhancing server capacities in regions with slower detection times, and implementing more efficient data processing algorithms. Targeting these areas for development will help greatly increase the system’s reliability and effectiveness, consequently guaranteeing better performance under different running circumstances.

6.1. Verification Overhead and State-Space Growth

The observed increase in detection/verification time with larger user populations is consistent with the well-known state-space explosion phenomenon in model checking. As the number of users and edge servers grows, the composed transition system expands combinatorially, increasing the number of reachable interleavings and the cost of exploring counterexample traces. In practice, this overhead is influenced by the size of the encoded model, the number of atomic propositions monitored, and the complexity of the LTL formulas. Standard mitigation techniques include abstraction and compositional reasoning, symmetry reduction for replicated clients, and bounded verification to focus on critical execution windows.

6.2. Synthetic Evaluation and External Validity

Our experiments are simulation-based and use synthetic workloads to systematically explore a wide range of user/server configurations under controlled conditions. While this enables reproducibility and controlled scalability studies, it cannot capture all aspects of real-world social-network dynamics (e.g., long-tailed user engagement, temporal bursts, and non-stationary preferences). We therefore interpret the results primarily as evidence of feasibility and scalability trends of the verification workflow, and we outline real-data validation as future work.

6.3. Privacy Threat Model Beyond Data Locality

The privacy property verified in this paper is a baseline data-locality constraint (raw user data remain on the serving edge). However, federated learning systems may still be exposed to advanced threats such as gradient/embedding leakage (e.g., ref. [12]), inference attacks, and poisoning/backdoor attacks (e.g., refs. [13,14]). Extending formal specifications to include adversarial behaviors and integrity constraints is an important direction to strengthen the trustworthiness guarantees of FL-driven advertising systems.

6.4. Load Imbalance and Practical Mitigations

The heatmap and outliers indicate heterogeneity across edge servers and network paths. In real deployments, capacity-aware user-to-edge assignment, admission control, and dynamic reallocation (e.g., re-routing users to less loaded servers) can reduce tail latency. Another complementary direction is to couple verification with runtime monitoring, using counterexample-guided diagnostics to inform operational policies when abnormal delays are observed.

7. Conclusions

This study presented a model-checking-based assurance framework for Federated Learning (FL)-driven smart advertising systems. By modeling the workflow as a finite-state system and expressing key requirements in Linear Temporal Logic (LTL), we formally evaluated correctness, availability, and baseline privacy properties in a distributed advertising setting. The results show that the system maintains strong service behavior across the tested configurations: ad delivery remains high, global-model availability is preserved, and verification overhead grows moderately as the number of users increases.

The findings also highlight the practical value of formal verification for real intelligent advertising systems. Rather than serving only as an abstract correctness exercise, model checking helps expose bottlenecks, identify imbalance patterns across edge servers, and provide evidence about whether an FL-enabled workflow satisfies important temporal requirements before deployment. In this sense, the proposed approach can support more reliable, trustworthy, and user-centric operation in distributed advertising infrastructures.

At the same time, the study has clear limitations. The current evaluation is based on controlled synthetic workloads, which support reproducibility and tractable verification but do not fully capture the heterogeneity and temporal complexity of real production environments. In addition, the privacy property considered here represents a baseline data-locality constraint and does not cover the full range of FL threat models, such as gradient leakage, inference attacks, poisoning, or backdoor attacks.

Several future directions can further strengthen the practical impact of this work. First, real-world validation should be pursued by mapping public social-network, recommendation, or advertising datasets to the proposed model variables and temporal properties. Second, scalability can be improved through abstraction, compositional reasoning, bounded verification, and symmetry-reduction techniques to better manage state-space growth. Third, richer adversarial and privacy-aware specifications should be incorporated to capture more realistic FL security risks. Finally, integrating offline model checking with runtime monitoring and adaptive FL strategies could enable continuous assurance during operation and support dynamic decision making under changing user demand and network conditions.