## 6 Future Research Trajectories for FL Ecosystem
* _Intelligent methods for inference-time vulnerability mitigation:_ After multiple rounds of training, the trained model can be deployed to serve people. However, there are plenty of interference-time vulnerabilities that stem from trained model deployment. For example, the model can yield low accuracy on different versions of the test data carefully crafted by an attacker. The credibility and fairness of the final results produced by the FL model can be low due to the higher diversity in data. Furthermore, scalability and verifiability are two main challenges in this context. To alleviate such issues, intelligent methods are required to lower interference-time vulnerabilities and make FL models trustworthy. * _Practical methods for enhancing security and privacy in FL ecosystems:_ FL ecosystems are constantly targeted by active/passive attackers to impair model performance [66; 67]. Attacks that corrupt/damage global model performance by manipulating either model updates or samples of training data are referred to as poisoning attacks (PAs) [68]. PAs can be classified into two types:
* Data PA: integrity breach in training data \(\rightarrow\) global model corruption. * Model PA: manipulation of model updates (i.e., training procedure \(\rightarrow\) global model corruption). Both PAs can cause severe damage to global model performance (i.e., wrong classifications/predictions) and are difficult to detect. We present both these attacks with practical examples in Figure 10.  
Some developments, such as federated distillation, moving target defense, trusted execution environments, DP-powered FL for parameter/update security, anomaly detection, pruning, ZKPs, adversarial training, legitimate client recognition, clipping gradients, federated multi-task learning, and SMC, have recently emerged to tackle these PAs and their variants. Although these approaches are handy, certain limitations exist regarding emerging adversarial threats [69]. Hence, proposing practical methods to enhance security and privacy in the FL ecosystem from major adversarial attacks without compromising accuracy is an interesting area of research. * _Simultaneous optimization of multiple types of trade-offs in FL systems:_ There exist multiple types of trade-offs in FL systems such as privacy-accuracy trade-offs, privacy-poising trade-offs, privacy-convergence trade-offs, and privacy-fairness trade-off [70,71]. Recently, researchers have resolved more than two types of trade-offs in FL environments. [PERSON] et al. [72] explored the solution for three different types (e.g., robustness, privacy, and governance) of trade-offs in distributed AI systems. [PERSON] et al. [73] explored ways to solve three types (security, robustness, and privacy) of trade-offs to make FL more trustworthy. [PERSON] et al. [74] explored ways to resolve privacy, utility, and efficiency objectives in FL environments. To this end, more methods are required that can effectively resolve the trade-offs of different kinds without degrading performance. * _Adoption of data-centric AI approaches to address data quality problems:_ The application of data-centric approaches [[https://landing.ai/data-centric-ai/](https://landing.ai/data-centric-ai/)]([https://landing.ai/data-centric-ai/](https://landing.ai/data-centric-ai/)) (accessed on 10 February 2024) to enhance data quality within the framework of COVID-19-oriented FL is very challenging due to the higher diversity in the amount and type of data across hospitals. In the COVID-19 era, there was a huge skew in the data across hospitals such as feature skew, labels skew, quality skew, and quantity skew. However, the solution for quantity skew poses more challenges in server-side aggregation as the local models trained with long-tail distributed data cannot fairly contribute to the global model's performance [75].