Private Computation Space: Experience with Trusted Multi-Cluster Federated Learning for Agriculture

Shuangyu Lei; Muhammad Salman Abid; Jacob Belding; Sam Mosher; Manushi B. Trivedi; Shivranjani Baruah; Liam Wickes-Do; Andrew Anderson

cs.CRSep 1, 2026

Private Computation Space: Experience with Trusted Multi-Cluster Federated Learning for Agriculture

Authors: Shuangyu Lei, Muhammad Salman Abid, Jacob Belding, Sam Mosher, Manushi B. Trivedi, Shivranjani Baruah, Liam Wickes-Do, Andrew Anderson,

Organizations: Cornell University USA

Abstract

Artificial Intelligence has shown to help improve agricultural practices, yet adoption remains limited: 69% of U.S. farmers have privacy concerns with sharing their data, and these concerns must be addressed before adoption is widespread. While Federated Learning has been demonstrated to protect privacy at scale for other sectors, deploying a system for agriculture comes with its own set of challenges; the problem necessitates a system that can protect farmer data and identities while preserving model utility, runs on commodity hardware, and is resilient to fragile rural infrastructure. To address these concerns, we introduce the Private Computation Space (PCS), a deployed, open-source Machine Learning system to provision and process farmer data securely. We design a system tailored to an agricultural setting, with multi-cluster orchestration for reliability in rural areas with asynchronous Federated Learning (FL), Differential Privacy (DP), and Trusted Execution Environments (TEEs), to allow farms to participate in the framework while keeping their data private. We evaluate the system on two deployed workloads: monitoring nitrogen with living plant sensors in NY for six months and predicting evapotranspiration from weather stations in CA for ten months. Our evaluation finds a Dice Similarity Coefficient (DSC) of 0.71 and $R^2$ accuracy of 0.84 for the respective workloads, improving the worst single-site model accuracy by 22.4% and 9.1%, respectively, while preserving privacy.

Figures & tables

Figure 1. Multi-cluster Federated Learning deployment for nitrogen estimation with sentinel plants in New York.

Figure 2. FarmBot ( Inc., ) imaging setup at a greenhouse client. The robot carries a camera that captures each of the 54 tomato plants in the bench.

Figure 3. Multi-cluster Federated Learning deployment for ET prediction across California. Ten climatically distinct weather stations (labeled by station ID) run as FL clients. Map colors correspond to ET zones ( , 2025 ) .

Figure 4. Nitrogen deployment : Federated segmentation of one greenhouse plant over a 14-day cycle.

Figure 5. Daily live ET predictions versus station-measured ET across the ten CIMIS stations for ten months.

Reality	Complex threat model and privacy goals	Heterogeneous workloads and constrained privacy mechanisms	Fragile farm infrastructure and scarce heterogeneous data
Lesson	Privacy preservation requires combining FL, TEE-secured aggregation, and Differential Privacy.	Generalizable framework requires model-agnostic privacy techniques.	Resilient deployment requires multi-cluster orchestration and asynchronous FL.

Table 1. Three operational realities and lessons learned of privacy-preserving agricultural deployments.

Figure 6. Overall design diagram for PCS with multi-cluster orchestration. Each training task (model, config) spawns an aggregator-trainer pair, each aggregator has a one-to-one relationship with a trainer downstream.

Figure 7. Overall design diagram for PCS with multi-cluster orchestration. Each training task (model, config) spawns an aggregator-trainer pair, each aggregator has a one-to-one relationship with a trainer downstream.

Panel of Figure 8 — Figure 8. Example federated request for ET deployment.

Figure 9. Trusted Execution Environment Threat personas.

Deployment	Data	Model	Training	Privacy
Nitrogen monitoring (NY)	3 farms (2 greenhouses, 1 field); 1,090 images.	Leaf segmentation; U-Net + MobileNetV2 ( $\alpha{=}0.35$ ).	Pretrained on public dataset ( Steininger et al., 2023 ; Hughes and Salathé, 2015 ) ; fine-tuned on client data; aggregated with FedAdam.	DP-FTRL Gaussian; central DP; per-layer adaptive clipping ( $C_{0}{=}0.5$ ); Rényi-DP ( $\delta{=}10^{-5}$ ).
ET prediction (CA)	10 CIMIS stations of distinct climates; $34{,}107$ samples.	Next-day ET regression; stacked LSTM ( $h{=}64$ , 2L).	Trained on 2008–2020; tested on 2020–2025; aggregated with FedAvg.	DP-FTRL Gaussian; central DP; global adaptive clipping ( $C_{0}{=}0.5$ ); Rényi-DP ( $\delta{=}10^{-5}$ ).

