CoChat
Sign Up
Cited by 613Privacy-Preserving Technologies in DataBlockchain Technology Applications and SecurityIoT and Edge/Fog Computing

Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices

Open access
Zhao, Yang, Zhao, Jun, Jiang, Linshan, Tan, Rui, Niyato, Dusit, Li, Zengxiang, Lyu, Lingjuan, Liu, Yingbo·2021·IEEE Internet of Things Journal
DOI 10.1109/jiot.2020.3017377
Open this paper in CoChat — free accountOpen PDF

Abstract

Home appliance manufacturers strive to obtain feedback from users to improve their products and services to build a smart home system. To help manufacturers develop a smart home system, we design a federated learning (FL) system leveraging a reputation mechanism to assist home appliance manufacturers to train a machine learning model based on customers’ data. Then, manufacturers can predict customers’ requirements and consumption behaviors in the future. The working flow of the system includes two stages: in the first stage, customers train the initial model provided by the manufacturer using both the mobile phone and the mobile-edge computing (MEC) server. Customers collect data from various home appliances using phones, and then they download and train the initial model with their local data. After deriving local models, customers sign on their models and send them to the blockchain. In case customers or manufacturers are malicious, we use the blockchain to replace the centralized aggregator in the traditional FL system. Since records on the blockchain are untampered, malicious customers or manufacturers’ activities are traceable. In the second stage, manufacturers select customers or organizations as miners for calculating the averaged model using received models from customers. By the end of the crowdsourcing task, one of the miners, who is selected as the temporary leader, uploads the model to the blockchain. To protect customers’ privacy and improve the test accuracy, we enforce differential privacy (DP) on the extracted features and propose a new normalization technique. We experimentally demonstrate that our normalization technique outperforms batch normalization when features are under DP protection. In addition, to attract more customers to participate in the crowdsourcing FL task, we design an incentive mechanism to award participants.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper designs a blockchain-based crowdsourcing federated learning system for IoT smart-home data, combining mobile feature extraction with differential privacy, MEC training, Algorand blockchain, IPFS storage, and a reputation incentive. It proposes a normalization technique that outperforms batch normalization under differential privacy and reports MNIST experiments plus Raspberry Pi feasibility tests.

Key findings

  • The proposed normalization constrains feature values to \([-\sqrt{N-1}, \sqrt{N-1}]\) without enforcing mean 0 or variance 1; under \(\epsilon\)-DP it outperforms batch normalization. With \(N=64\), batch-normalized features are seriously perturbed when \(\epsilon \ll 5.33\), while the proposed method’s features are overwhelmed only when \(\epsilon \ll 2\).
  • On MNIST with 10 participants, 6,000 images each, batch size 64, default \(\epsilon=2\), 40 local epochs, and 2 global epochs, the system achieves at least 90% accuracy when global epoch = 2 and \(\epsilon > 1\); the discussion states it can achieve 97% accuracy.
  • Under DP (\(\epsilon=2\)), test accuracy decreases as batch size increases; without DP, batch normalization outperforms the proposed normalization. With \(\epsilon=2\) and 40 local epochs, the optimal number of global epochs is 2; accuracy drops at 3 or 4 global epochs because noise increases.
  • In the incentive simulation (\(\gamma_{\text{Max}}=100\), initial reputation \(h=5\)), no incentive gives a fixed reward of 5 per global epoch; honest customers gain more reward/reputation, while a poisoning update yields reward 0 and drops reputation to 0 if it equals \(h=5\), otherwise by 1.
  • Raspberry Pi 4 training with 6,000 images takes about 144 seconds per epoch versus about 9 seconds on the laptop edge server; for 40 epochs this is about 96 minutes versus 6 minutes. Average local model size is 617.8 KB, giving about 0.6178 seconds communication cost at 1 MB/s upload bandwidth.

