## 3 Materials and Methods  
### Overall Research Workflow  
The research workflow, illustrated in Figure 3, was systematically organized to enhance repeatability. The sequential steps are detailed as follows:  
\(1\)**Data Collection:**  
* The dataset utilized in this study was accessible for download from our Kaggle repository [49]. Alternatively, researchers had the flexibility to use their own dataset tailored to specific applications, as the proposed method was application-agnostic. * A comprehensive explanation of the dataset processing was available in Section 3.2. The set of images utilized in this research is illustrated in Figure 4.  
Figure 3: The overall research workflow in this work. 2. **Data Labeling:** * Immediate labeling of the dataset occurred right after capturing the images or videos to ensure accuracy. * Given that the dataset's primary purpose was air quality measurement, label values were extracted from official website data, providing air quality parameters at the time of data capture. * For alternative datasets, meticulous attention to correct labeling was imperative. 3. **Data Partitioning:** * Recognizing that federated client computational power is typically less powerful than that of the central server, handling only a limited amount of data is feasible. * To showcase the proposed method, the dataset was partitioned into smaller subsets, each containing 1224 images. These subsets were then distributed across all clients and servers for experimentation. * If federated clients lacked GPU support, it was advisable to reduce the number of subsets to prevent extended processing times, ensuring a more efficient execution of the entire process. 4. **Model Development or Selection:** * In this step, we employed a model derived from our previous research [50], adjusting it to suit the current study's goals. The model architecture in this study is presented in Figure 5. * Researchers could choose any model, whether self-developed or established (e.g., MobileNet, ResNet, VGG16), as long as it met their study's objectives and enhanced the global model's robustness. * The detailed architecture of our chosen model is provided in Section 3.3. 5. **Adversarial Sample Generation:** * For adversarial training to be conducted, adversarial samples were required. * In order to generate adversarial samples, the original dataset was utilized. A variety of attack techniques were capable of producing adversarial samples. * In this research, we specifically employed the FGSM and PGD methods, each meticulously explained in Section 3.4. * The data label for the adversarial samples was the same as the original dataset used. * It was recommended to perform adversarial sample generation after data partitioning for ease of data verification, considering the time-intensive nature of the process. 6. **Natural Training:** * Natural (conventional) model training was performed using a dataset comprising normal data devoid of adversarial samples. * The objective was to obtain key metrics, particularly model accuracy, serving as a baseline for comparison with subsequent experimental results. * Further details on this training step were elaborated in Section 4.2.1, with hyperparameters specified in Table 1.
7. **Natural FGSM Adversarial Training:** * This phase mirrored natural training, with the distinction that the dataset incorporated both normal and FGSM adversarial samples. The dataset composition was detailed in Section 4.4.1. 8. **Natural PGD Adversarial Training:** * Similar to natural training, this step involved utilizing a dataset comprising normal data alongside PGD adversarial samples (see Section 4.4.1 for dataset details). * **Normal FL:*
* This step employed one federated server and four federated clients (with the option to add more based on available resources in replication) and focused on observing global model performance under non-attack conditions. * The primary objective was to examine the process under ideal circumstances, establishing a baseline for global model accuracy.