Balancing the trilemma: a survey of federated anomaly detection for secure cyber-physical systems

Abstract The proliferation of Cyber-Physical Systems (CPS) across critical infrastructure has created an unprecedented attack surface where digital threats may precipitate catastrophic physical consequences. As conventional centralized security paradigms fail to address the scale and complexity of these environments, Federated Learning (FL) has emerged as a transformative approach, enabling collaborative, edge-native anomaly detection without centralizing sensitive data. This paper presents a comprehensive survey and critical analysis of the state-of-the-art in securing CPS through advanced FL. We introduce a novel multi-axis taxonomy that systematically categorizes the field by architecture, detection methodology, application domain, and privacy-preservation scheme. Building on this analysis, we synthesize these findings into a prescriptive framework to guide the selection of appropriate security archetypes for different CPS domains. Through this lens, we deconstruct the—the trade-off between accuracy, communication, and privacy- that governs every FL design. Our analysis synthesizes the dominant trends, including the convergence of deep learning with edge computing and the increasing sophistication of privacy-enhancing technologies. We further identify critical research gaps, including the scarcity of physical testbeds, limited resilience against advanced adversarial attacks, and underdeveloped explainability. The paper concludes by defining the critical frontiers for future research, emphasizing the need to resolve the inherent tension between FL’s privacy goals and the transparency requirements of Explainable AI (XAI) to build truly trustworthy systems.