Table 2. Summary of the two deployments on PCS.

Panel of Figure 10 — Figure 10. Nitrogen deployment : Segmentation accuracy and visualization (see § 6.1 for details). The color configuration of bars in 10(a) matches the color configuration of masks in 10(b) , except for the local models that remain neutral such that the background stays visible.

Figure 11. ET deployment : Prediction accuracy,

R^{2}

, across training settings and privacy budgets. See

\lx@sectionsign\ref{sec::eval-accuracy}

for details.

Panel of Figure 12 — Figure 12. ET deployment : AsyncFL (FedBuff) evaluation with trace-replayed CIMIS station availability. See $\lx@sectionsign\ref{sec::eval-async}$ for details. Buffer size $K$ is the number of client updates the server waits for before aggregating.

Figure 13. Nitrogen deployment : Three representative one-week availability traces from a greenhouse client under high, medium, and low availability.

	$E$	Bare (s)	TEE (s)	$\Delta$
Nitrogen	1	146.07	146.01	$+0.0\%$
	2	289.87	286.61	$-1.1\%$
	4	574.97	573.00	$-0.3\%$
ET	1	14.40	14.49	$+0.6\%$
	2	26.31	26.36	$+0.2\%$
	4	48.98	49.33	$+0.7\%$

Table 3. Median per-round time for bare and TEE server configurations across local epoch

E

\Delta

is relative to bare.

Privacy-Preserving Federated Learning

See all 41 papers

Differentially Private Clustered Federated Learning with Privacy-Preserving Initialization and Normality-Driven Aggregation
Apr 22, 2026Jie Xu, Haaris Mehmood, Rogier Van Dalen +2Federated Learning Aggregation Non-IID Federated Learning
Samsung R&D Institute UK (SRUK) · Samsung AI Centre Cambridge
Secure and Privacy-Preserving Vertical Federated Learning
Apr 15, 2026Shan Jin, Sai Rahul Rachuri, Yizhen Wang +2Privacy-Preserving Federated Learning Federated Learning
Visa Research
FecalFed: Privacy-Preserving Poultry Disease Detection via Federated Learning
Apr 1, 2026Tien-Yu ChiClassification Federated Learning
Independent Researcher

Apr 22, 2026J/K move · Enter open · S save

Differentially Private Clustered Federated Learning with Privacy-Preserving Initialization and Normality-Driven Aggregation

Jie Xu, Haaris Mehmood, Rogier Van Dalen, Karthikeyan Saravanan+1

Samsung R&D Institute UK (SRUK) · Samsung AI Centre Cambridge

Federated Learning Aggregation Non-IID Federated Learning Differentially Private Federated Learning Clustered Federated Learning Federated Learning Privacy-Preserving Federated Learning

Open paper AskPDF arXiv

Federated learning (FL) enables training of a global model while keeping raw data on end-devices. Despite this, FL has shown to leak private user information and thus in practice, it is often coupled with methods such as differential privacy (DP) and secure vector sum to provide formal privacy guarantees to its participants. In realistic cross-device deployments, the data are highly heterogeneous, so vanilla federated learning converges slowly and generalizes poorly. Clustered federated learning (CFL) mitigates this by segregating users into clusters, leading to lower intra-cluster data heterogeneity. Nevertheless, coupling CFL with DP remains challenging: the injected DP noise makes individual client updates excessively noisy, and the server is unable to initialize cluster centroids with the less noisy aggregated updates. To address this challenge, we propose PINA, a two-stage framework that first lets each client fine-tune a lightweight low-rank adaptation (LoRA) adapter and privately share a compressed sketch of the update. The server leverages these sketches to construct robust cluster centroids. In the second stage, PINA introduces a normality-driven aggregation mechanism that improves convergence and robustness. Our method retains the benefits of clustered FL while providing formal privacy guarantees against an untrusted server. Extensive evaluations show that our proposed method outperforms state-of-the-art DP-FL algorithms by an average of 2.9% in accuracy for privacy budgets (epsilon in {2, 8}).

Abstract

Privacy-Preserving Federated Learning

Explore similar work

Differentially Private Clustered Federated Learning with Privacy-Preserving Initialization and Normality-Driven Aggregation

Secure and Privacy-Preserving Vertical Federated Learning

FecalFed: Privacy-Preserving Poultry Disease Detection via Federated Learning