## 1 Introduction
* Scenario B: An adversary attempts to gain unauthorized access to the federated server (FS). However, since FL data are primarily stored on FCs, a successful attack on the FS would not expose any FL data. Therefore, FL can significantly enhance the security and privacy of conventional IoT systems. By adopting FL, organizations can improve data protection and reduce the risk of data intrusions similar to the one that occurred at Orvibo [7]. Figure 1: Attack scenarios in cloud-based architecture. Although federated learning (FL) can improve security and privacy compared to centralized systems, it is still vulnerable to adversarial attacks, as shown in previous research [27; 29; 30; 31; 32; 33; 34; 35; 36]. If this vulnerability is not properly addressed, it could lead to data leakage [8; 13; 28]. However, the aggregation procedure used in FL makes it difficult to extract private data from gradients. Therefore, the most common attack method in FL is to join as a client and send malicious updates to the server, which can lead to incorrect model decisions and reduced accuracy [27; 30; 33; 34; 35; 36]. If an AI model used in a sensitive system, such as loan evaluation or healthcare applications, is successfully attacked, the consequences for users could be severe. To address the aforementioned challenges, we propose federated adversarial training (FAT) strategies to enhance privacy and security in sustainable smart city applications. FAT is a mechanism that has been shown to improve the robustness of FL models [30; 34; 36] despite the inherent complexity of this task. Our experimental results demonstrate promising outcomes, suggesting that FAT is a promising approach for practical use. In this paper, we select an air pollution monitoring system as a case study due to its significant societal impact and its ability to exemplify the effectiveness of our proposed solution in improving privacy and security within sustainable smart city applications. The structure of our contributions in this paper is as follows:  
* We conducted a thorough examination of a wide range of adversarial attack scenarios targeting federated learning. * Our findings have been experimentally validated, leading to the presentation of an adversarial learning strategy aimed at enhancing the overall robustness of the global model. * We have successfully demonstrated the practicality of implementing our technique in situations with limited data capacity on the client side. It is important to note that prior research has recognized the challenges related to integrating adversarial training in a federated context, primarily due to the data-intensive nature of this training process. * Our study provides valuable insights that can serve as a foundation for the development of additional defense scenarios and countermeasures against adversarial attacks, ultimately contributing to the reinforcement of security measures for sustainable smart city applications. The paper is structured as follows: Section 2 provides an extensive discussion of related works concerning security and privacy issues in smart city applications, along with a review of prior approaches to addressing these challenges. Section 3 offers a comprehensive account of the materials and methods employed in our proposed solution. In Section 4, we present detailed experimental results and engage in a thorough discussion of these findings. Finally, Section 5 encompasses the conclusion of this paper, summarizing the key takeaways and implications. Figure 2: Attack scenarios in FL-based architecture.