The convergence of Artificial Intelligence (AI) and the Internet of Things (IoT) has resulted in the emergence of the Artificial Intelligence of Things (AIoT), a technological paradigm that enables intelligent, autonomous, and interconnected environments known as smart societies [1]. AIoT can be defined as an integrated paradigm in which IoT devices sense and exchange data while AI models perform learning, inference, and optimization—often at the edge and/or cloud—to enable context-aware and autonomous decision-making in real time. Internet of Things (IoT) began as networks of connected sensors and devices that mostly collected and transmitted data. The field has since evolved into Artificial Intelligence of Things (AIoT), where these devices also analyze, learn from, and act on data autonomously [2]. This shift is driven by advances in AI, edge computing, and cheap, powerful hardware [3]. These societies are underpinned by a network of AI-empowered IoT devices that collaborate to enhance life quality across domains such as healthcare, transportation, manufacturing, and urban infrastructure [4]. AIoT systems facilitate real-time data acquisition, contextual analysis, and autonomous decision-making, thus transforming conventional environments into responsive ecosystems [5]. In applications such as smart homes, intelligent healthcare systems, and autonomous transportation, AIoT significantly improves operational efficiency, predictive capabilities, and user personalization [6]. However, this convergence also raises serious concerns regarding security, privacy, and ethical data governance. The simultaneous integration of AI with the IoT has greatly accelerated the development of AI-of-Things (AIoT) systems, which assess and react to environmental stimuli more intelligently without the need for human intervention. However, the negative effects of data volume, velocity, and veracity, as well as catastrophic transmission latency on networking infrastructures, make processing large amounts of data on the cloud difficult or impossible [7].

AIoT systems are commonly described through a layered architecture that includes (i) a perception/sensing layer for data acquisition from heterogeneous devices, (ii) a communication/network layer for reliable data transfer, (iii) an edge/fog intelligence layer that performs low-latency analytics and on-device inference under resource constraints, (iv) a cloud layer that supports large-scale storage and model training, and (v) an application and decision layer that delivers services and automated actuation within smart society domains.

Despite the transformative potential of AIoT, the deployment of these systems in smart societies introduces new vulnerabilities [8]. The proliferation of devices increases the surface area for cyberattacks, while the sensitive nature of the data being exchanged especially in healthcare and smart governance exacerbates privacy risks [9]. Traditional security mechanisms such as centralized access control and standard encryption are often inadequate for heterogeneous, decentralized AIoT architectures [10]. Emerging attacks, including adversarial manipulation of AI models, data poisoning, and device spoofing, further complicate the deployment of secure AIoT systems [11]. These challenges necessitate a new generation of lightweight, scalable, and privacy-preserving solutions that are specifically designed for AIoT-enabled environments as shown in Fig. 1.

As AIoT becomes a foundational technology in smart societies, ensuring its security and privacy remains a critical research problem. The dynamic and distributed nature of AIoT systems, coupled with limited computational resources of edge devices, renders conventional security approaches inefficient or infeasible [12].

Moreover, current literature lacks a consolidated understanding of how recent state-of-the-art mechanisms, such as blockchain, AI, machine learning (ML), federated learning, and trusted execution environments, can be applied effectively across application domains [13]. In addition, there is a need for a structured synthesis that links (i) AIoT applications, (ii) security and privacy challenges, and (iii) evidence reported in real-world or simulated evaluations to support design and deployment decisions in smart society environments [14].

This systematic literature review (SLR) provides a comprehensive analysis of recent advancements in securing AIoT systems within the context of smart societies. The SLR is guided by three core research questions. First, it identifies the applications of AIoT in smart society environments and the emerging security and privacy challenges associated with deployment. Second, it examines state-of-the-art techniques and frameworks proposed to mitigate these challenges and considers their effectiveness across application domains. Third, it evaluates how these mechanisms perform under real-world or simulated conditions, with emphasis on scalability, reliability, and compliance with privacy and security standards, as shown in Fig. 2. This SLR analyzes peer-reviewed literature from 2020 to 2025 to extract key themes, classify solutions, assess efficacy, and identify open research challenges.

To clearly distinguish the manuscript’s contributions from the background and motivation, the contributions are summarized below in a compact form:

Categorizes and synthesizes AIoT security and privacy challenges in smart society environments, with emphasis on encryption, access control, federated learning, and blockchain integration.