Methods

  • System design: manufacturers post a crowdsourcing FL task; customers collect home-appliance data via phone, extract CNN features locally, add \(\epsilon\)-DP Laplace noise, and offload perturbed features and labels to an MEC server for fully connected layer training. Customers sign model hashes and upload them to a consortium blockchain using Algorand PoS/BFT; miners verify with Multi-KRUM, a selected leader aggregates the global model, and IPFS provides off-chain storage.
  • Privacy/normalization: each feature dimension is normalized to \([-\sqrt{N-1}, \sqrt{N-1}]\), giving sensitivity \(2\sqrt{N-1}\); independent zero-mean Laplace noise with scale \(2\sqrt{N-1}/\epsilon\) is added to each normalized feature dimension.
  • Experiments: MNIST (60,000 training, 10,000 test images), CNN with two convolutional layers (30 and 80 channels), max-pooling, four fully connected hidden layers reducing dimension from 3920 to 10, learning rate 0.01, batch size 64, \(\epsilon \in [1,10]\) with default \(\epsilon=2\), default 2 global epochs and 40 local epochs, 10 participants with 6,000 images each. A Raspberry Pi 4 simulates the mobile device and a laptop emulates the edge server; incentive experiments use \(\gamma_{\text{Max}}=100\) and initial reputation \(h=5\).

Limitations

  • Stated: future work will test the system with real-world home-appliance datasets and find a deterministically optimal balance between local and global epochs. The paper also notes that customers who seldom use devices may postpone crowdsourcing progress.
  • Evident: the evaluation is limited to MNIST and simulated FL by averaging locally trained model parameters; mobile and edge hardware are simulated by a Raspberry Pi 4 and a laptop, not an actual smart-home deployment.
  • Evident: the paper does not report a formal end-to-end security proof or real-world attack evaluation, though it discusses GAN-based and DeepInversion risks qualitatively.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1109/jiot.2020.3017377

Cites

66 of 66 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 29 cited sources checked · 0 supported · 0 flagged

  • Findingown data
    § Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices · p. 1

    The proposed normalization technique outperforms batch normalization when features are under differential privacy protection.

    “We experimentally demonstrate that our normalization technique outperforms batch normalization when features are under differential privacy protection.”
    • Also stated in: § I. INTRODUCTION · p. 2 · plain
      “Second, we propose a new normalization technique which delivers a higher test accuracy than batch normalization, while preserving the privacy of the extracted features of each participant's data.”
    Quote in the paperSubstantial claim
  • Findingown data
    § C. Normalization Technique · p. 6

    Experiments in Section VI show that our normalization technique significantly improves the learning accuracy over that of Jiang et al.'s batch normalization.

    “Experiments to be presented in Section VI show that our normalization technique significantly improves the learning accuracy over that of [45].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [45] [45] L. Jiang, X. Lou, R. Tan, and J. Zhao, 'Differentially private collaborative learning for the IoT edge,' in International Workshop on Crowd Intelligence for Smart Cities: Technology and Applications (CISC) , 2018. -

      Not checked in the free run.

  • Findingreasoning
    § C. Normalization Technique · p. 7

    When using our normalization technique, the true value will be overwhelmed by noise when the privacy parameter ε ≪ 2.

    “Hence, when the privacy parameter ϵ ≪ 2 , the true value will be overwhelmed by the noise.”
    Quote in the paperSubstantial claim
  • Findingown data
    § B. Experimental Results · p. 8

    Figure 3 shows the superiority of DP-aware FL using our normalization technique over DP-aware FL using Jiang et al.'s batch normalization.

    “Figure 3 shows the superiority of DP-aware FL using our normalization technique over DPaware FL using Jiang et al. 's batch normalization [45].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [45] [45] L. Jiang, X. Lou, R. Tan, and J. Zhao, 'Differentially private collaborative learning for the IoT edge,' in International Workshop on Crowd Intelligence for Smart Cities: Technology and Applications (CISC) , 2018. -

      Not checked in the free run.

  • Findingreasoning
    § B. Experimental Results · p. 9

    The test accuracy of FL model decreases as the batch size increases when the number of global epoch is 1 and DP parameter ε = 2.

