  Federated Learning (FL) in the Internet of Things (IoT) environments can
enhance machine learning by utilising decentralised data, but at the same time,
it might introduce significant privacy and security concerns due to the
constrained nature of IoT devices. This represents a research challenge that we
aim to address in this paper. We systematically analysed recent literature to
identify privacy threats in FL within IoT environments, and evaluate the
defensive measures that can be employed to mitigate these threats. Using a
Systematic Literature Review (SLR) approach, we searched five publication
databases (Scopus, IEEE Xplore, Wiley, ACM, and Science Direct), collating
relevant papers published between 2017 and April 2024, a period which spans
from the introduction of FL until now. Guided by the PRISMA protocol, we
selected 49 papers to focus our systematic review on. We analysed these papers,
paying special attention to the privacy threats and defensive measures --
specifically within the context of IoT -- using inclusion and exclusion
criteria tailored to highlight recent advances and critical insights. We
identified various privacy threats, including inference attacks, poisoning
attacks, and eavesdropping, along with defensive measures such as Differential
Privacy and Secure Multi-Party Computation. These defences were evaluated for
their effectiveness in protecting privacy without compromising the functional
integrity of FL in IoT settings. Our review underscores the necessity for
robust and efficient privacy-preserving strategies tailored for IoT
environments. Notably, there is a need for strategies against replay, evasion,
and model stealing attacks. Exploring lightweight defensive measures and
emerging technologies such as blockchain may help improve the privacy of FL in
IoT, leading to the creation of FL models that can operate under variable
network conditions.
