## 2 Related Work  
Federated learning, a decentralized machine learning technique, was pioneered by Google in 2016 as a solution to train predictive models on mobile devices without consolidating datas [2]. Its fundamental principle revolves around enabling users to contribute to a collective global model by transmitting their locally trained models to a central server, while keeping their datasets secure on their devices. In the federated learning framework, the server initiates each training cycle by distributing the current global model parameters to participating clients. These clients then utilize their own localized datasets to refine a model tailored to their unique data. Upon completion of local training, the clients relay their updated model parameters back to the server. The server employs an aggregation mechanism to amalgamate these parameters from various clients, resulting in a refined set of global model parameters. Subsequently, these enhanced global parameters are made available for download by the clients, marking the commencement of the subsequent training iteration. This cyclic process persists until the global model reaches a satisfactory level of performance or meets predefined criteria. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Schemes** & **L** & **F** & **I** & **H** & **V** & **T** \\ \hline [PERSON] et al. [16] & ✓ & ✓ & ✓ & ✓ & ✗ & ✓ \\ [PERSON] et al. [22] & ✗ & ✓ & ✗ & ✓ & ✗ & ✓ \\ [PERSON] et al. [23] & ✗ & ✓ & ✗ & ✓ & ✓ & ✓ \\ [PERSON] et al. [24] & ✗ & ✓ & ✗ & ✓ & ✗ & ✓ \\ [PERSON] et al. [18] & ✗ & ✓ & ✗ & ✓ & ✓ & ✓ \\ [PERSON] et al. [25] & ✓ & ✓ & ✓ & ✓ & ✗ & ✗ \\ [PERSON] et al. [26] & ✗ & ✓ & ✗ & ✓ & ✗ & ✗ \\ [PERSON] et al. [27] & ✓ & ✓ & ✓ & ✓ & ✗ & ✓ \\
**Our work** & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Advantages and disadvantages comparison among the related schemes. “**L**” denotes the lightweight cryptography. “**F**” denotes fault tolerance against users dropping out. “**I**” denotes individual keys **without** trusted third parties. “**H**” denotes high accuracy of global model. “**V**” denotes verifiable computation to prevent malicious server returning incorrect results. “**T**” denotes the trusted execution environments (TEEs) are **not** required. In recent years, federated learning has been gaining traction in the business world as a solution to privacy and security concerns; academics are pushing its boundaries through research, and innovative algorithms like FedGRU [28] and FedSem [29] are being developed to predict traffic flow for smart vehicles, train medical models without sharing patient data, and utilize unlabeled data in smart cities, respectively. All these developments highlight federated learning's significant promise in cross-institutional data collaboration while maintaining privacy. However, some research indicates that within the context of federated learning, some attack methods remain capable of threatening users' privacy. [PERSON] et al. [6] have identified several types of attacks, including membership inference assaults, unintentional data leaks, inference-based reconstructions, and GAN-based inference attacks. A membership inference attack, specifically, is when an attacker examines the global model to uncover information about the training data of other users [30]. This type of attack allows the attacker to determine whether a certain type of dataset was used for model training [31; 32; 33; 34]. The GAN-based inference attack takes use of GAN's superior data reconstruction performance to learn the distribution of the user's privacy dataset based on the user's local model and then rebuild the user's privacy dataset. It has been proved experimentally that GAN may be used to rebuild user privacy data [35]. To address the aforementioned issues, federated learning commonly employs several privacy-enhancing techniques, including homomorphic encryption [22; 24; 36] and differential privacy [12; 37; 38; 39].