    “Figure 4 presents that the test accuracy of FL model decreases as the batch size increases when the number of global epoch is 1 and DP parameter ϵ = 2 .”
    Quote in the paperSubstantial claim
  • The quote only partly states this claim. 1
  • May combine two claims. 29
  • Classified as probably not a substantial claim. 24

  • The quote only partly states this claim.

    Findingreasoning
    § C. Normalization Technique · p. 7

    When batch size N=64 and Laplace scale is 2√N-1/ε, true feature values will be seriously perturbed by noise when the privacy parameter ε ≪ 5.33 using batch normalization.

    “Thus, true feature values will be seriously perturbed by noise when the privacy parameter ϵ ≪ 5 . 33 using batch normalization.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning
    § B. Experimental Results · p. 9

    For each DP-aware FL, the test accuracy gets closer to the test accuracy of FL without DP as the privacy parameter ε increases, because a larger ε means less privacy protection and less noise.

    “For each DP-aware FL, we also observe that the test accuracy gets closer to the test accuracy of FL without DP as the privacy parameter ϵ increases, because a larger privacy parameter ϵ means less privacy protection which equals that less noise is used.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning
    § C. Performance evaluation on the mobile device and edge server · p. 9

    For default forty epochs, the mobile device and the edge server use about 96 minutes and 6 minutes, respectively.

    “For default forty epochs, the mobile device and the edge server use about 96 minutes and 6 minutes, respectively.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning
    § B. Experimental Results · p. 9

    When the number of global epochs increases to 3 or 4, the test accuracy may decrease because the noise increases as the number of global epochs increases.

    “However, when the number of global epochs increases to 3 or 4 , the test accuracy may decrease. The test accuracy decreases because the noise increases as the number of global epochs increases.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § B. Experimental Results · p. 9

    As the number of global epochs increases, the test accuracy increases if DP noise is not added; however, Laplace noise increases as the number of global epochs increases, which negatively affects the test accuracy.

    “As the number of global epochs increases, the test accuracy increases if DP noise is not added. However, Laplace noise increases as the number of global epochs increases, which negatively affects the test accuracy.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given
    § D. Evaluation on the incentive mechanism · p. 10

    If there is no incentive mechanism, the customer gets a fixed reward of 5 in every global epoch.

    “If there is no incentive mechanism, the customer gets a fixed reward of 5 in every global epoch.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § C. Performance evaluation on the mobile device and edge server · p. 9

    It takes about 144 seconds to train the model with 6,000 images on the Raspberry Pi 4 for each epoch, and about 9 seconds on the laptop.

    “It takes about 144 seconds to train the model with 6,000 images on the Raspberry Pi 4 (i.e., the mobile device) for each epoch, and it uses about 9 seconds to train the model on the laptop (i.e., the edge server).”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § B. Experimental Results · p. 9

    When the number of local epochs equals 20 or 30, it takes 4 global epochs to achieve a similar accuracy; when the number of local epochs is 40, it takes 2 global epochs.

    “From Figure 8, when the number of local epochs equals 20 or 30 , it takes 4 global epochs to achieve a similar accuracy. When the number of local epochs is 40 , it takes 2 global epochs.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given
    § D. Evaluation on the incentive mechanism · p. 10

    The behaviour of the poisoning attack affects the value of reputation, which results in a decrease of the reputation.

    “Besides, the behaviour of the poisoning attack affects the value of reputation, which results in a decrease of the reputation.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given
    § D. Evaluation on the incentive mechanism · p. 10

    If a customer uploads a malicious update when her reputation value equals h (i.e., 5), her reputation will drop to 0; if her reputation is not 5, her reputation drops by 1 when caught performing poisoning attack.

    “However, if a customer uploads a malicious update when her reputation value equals to the h (i.e., 5 ), her reputation will drop to 0 . However, if her reputation is not 5 , her reputation drops by 1 when caught performing poisoning attack.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingnone given
    § D. Evaluation on the incentive mechanism · p. 10

    If a customer's update is considered as poisoning, her update will not be accepted, and her reward is 0.

