## 7 Results and Discussion
### Privacy and Scalability Analysis  
One of the core objectives of Edge-FLGuard is to provide effective anomaly detection while preserving user data privacy through federated learning. Our experiments confirmed  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Metric** & **Local AE** & **FL AE** & **Local LSTM** & **FL LSTM** \\ \hline Inference latency (ms) & 12.4 & 13.1 & 18.7 & 19.6 \\ Model update time (s) & — & 3.4 & — & 4.1 \\ Memory usage (MB) & 26 & 29 & 39 & 42 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Runtime and resource performance of local vs. federated models.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**System** & **F1-Score** & **Latency (ms)** & **Privacy Exposure** \\ \hline Centralized Model & 0.92 & 45.6 & High (full data sharing) \\ Local-only Baseline & 0.79 & 11.3 & Low (but low accuracy) \\ Edge-FLGuard (ours) & 0.91 & 13.1 & Low (no raw data shared) \\ \hline \hline \end{tabular}
\end{table}
Table 12: Comparative analysis of Edge-FLGuard versus centralized and local baselines.  
that no raw data was ever transmitted between clients and the server. All communication was limited to encrypted model updates using gRPC over TLS 1.3.  
To evaluate privacy preservation quantitatively, we measured several key indicators, as follows:  
* First, gradient norm clipping was applied during client-side training to prevent potential overfitting or model inversion attacks. On average, only 6.8% of clients exceeded the configured L\({}_{2}\) norm threshold (set to 1.0), suggesting that most updates adhered to safe update magnitudes without distortion.
* We also introduced differential privacy (DP) noise to local model updates using Gaussian perturbations. The noise-to-signal ratio (NSR), defined as the L\({}_{2}\) norm of the added noise over the L\({}_{2}\) norm of the raw gradient, was maintained at approximately NSR = 0.21. Despite this privacy enhancement, detection performance remained robust--The federated LSTM model maintained an F1-score of 0.91, compared to 0.93 without noise, indicating only a 2.1% degradation in performance for significant gains in privacy protection.
* Finally, we tracked the empirical privacy budget \(\varepsilon\) throughout federated training. Using Renyi differential privacy accounting with clipping bound \(C=1\), noise multiplier \(\sigma=1.2\), and a total of 50 communication rounds, the cumulative budget was estimated at \(\varepsilon=2.9\) with \(\delta=10-5\). This level of privacy is well-aligned with established best practices in differentially private learning for distributed systems.  
In terms of scalability, Edge-FLGuard demonstrated stable performance with up to 100 clients participating in training. Neither communication delays nor model accuracy showed meaningful degradation as the number of participants increased, confirming the framework's ability to scale horizontally across large IoT deployments.  
Figure 4 summarizes the privacy-preserving aspects of Edge-FLGuard by illustrating the impact of differential privacy techniques on model performance, as well as the values of key privacy metrics measured during training.  
Figure 4: Privacy metrics in Edge-FLGuard: model performance with and without differential privacy (DP), noise-to-signal ratio (NSR), percentage of clients exceeding gradient clipping threshold, and cumulative privacy budget (\(\varepsilon\)) over 50 rounds.  
Figure 5 illustrates the scalability of Edge-FLGuard by showing how the system maintains performance as the number of clients increases, and how the model converges over communication rounds.