## 1 Introduction
The scope of our investigation includes a comparative assessment of attack probabilities and the extent of potential losses between centralized systems and the FL paradigm. Figure 1 illustrates a generalized cloud-based architecture for smart cities, along with potential attack scenarios. This architecture typically collects data from a variety of IoT devices, such as wearable devices, smart sensors, and data loggers, which are used to support applications in areas such as intelligent monitoring, intelligent transportation, and intelligent healthcare. The collected data is then transmitted to edge computing servers, which significantly reduces data transport latency to and from centralized cloud data centers. Edge computing plays a crucial role in facilitating real-time data processing and decision-making, a key requirement for applications demanding immediate responses, such as autonomous vehicles, robotics, and monitoring systems [15; 16; 17; 18; 19; 20]. By employing edge processing and filtering, only relevant information is transmitted to the cloud, thereby reducing network traffic [20; 21]. This optimization is particularly beneficial for applications with limited bandwidth. Furthermore, edge computing enhances data security and privacy by limiting data exposure to external cloud services and keeping sensitive data within a local network. This approach aligns with best practices to safeguard data privacy [16; 17; 21]. The concept of edge AI has gained prominence with the advent of edge AI devices, such as the NVIDIA Jetson Xavier AGX (NVIDIA, Beijing, China), NVIDIA Jetson TX2 (NVIDIA, China), NVIDIAJetson Xavier NX (NVIDIA, China), Google Coral Dev Board (Google Coral, Taiwan, China), and Intel NUC (Intel, Beijing, China). These devices are equipped with graphical processing units (GPUs) and substantial computational capabilities, enabling advanced AI applications at the network's edge [22; 23; 24; 25; 26]. Two potential attack scenarios that may occur in cloud architecture are illustrated in Figure 1. Attack scenario A targets the edge server, which plays a critical role as a data storage and processor for a wide variety of IoT devices. This data often includes confidential and sensitive information [16; 17; 21]. If an attack is successful, unauthorized actors could gain access to the confidential information of numerous clients, which could have significant financial consequences. Attack scenario B focuses on compromising the cloud server, which stores a significantly larger amount of data than the edge server. The cloud server acts as a centralized repository for all data collected from interconnected edge servers. The Orvibo incident [7] serves as a prime example, demonstrating how an attacker was able to access over two billion records from a cloud server with relative ease. In Section 3.5, a thorough explanation of FL will be presented. This section will conduct a thorough examination of potential attack scenarios in order to evaluate the data leakage risk associated with the FL system. FL computational tasks are primarily performed on nodes called federated clients (FCs). This approach is designed to prioritize user privacy and minimize the amount of data shared between devices. Consequently, FL has the potential to significantly improve the security and privacy of the overall system [8; 13; 27; 28; 29]. To facilitate understanding of how FL reinforces security and privacy protocols, we refer to Figure 2 illustrates two distinct attack scenarios:  
* Scenario A: An adversary attempts to compromise an FC. FCs can be a wide variety of devices, including personal computers, IoT devices, smartphones, and minicomputers (e.g., Raspberry Pi (Raspberry Pi, Wales, UK) and NVIDIA Jetson Nano (NVIDIA, China)). If the attack is successful, only the affected client's data will be compromised; the data of other clients will remain unaffected [13; 14]. This is a significant advantage over cloud-based architectures, which are vulnerable to large-scale data breaches.