    “If a customer's update is considered as poisoning (i.e., the value of s in Eq. (1) is significantly larger than others), her update will not be accepted, that is, her reward is 0 .”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning
    § I. INTRODUCTION · p. 1

    Customers and the requester can save high service fees while keeping the crowdsourcing system functional.

    “Therefore, customers and the requester can save high service fees while keeping the crowdsourcing system functional.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The traditional crowdsourcing system is hosted by a third party, which charges customers costly service fees.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § I. INTRODUCTION · p. 2

    The blockchain-based system prevents malicious model updates by ensuring that all model updates are held accountable.

    “Third, our blockchain-based system prevents malicious model updates by ensuring that all model updates are held accountable.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § A. System Overview · p. 4

    Neither manufacturers nor customers can deny recorded contributions or activities.

    “In addition, neither manufacturers nor customers can deny recorded contributions or activities.”
    • Also stated in: § A. System Overview · p. 5 · plain
      “By using the immutable property of the blockchain, both manufacturers and customers cannot deny transactions stored on the blockchain.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationcitation
    § B. Differential Privacy · p. 3

    The final trained model satisfies differential privacy because noise is added to an intermediate layer and the post-processing property holds.

    “Hence, in our design, although noise is added to an intermediate layer of the neural network, the post-processing property ensures that the final trained model also satisfies differential privacy.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [9] [9] C. Dwork, F. McSherry, K. Nissim, and A. Smith, 'Calibrating noise to sensitivity in private data analysis,' in Theory of Cryptography Conference (TCC) , 2006, pp. 265-284. - source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation
    § C. Normalization Technique · p. 6

    According to the three-sigma rule of Gaussian distribution, about 99.73% of values lie within three standard deviations of the mean.

    “According to the three-sigma rule of Gaussian distribution [54], about 99 . 73% values lie within three standard deviations of the mean.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [54] [54] F. Pukelsheim, 'The three sigma rule,' The American Statistician , vol. 48, no. 2, pp. 88-91, 1994. -

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation
    § B. Differential Privacy · p. 3

    The Laplace mechanism can be used to ensure differential privacy by adding independent zero-mean Laplace noise with scale λ to each dimension of the output.

    “The Laplace mechanism of [9] can be used to ensure differential privacy by adding independent zero-mean Laplace noise with scale λ to each dimension of the output.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [9] [9] C. Dwork, F. McSherry, K. Nissim, and A. Smith, 'Calibrating noise to sensitivity in private data analysis,' in Theory of Cryptography Conference (TCC) , 2006, pp. 265-284. - source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation
    § B. Differential Privacy · p. 3

    The post-processing property of differential privacy means that a data analyst cannot compute the function of the output of a differentially private algorithm and reduce its privacy guarantee without obtaining additional knowledge about the private data.

    “The post-processing property [9] of differential privacy means that a data analyst cannot compute the function of the output of a differentially private algorithm and reduce its privacy guarantee without obtaining additional knowledge about the private data.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [9] [9] C. Dwork, F. McSherry, K. Nissim, and A. Smith, 'Calibrating noise to sensitivity in private data analysis,' in Theory of Cryptography Conference (TCC) , 2006, pp. 265-284. - source

      Not checked in the free run.

  • May combine two claims.

    Premisecitation
    § C. Normalization Technique · p. 6

    When using batch normalization, the mean of features is 0 and the variance is 1.

    “When using batch normalization, the mean of features µ = 0 and the variance σ = 1 .”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [45] [45] L. Jiang, X. Lou, R. Tan, and J. Zhao, 'Differentially private collaborative learning for the IoT edge,' in International Workshop on Crowd Intelligence for Smart Cities: Technology and Applications (CISC) , 2018. -

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisecitation
    § I. INTRODUCTION · p. 1

    Federated learning enables analysts to analyze and utilize locally generated data in a decentralized way without requiring uploading data to a centralized server.

