## 2 Related Work
### Privacy-Preserving Techniques  
Privacy preservation in federated learning is a topic of interest because of the sensitivity of healthcare data. Simple techniques such as data masking and encryption are somewhat effective but they are not a solution to the modern threats which can even use aggregate data to their advantage [12]. DP and SMPC have proved to be the most effective methodologies for boosting privacy in federated environments [13]. Differential Privacy is achieved by adding noise to model updates to be transmitted while protecting the individual patient records from being identified from the aggregated results. LDP, proposed by [14], means that noise is added at the source (each institution), while GDP adds noise during the aggregation process. These methods have been employed broadly in FL implementations in healthcare, such as in the work of [15]. But the problem of privacy vs. model usefulness persists, and here excessive noise is a problem as it can harm the model [16]. Another widely used technique is Secure Multi-Party Computation (SMPC), which also allows the performance of computations on encrypted data. Study [17] came up with an efficient SMPC protocol for federated learning where no party can have access to the raw data during aggregation. This method has been implemented and effective in the healthcare systems where there is a need to train a model jointly across different institutions without compromising patient privacy. However, with SMPC, there is always a large computational cost, which becomes a problem of scalability and real-time processing [18]. Federated learning (FL) ensures data security by employing methods like Secure Multi-Party Computation (MPC), Differential Privacy, and hardware-based solutions. These techniques facilitate the creation and deployment of distributed, multi-party machine learning systems and statistical models across diverse data sources. Beyond concerns of data privacy, the concept of the \"model\" itself warrants careful consideration, as federated models are vulnerable to various risks, including plagiarism, unauthorized copying, and misuse. To address these issues, FedIPR, a novel ownership verification scheme that embeds watermarks into FL models, was developed in [19]. The approach enables the verification of FL model ownership and safeguards intellectual property rights (IPRs or IP-rights). Therefore, the notion of federated learning was revised, and the architecture of Secure Federated Learning (SFL) was introduced. The overall goal of SFL is to build reliable and secured AI systems with high levels of privacy and IPR protection. Study [20] presents a strong privacy-preserving federated learning model that is immune to model poisoning attacks while maintaining accuracy. The approach proposed an internal auditor that compared the encrypted gradient similarity and distribution to distinguish between normal and adversarial gradients. These models did not, however, support hierarchical FL, and thus could not be deployed in a large-scale network. In addition, privacy mechanisms such as DP and SMPC had not been implemented diligently or at all, thus leaving a gap in privacy vulnerability. Table 1 shows a summary of the related literature on federated learning (FL), highlighting each study's focus area, methodology, key findings, and limitations. Our model addresses this gap by having both design hierarchy and formal privacy assurances.