Privacy-preserving clustered federated learning via differential privacy and homomorphically encrypted prototypes

Clustered federated learning (CFL) is an effective paradigm for handling statistical heterogeneity by grouping clients with similar data characteristics and learning cluster-specific models. However, existing CFL methods often expose sensitive clustering signals or cluster-specific updates to the server, which may reveal latent client similarity relations and weaken privacy protection. To address this issue, we propose Privacy-Preserving Clustered Federated Learning (PPCFL), a split-stream framework that integrates adaptive Gaussian perturbation with threshold Paillier encrypted aggregation. In PPCFL, backbone updates are protected by adaptive Gaussian perturbation before plaintext aggregation, while clustering signatures and cluster-head updates are first perturbed by stream-specific adaptive Gaussian mechanisms and then uploaded under threshold Paillier encryption. The server performs ciphertext-domain aggregation for clustering prototypes and cluster-head updates, whereas plaintext prototypes and cluster-level decrypted aggregates are recovered by a qualified threshold-decryption client subset without giving the server decryption capability. In addition, PPCFL adopts round-wise budget growth, utility-aware refinement, and adaptive clipping-threshold updates to improve the privacy-utility trade-off under dynamic Non-IID settings. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 show that PPCFL achieves the highest final-round accuracy among the evaluated methods in the reported settings while providing enhanced protection for clustering-related information and cluster-specific updates. Under the representative Dirichlet setting [Formula: see text], PPCFL improves the final accuracy over DP-FedAvg by 0.33, 1.73, and 2.62 percentage points on MNIST, Fashion-MNIST, and CIFAR-10, respectively, and over IFCA by 0.98, 8.28, and 10.24 percentage points.