    “Federated learning (FL) enables analysts to analyze and utilize the locally generated data in a decentralized way without requiring uploading data to a centralized server; that is, the utility of data are well maintained despite data are preserved locally.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [13] [13] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, 'Communication-efficient learning of deep networks from decentralized data,' in Artificial Intelligence and Statistics , 2017, pp. 1273-1282. -

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given
    § I. INTRODUCTION · p. 2

    The reputation-based incentive mechanism rewards reliable customers and punishes malicious customers correspondingly.

    “Furthermore, to motivate more customers to participate in the crowdsourcing task and reduce malicious and poisoning updates, we utilize a reputation-based crowdsourcing incentive mechanism, which rewards reliable customers and punish malicious customers correspondingly.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Some customers are unwilling to participate in training the FL model.

  • May combine two claims.

    Interpretationreasoning
    § C. Normalization Technique · p. 7

    The larger privacy parameter means less noise, so feature values using batch normalization are more vulnerable.

    “The larger privacy parameter means the less noise, so that feature values using batch normalization are more vulnerable.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given
    § A. Experiment Setup · p. 7

    The normalization layer enables the computation of sensitivity in differential privacy to determine the amount of noise to add, speeds up the learning rate, and regularizes gradients from distraction to outliers.

    “The normalization layer enables the computation of sensitivity in differential privacy to determine the amount of noise to add, speeds up the learning rate, and regularizes gradients from distraction to outliers.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § A. Experiment Setup · p. 7

    The MNIST dataset includes 60,000 training image samples and 10,000 test image samples, each a 28×28 gray scale image showing a handwritten number within 0 to 9.

    “The MNIST dataset includes 60,000 training image samples and 10,000 test image samples. Each sample is a 28 × 28 gray scale image showing a handwritten number within 0 to 9 .”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [56] [56] Y. LeCun, C. Cortes, and C. Burges, 'MNIST handwritten digit database,' 2010, accessed on March 1, 2019. [Online]. Available: http://yann.lecun.com/exdb/mnist -

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning
    § A. Privacy and Security · p. 7

    Our system leverages differential privacy to protect the privacy of extracted features, keeping participating customers' data confidential.

    “Our system leverages differential privacy technique to protect the privacy of the extracted features. Thus, the system keeps the participating customers' data confidential.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § B. Experimental Results · p. 8

    A feature that goes through batch normalization often results in a smaller magnitude than one that goes through our normalization technique, so the feature value is easily overwhelmed by noise when using batch normalization.

    “A feature goes through batch normalization often results in a smaller magnitude than that goes through our normalization technique, so the value of feature is easily overwhelmed by the noise when using batch normalization.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Study design and conductreasoning
    § A. Experiment Setup · p. 7

    We apply ε-DP noise to perturb the output of normalization layers to preserve the privacy of the extracted features.

    “Then, we apply ϵ -DP noise to perturb the output of normalization layers to preserve the privacy of the extracted features.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Study design and conductnone given
    § A. Privacy and Security · p. 7

    The trained model is encrypted and signed by the sender to prevent attackers and imposters from stealing the model or deriving original data through reverse-engineering.

    “Furthermore, the trained model is encrypted and signed by the sender to prevent the attackers and imposters from stealing the model or deriving original data through reverse-engineering.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Study design and conductnone given
    § A. Experiment Setup · p. 7

    We normalize each dimension of the feature to the interval [-√N-1, √N-1] for batch size N, so that the sensitivity of the normalized feature vector when one dimension changes is 2√N-1.

    “We normalize each dimension of the feature to the interval [ - √ N -1 , √ N -1] for N denoting the batch size, so that the sensitivity of the normalized feature vector when one dimension of the feature changes is 2 √ N -1 .”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § B. Delay in Crowdsourcing · p. 7

    Yu et al. designed a queue to store customers who submitted their models in order, so customers who submit locally trained models early will be rewarded to encourage earlier updates.

