# Lightweight Anomaly Detection in Digit Recognition Using Federated Learning
## 5 Federated Training of Edge Autoencoders  
To evaluate FL on constrained embedded platforms, we implemented a real-world experimental testbed involving ten ESP32-CAM devices and a central server connected via Wi-Fi, as described in the System Architecture section. Each device was equipped with an SD card to store its local training and test sets and run the same model architecture and identical hyperparameters. However, the training data was partitioned differently across devices to reflect data diversity and imbalance often encountered in real-world deployments. This setup enabled us to evaluate FL performance directly on actual hardware, with a focus on convergence behavior under non-IID (non-identically independently distributed) conditions and the system's robustness to corrupted or anomalous data in IID (identically independently distributed) conditions. To facilitate communication and model aggregation, a Wi-Fi server acts as the central node in the federated system. Training is organized in alternating rounds of local training and federated aggregation. After each training round, devices send their updated models to the server, which aggregates them using federated averaging (FedAvg) [52] and redistributes the resulting global model to all participants for the next round. We adopted the anomaly threshold computation method proposed in [44], which enables devices to collaboratively determine a global anomaly threshold via device-to-device communication. Specifically, we used the formula (5) from [44], where each device computes a global threshold \(\alpha^{n}\) by aggregating the local thresholds \(\beta^{n}\), and received thresholds \(\alpha^{k}\) from neighbors:  
\[\alpha^{n}\leftarrow\frac{\sum_{k\in\text{nbr}(n)}\alpha^{k}+\alpha^{n}+\gamma \beta^{n}}{|\text{nbr}(n)|+1+\gamma}. \tag{1}\]Here, \(\alpha^{n}\) represents the global anomaly threshold for device \(n\), and \(\beta^{n}\) is its locally calculated threshold based on training data (e.g., using 95 th percentile metric). In our setup, we do not perform true peer-to-peer communication; instead, devices send their values to a central server, which mimics neighbor aggregation. Therefore, the number of neighbors is fixed to \(|\mathrm{nbr}(n)|=10\) for all devices, and we use a weighting coefficient of \(\gamma=0.1\). Unlike the model, which is synchronized across devices, the anomaly threshold remains device-specific. This aggregation method allows each device to retain a threshold that reflects its local data distribution while incorporating information from the broader network. As a result, thresholds remain slightly biased toward local conditions, which improves their suitability for detecting anomalies in each device's context. This balance is especially useful after additional rounds of local fine-tuning, where a personalized threshold performs better than a purely averaged one. Additionally, to ensure efficiency and avoid unnecessary computation, we employ a previously described dual-phase early stopping mechanism, adapted for FL. While early stopping is still applied at the local level during each device's training phase (as in the standalone setup), we additionally apply early stopping at the global level for federated training. After each round, when devices receive the updated global model and complete the following local training phase, they evaluate their performance and vote on whether to terminate the training. A device votes to stop if the model's performance has not improved for a predefined number of rounds. In our implementation, we adopt the strictest configuration with _patience phase_2 set to 0, meaning that even a single round without improvement triggers the voting. If the majority of devices vote to stop, the FL process is terminated, conserving both communication and energy resources once convergence has been effectively reached.