A Survey of Security in Cloud-Edge-Device Distributed Machine Learning: Trustworthy Challenges Under Heterogeneity

Distributed Machine Learning (DML) is becoming the mainstream paradigm for collaborative model training under the Cloud-Edge-IoT architecture. Federated Learning (FL), as a representative technology within it, allows multiple parties to jointly train models without centralizing raw data. However, while the decentralization of data, computation, updates, and orchestration brings privacy advantages, it also significantly expands the attack surface and introduces coupled challenges across multiple dimensions, including privacy, robustness, reliability, fairness, and governance. A recent survey paper takes security as its focus and heterogeneity as its perspective, systematically mapping out the research roadmap for trustworthy DML and placing federated learning under close examination as a high-risk scenario.

How Are the Security Boundaries of Distributed Machine Learning Defined

The survey first defines the security boundaries of DML/FL, including assets, adversaries, trust assumptions, and coordination modes. In cloud-edge-device systems, assets include not only model parameters and training data but also orchestration logic, communication links, and end devices. Adversaries may come from external attackers, malicious participants, or even honest-but-curious servers. Differences in trust assumptions—for example, the differing trustworthiness of participants in cross-silo versus cross-device scenarios—directly determine the choice of defense strategies. Coordination modes (such as synchronous/asynchronous and centralized/decentralized) also affect the feasibility of attacks and the difficulty of detection. This framework lays the foundation for the subsequent analysis of the impact of heterogeneity.

Cross-silo and cross-device are two typical coordination modes in federated learning, and their trust assumptions and system constraints differ significantly. Cross-silo scenarios involve a small number of institutions (such as hospitals and banks), with few participants but large data volumes, ample computing resources, and high online rates. Contracts or regulatory constraints typically exist among participants, and trust levels are relatively high, though the risk of honest-but-curious servers remains. Cross-device scenarios involve massive numbers of terminals (such as phones and IoT devices), with dispersed data, constrained resources, intermittent connectivity, and anonymous, untrusted participants, making it easier for malicious parties to launch Sybil attacks or strategically drop out. These two modes directly determine the choice of defense mechanisms: cross-silo settings can deploy heavier cryptographic protocols and audit processes, whereas cross-device settings require lightweight, dropout-tolerant robust solutions. Therefore, trust heterogeneity is not an abstract concept but an engineering constraint concretely shaped by coordination modes.

How Heterogeneity Affects Convergence, Fairness, and Defense Reliability

The survey provides an in-depth analysis of the impact of statistical heterogeneity, system heterogeneity, and trust heterogeneity on DML/FL. Statistical heterogeneity manifests as non-independent and identically distributed (non-IID) data, which leads to unstable model convergence and a global model biased toward certain clients, thereby affecting fairness. System heterogeneity includes resource asymmetry and intermittent participation, making it difficult for some devices to complete training tasks; attackers may exploit this instability to hide malicious behavior. Trust heterogeneity is reflected in the differing trust levels of participants across cross-silo and cross-device scenarios, which affects the reliability of defense mechanisms (such as robust aggregation). The article points out that heterogeneity not only degrades model performance but also undermines attack detectability and defense effectiveness, necessitating heterogeneity-aware defense design.

Non-independent and identically distributed (non-IID) data is the most typical source of statistical heterogeneity in federated learning. In cross-device scenarios, each client's local data is often determined by its individual usage habits, leading to skewed label distributions, differing feature distributions, or highly imbalanced sample sizes. Non-IID data causes client drift: each local model drifts toward the optimal solution for its own data distribution during optimization, and the aggregated global model may deviate from the true global optimum, manifesting as convergence oscillation, accuracy degradation, and systematic bias against certain clients. Mitigation approaches include the proximal term constraint in FedProx, control variate correction in SCAFFOLD, and personalized federated learning. Understanding the causes and manifestations of non-IID is a prerequisite for analyzing fairness and the decline in attack detectability, because distribution differences themselves amplify the overlap region between malicious and benign updates.