    “Yu et al. [55] designed a queue to store customers who submitted their models in order. Thus, customers who submit their locally trained models early will be rewarded to encourage people to submit their updates earlier.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [55] [55] H. Yu, Z. Liu, Y. Liu, T. Chen, M. Cong, X. Weng, D. Niyato, and Q. Yang, 'A fairness-aware incentive scheme for federated learning,' in Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society , 2020, pp. 393-399. -

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § A. Experiment Setup · p. 7

    MNIST is a standard dataset employed for testing machine learning algorithms and gives moderate and typical complexity faced by IoT applications.

    “In addition, the MNIST is a standard dataset employed for testing machine learning algorithms. It gives moderate and typical complexity faced by IoT applications.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [45,57]-[62]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § B. Delay in Crowdsourcing · p. 7

    Customers who seldom use devices may postpone the overall crowdsourcing progress.

    “As a result, customers who seldom use devices may postpone the overall crowdsourcing progress.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: There is a large number of customers, and the system highly depends on customers' training results to obtain the predictive model in one global epoch.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationnone given
    § B. Experimental Results · p. 9

    A larger ε means that less noise is added to features, so that the privacy protection is weaker.

    “A larger ϵ means that less noise is added to features, so that the privacy protection is weaker.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § C. Performance evaluation on the mobile device and edge server · p. 9

    A client is supposed to participate in federated learning when the smartphone is idle, such as charging, screen off, and connected to an unmetered network.

    “A client is supposed to participate in the federated learning when the smartphone is idle, such as charging, screen off, and connected to an unmetered network, for example, WiFi [13,65].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [13] [13] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, 'Communication-efficient learning of deep networks from decentralized data,' in Artificial Intelligence and Statistics , 2017, pp. 1273-1282. -

      Not checked in the free run.

    • cites [65] [65] K. Bonawitz, H. Eichner, W. Grieskamp, D. Huba, A. Ingerman, V. Ivanov, C. Kiddon, J. Koneˇ cn` y, S. Mazzocchi, H. B. McMahan et al. , 'Towards federated learning at scale: System design,' arXiv preprint arXiv:1902.01046 , 2019. -

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning
    § B. Experimental Results · p. 9

    The added Laplace noise increases as the batch size N increases, which results in a worse test accuracy.

    “This is because we add Laplace noise to features, the added noise will increase as the batch size N increases, which results in a worse test accuracy.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § B. Experimental Results · p. 9

    Typical ε values for experiments are between 0.1 and 10.

    “Typical ϵ values for experiments are between 0 . 1 and 10 [63].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [63] [63] D. S´ anchez, J. Domingo-Ferrer, and S. Mart´ ınez, 'Improving the utility of differential privacy via univariate microaggregation,' in International Conference on Privacy in Statistical Databases , 2014, pp. 130-142. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S4 (based).

    Study design and conductnone given
    § VIII. CONCLUSION AND FUTURE WORK · p. 11

    Our system enforces differential privacy to protect the privacy of customers' data.

    “Besides, our system enforces differential privacy to protect the privacy of customers' data.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § D. Evaluation on the incentive mechanism · p. 11

    Our incentive mechanism can encourage honest customers to contribute their useful updates while preventing malicious customers from attempting to perform the poisoning attack.

    “Thus, our incentive mechanism can encourage honest customers to contribute their useful updates while preventing malicious customers from attempting to perform the poisoning attack.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning
    § VII. DISCUSSION · p. 11

    In our trained model, we add Laplacian noise during training in the batch normalization layer, so attackers are unable to obtain the true information stored there, and DeepInversion is ineffective against our trained model.

    “In our trained model, we add Laplacian noise during training in the batch normalization layer, and then attackers are unable to obtain the true information stored there. Thus, their approach is ineffective against our trained model.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § VII. DISCUSSION · p. 11

    We leverage differential privacy to perturb features before classification in the fully connected layers, so gradients are also protected by differential privacy.

    “To prevent this scenario, we leverage differential privacy to perturb features before classification in the fully connected layers. Thus, gradients are also protected by differential privacy.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning
    § VII. DISCUSSION · p. 11

    Our designed approach guarantees the accuracy and protects the privacy of local models as well as data.

