Privacy-Preserving Federated Learning for Cryptography Cybersecurity in Uganda: Robustness Under Distribution Shift and Sparse Labels

The federated monitoring of cryptographic failure and cyber-intrusion signals across Ugandan institutions inherits two under-addressed tensions: client event distributions drift with sectoral traffic, software configuration and adversary behaviour, and attack labels remain sparse because cryptographic incident confirmation is slow, costly and legally sensitive. It combines local differential privacy with a distributionally robust semi-supervised objective over Wasserstein perturbations. The main results are a Kantorovich–Rubinstein bound relating tolerated distribution shift and loss variation, an excess-risk bound for confidence-thresholded pseudo-labelling under sparse labels, and a privacy-utility trade-off specified through Rényi differential privacy and secure aggregation. The framework distinguishes what can be guaranteed at design time from what must be validated by local security operations alone. The result is not an empirical report on Ugandan data; it is a mathematically stated protocol of assumptions, theorems and implementation conditions tailored to Uganda's inter-institutional cyber incident monitoring under the Data Protection and Privacy Act 2019.