The Attack-Defense Game: From Poisoning to Privacy Leakage

The survey systematically reviews the attack-defense interactions in DML/FL, covering poisoning attacks, backdoor attacks, Byzantine manipulation, privacy leakage, model extraction, network/orchestration attacks, Sybil behavior, and strategic participation. These attacks may occur during training, aggregation, or inference, and often combine with one another. On the defense side, the article compares layered defense strategies, including robust aggregation, drift-aware optimization, differential privacy, secure aggregation, homomorphic encryption, secure multi-party computation, trusted execution environments, watermarking, provenance tracking, authenticated communication, and monitoring. Each defense has its applicable scenarios and limitations; for example, differential privacy protects privacy at the cost of model accuracy, while secure aggregation relies on cryptographic assumptions but may incur computational overhead. The article emphasizes that no single defense can address all threats and that defenses need to be combined according to heterogeneity characteristics.

Secure Aggregation is a cryptographic protocol that allows multiple parties to upload their local model updates without exposing them, with the server obtaining only the aggregate sum of all updates. Typical implementations rely on secret sharing and key agreement: clients upload masked updates, and the server completes the sum without being able to decrypt individual updates, with results recoverable even if some clients drop out. Its security assumptions typically include semi-honest participants, the existence of a trusted coordinator, or threshold dropout tolerance. In federated learning, secure aggregation can be stacked with differential privacy—the former hides individual updates, while the latter limits privacy leakage from the aggregate result. However, secure aggregation incurs significant computation and communication overhead and has limited robustness against frequent dropouts in cross-device scenarios, so trade-off design must account for heterogeneity characteristics.

Byzantine fault tolerance and robust aggregation target scenarios where participants may send arbitrary malicious updates. Classic aggregation rules such as coordinate-wise median, trimmed mean, and Krum suppress the influence of extreme values through statistically robust estimation. However, under non-IID data, these methods may misclassify legitimate updates from benign clients as anomalous, because differences in data distributions across clients naturally cause gradient directions to diverge. Therefore, the design of robust aggregation must be considered jointly with statistical heterogeneity—for example, by introducing drift-aware weight adjustment or reference-gradient-based anomaly scoring—to maintain defense effectiveness in highly heterogeneous environments.

Open Challenges in Deployment, Evaluation, and Governance

Finally, the survey discusses deployment, evaluation, governance, and open research directions. On evaluation, the article emphasizes the need for reproducible non-IID data partitioning, attack-aware benchmarks, and attention to metrics such as privacy budget, attack success rate, client-level disparity, latency, communication, memory, energy/carbon overhead, and auditable lifecycle artifacts. Governance involves auditing, compliance, and lifecycle management. These open problems indicate that trustworthy DML is not merely a technical issue but also involves the coordination of system design, evaluation methodologies, and policy governance.

Overall, this survey provides a structured analytical framework for trustworthy distributed machine learning in cloud-edge-device systems, highlighting the role of heterogeneity as a core variable in security, privacy, and robustness. For researchers and engineers, it suggests that when designing DML/FL systems, heterogeneity must be incorporated into threat models and defense design, and multi-dimensional evaluation metrics should be adopted rather than focusing solely on model accuracy.

One-line Summary

This survey takes heterogeneity as its perspective and systematically reviews the security boundaries, attack-defense dynamics, and governance challenges of cloud-edge-device distributed machine learning.

Paragraph Summary

This survey focuses on trustworthy distributed machine learning under the cloud-edge-device architecture, with federated learning as its primary analytical subject. The article first defines the security boundaries of DML/FL, covering assets, adversaries, trust assumptions, and coordination modes; it then analyzes how statistical, system, and trust heterogeneity affect model convergence, fairness, and defense reliability; it systematically reviews attack surfaces such as poisoning, backdoors, privacy leakage, and model extraction, and compares the applicability and limitations of layered defenses including robust aggregation, differential privacy, secure aggregation, and trusted execution environments; finally, it discusses open challenges such as evaluation benchmarks, multi-dimensional metrics, and governance frameworks. The core conclusion is that heterogeneity should be incorporated into threat models and defense design, and that trustworthy DML requires the coordinated advancement of technology, evaluation, and governance.