    “Therefore, our designed approach guarantees the accuracy and protects the privacy of local models as well as data.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § VIII. CONCLUSION AND FUTURE WORK · p. 11

    By designing a proper incentive mechanism for the crowdsourcing task, customers are more likely to participate in the crowdsourcing tasks.

    “By designing a proper incentive mechanism for the crowdsourcing task, customers are more likely to participate in the crowdsourcing tasks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given
    § VIII. CONCLUSION AND FUTURE WORK · p. 11

    The blockchain will audit all customers' updates during federated training, so the system can hold model updates accountable to prevent malicious customers or manufacturers.

    “The blockchain will audit all customers' updates during the federated training, so that the system can hold the model updates accountable to prevent malicious customers or manufacturers.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Premisecitation
    § VII. DISCUSSION · p. 11

    Yin et al. introduced a DeepInversion method which could invert a trained neural network to synthesized class-conditional input images starting from random noise, leveraging information stored in the batch normalization layer.

    “In addition, Yin et al. [66] introduced a DeepInversion method which could invert a trained neural network to a synthesized class-conditional input images starting from the random noise. However, they leveraged the information stored in the batch normalization layer.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [66] [66] H. Yin, P. Molchanov, J. M. Alvarez, Z. Li, A. Mallya, D. Hoiem, N. K. Jha, and J. Kautz, 'Dreaming to distill: Data-free knowledge transfer via deepinversion,' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2020, pp. 8715-8724. source

      Not checked in the free run.

44 of 44

  • The paper relies on this without support.

    The traditional crowdsourcing system is hosted by a third party, which charges customers costly service fees.

    “The traditional crowdsourcing system is hosted by a third party, which charges customers costly service fees, while our designed system uses blockchain to record crowdsourcing activities.”

  • The paper relies on this without support.

    Mobile phones have limited computational power and battery life.

    “Since mobile phones have limited computational power and battery life, we offload part of the training task to the edge computing sever.”

  • The paper relies on this without support.

    Home appliances are equipped with heterogeneous storage and computational powers, making it difficult to enable each IoT device to train the deep model.

    “However, since home appliances are equipped with heterogeneous storage and computational powers, it is difficult to enable each IoT device to train the deep model.”

  • The paper relies on this without support.

    Data in home appliances contain customers' confidential information.

    “Because data in home appliances contain customers' confidential information and training consumes computing resources, some customers are unwilling to participate in training the FL model.”

  • The paper relies on this without support.

    Training consumes computing resources.

    “Because data in home appliances contain customers' confidential information and training consumes computing resources, some customers are unwilling to participate in training the FL model.”

  • The paper relies on this without support.

    Some customers are unwilling to participate in training the FL model.

    “Because data in home appliances contain customers' confidential information and training consumes computing resources, some customers are unwilling to participate in training the FL model.”

  • The authors state this as an assumption.

    There is a large number of customers, and the system highly depends on customers' training results to obtain the predictive model in one global epoch.

    “Assume there is a large number of customers, and the system highly depends on customers' training results to obtain the predictive model in one global epoch.”

  • The authors state this as an assumption.

    The upload bandwidth is 1MB/s.

    “Assume the upload bandwidth is 1MB/s, so the communication cost is 0 . 6178 second.”

  • The paper relies on this without support.

    Smartphones often use wideband network connections (e.g., 4G and WiFi).

    “because smartphones often use wideband network connections (e.g., 4G and WiFi).”
9 of 9

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • This approach limits the danger of personal user data being leaked to an external source, ensuring better level of client security.

    “This approach limits the danger of personal user data being leaked to an external source, ensuring better level of client security [149].”

    From Federated learning-based AI approaches in smart healthcare: Concepts, taxonomies, challenges and open issues (2023) · cites this paper as [149]

  • FL reduces the risks of leakage of sensitive user information to external third-party, thus providing a higher degree of user privacy.

    “This would reduce the risks of the leakage of sensitive user information to the external third-party, and thus providing a higher degree of user privacy [30].”

    From Federated learning for smart healthcare: A survey (2023) · cites this paper as [30]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • MNIST dataset is cited as the Biscotti paper

    Minor

    The performance evaluation cites [52] for the MNIST dataset, but reference [52] is a paper titled "Biscotti," while the paper identifies [56] as the MNIST dataset reference elsewhere.

  • Byzantine parameter f is assigned two different meanings

    Minor

    Table I defines f as Byzantine miners, but the incentive-mechanism section defines it as the number of Byzantine customers. These are different groups in the proposed system.

2 of 2

Cites

Flagged first, then by citations

Research works printed but not linked: 5

  1. 2020, Raspberry PI 4 Tech Specs
  2. 2020, Smart Home—Statistics & Facts
  3. lecun, 2010, MNIST Handwritten Digit Database
  4. benet, 2014, IPFS - Content Addressed Versioned P2P File System
  5. hao, 2019, How Apple Personalizes Siri Without Hoovering Up Your Data

Cited by

Sorted by citations

Related

Authors
Zhao, Y., Zhao, J., Jiang, L., Tan, R., Niyato, D., Li, Z., Lyu, L., & Liu, Y.
Affiliations
  • Nanyang Technological University (SG)
  • Agency for Science, Technology and Research (SG)
  • National University of Singapore (SG)
  • Yunnan University of Finance And Economics (CN)
ORCID
Venue
IEEE Internet of Things Journal
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2021-02-01
Volume
8
Issue
3
Pages
1817-1829
ISSN
  • 2327-4662 (ISSN-L)
  • 2372-2541
DOI
10.1109/jiot.2020.3017377
OpenAlex
W3051272477
Cited by
613
References
66
Citations by year
2026: 55 · 2025: 107 · 2024: 122 · 2023: 137 · 2022: 109 · 2021: 65 · 2020: 17 · 2019: 1
FWCI
31.94
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Internet of Things Journal (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • DR-NTU (Nanyang Technological University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • Nanyang Technological University Startup Grant
  • Alibaba-NTU Singapore Joint Research Institute
  • Singapore Ministry of Education Academic Research Fund (Tier 1 RG128/18, Tier 1 RG115/19, Tier 1 RT07/19, Tier 1 RT01/19, Tier 2 MOE2019-T2-1-176)
  • NTU-WASP Joint Project
  • Singapore National Research Foundation under its Strategic Capability Research Centres Funding Initiative: Strategic Centre for Research in Privacy-Preserving Technologies and Systems
  • Energy Research Institute @NTU
  • Singapore NRF National Satellite of Excellence, Design Science and Technology for Secure Critical Infrastructure NSoE (DeST-SCI2019-0012, DeST-SCI2019-0007)
  • AI Singapore 100 Experiments Programme
  • NTU Project for Large Vertical Take-Off and Landing Research Platform
  • MOE AcRF Tier 1 (2019-T1-001-044)
  • National Research Foundation (NRF), Singapore, under Singapore Energy Market Authority, Energy Resilience (NRF2017EWT-EP003-041)
  • Singapore NRF (2015-NRF-ISF001-2277)
  • A*STAR-NTU-SUTD Joint Research Grant on Artificial Intelligence for the Future of Manufacturing (RGANS1906)
  • Wallenberg AI, Autonomous Systems and Software Program and Nanyang Technological University (M4082187 (4080))
  • NTU-WeBank JRI (NWJ-2020-004)
  • Alibaba Group through Alibaba Innovative Research Program and Alibaba-NTU Singapore Joint Research Institute, NTU-Singapore, Singapore Ministry of Education Tier 1 (RG16/20)
  • RIE 2020 Advanced Manufacturing and Engineering Domain’s Core Funds-SERC Strategic Funds: Trusted Data Vault (A1918g0063)
  • National Natural Science Foundation of China (11703010)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
Keywords
federated learning, blockchain, privacy preservation, Internet of Things, home automation, home appliance manufacturers, reputation mechanism, differential privacy, feature normalization, mobile edge computing, crowdsourcing, incentive mechanisms, model aggregation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review