The remainder of the article is summarized as follows. Section 2 is a detailed the background of existing works related to AIoT in various domains like smart buildings, transportation, healthcare, and smart cities. It summarizes methodologies, limitations, and opportunities found in the literature using a comparison table. Section 3 is the detailed methodology. Section 4 outlines challenges, and each challenge is described along with its disadvantages and potential solutions. Section 5 presents blockchain, ML, and AI-based methods proposed by different researchers to overcome each challenge, which cover the solutions across domains like healthcare, transportation, and smart cities. It also discusses open challenges and research gaps that hinder the wide-scale deployment of secure AIoT. Fig. 3 represents the structure of the paper, and Table 1 represents the list of abbreviations.

Smart buildings and smart homes. The authors [25] examine AIoT-enabled smart building systems and emphasize that interoperability issues and privacy risks remain dominant concerns when coordinated security strategies are absent. In the smart home context, reference [26] explore AI and blockchain synergy for secure local data exchange and show that blockchain-assisted protection can be effective at small scale; however, they highlight limitations when extending these solutions to city-scale AIoT deployments. Taken together, these studies agree that local protection mechanisms can be effective in constrained environments, but they differ in scalability assumptions, and they collectively indicate that extensible architectures and standardized interfaces are still missing for broader adoption.

Smart cities and urban governance. Several studies focus on smart city infrastructures and governance. The authors [27] identify cyber-policy gaps and weak interconnection between digital infrastructures and AI governance, noting the lack of technical implementation guidelines for security. Efficiency, innovation and sustainability of nations are among the objectives of smart governance to change nations into smart cities. The challenges are associated with administrative reform, development of infrastructure, and data security and big data management with a strategic frame required to implement and transition [28]. The authors [22] discuss AI and IoT deployment in smart urban systems but emphasize persistent vulnerabilities across the data lifecycle and the absence of unified security frameworks. The authors [29] similarly identify implementation barriers and conclude that the lack of integrated secure communication standards remains a key limitation. The authors [30] emphasize the benefits of AI in smart cities while noting that privacy-preserving tools remain inadequate at scale. Across these studies, a common theme is the gap between strategic smart-city planning and technical security implementation. While the works differ in emphasis—policy and governance [28], device-level and context-aware defenses [30], and data lifecycle protection [22] they consistently indicate that standardized, scalable, and technically actionable security frameworks are still lacking for smart society deployments [17].

Enterprise, industry, and agriculture AIoT. In enterprise environments, reference [31] proposes a privacy management framework based on risk analysis and highlights the need for AIoT-specific governance mechanisms; however, the study does not sufficiently address real-time autonomous threats without an integrated security layer. In broader industrial and agricultural AIoT settings, reference [32] report data leakage and inconsistent encryption practices as core challenges and recommend tighter integration between AI decision engines and network defense policies. Both studies converge on the need for stronger governance and consistent security practices, but they differ in orientation: enterprise privacy governance [31] vs. multi-sector technical challenges such as encryption inconsistency and integration fragmentation [32]. The missing element across both directions is an integrated approach that jointly addresses governance requirements and technical enforceability under real operational conditions.

Architectures and system integration for secure AIoT. The Industrial Internet of Things (IIoT) is susceptible to numerous security threats, and they are divided into different groups in accordance with the tier to which the threats are directed. These attacks are breaking important security requirements. New technologies, such as AI and the use of edges, are under consideration to solve these security issues and improve system protection on the whole [33]. Semantic interoperability is also problematic in Industry 4.0 because of the complicated automation systems and a variety of standards. This paper examines how semantic interoperability and AI could overcome the impediments in the IoT framework. The paper centers on the topic of trying to use Named Entity Recognition (NER) AI models and Natural Language Processing (NLP) to enhance identification and processing of IoT data, and increase semantic interoperability [34]. These studies collectively show that architectural proposals can improve connectivity and interoperability, yet security analytics and integrated protection remain underdeveloped, indicating a gap in operational security integration across heterogeneous AIoT systems.

Blockchain- and ML-enabled security mechanisms. An architecture that integrates AI, machine/deep learning, and blockchain can be used to improve the security of IoT devices. Machine learning assists in detection of attacks, and blockchain is used to verify requests and provide cryptographic security. This method enhances protection of IoT system by predicting and preventing attack before it impacts on system [35]. A major issue in cybersecurity is side-channel attacks, which exploit the weaknesses, which include power consumption and acoustic emission of cryptographic systems.

This SLR is driven by a set of focused research questions (RQs) designed to explore the core themes, applications, challenges, and solutions surrounding the deployment of AIoT systems in smart society environments. These questions help frame the review’s purpose, guide the search strategy, and support structured data extraction and synthesis. The research questions are:

RQ1: What are the applications of AIoT and smart society and what are the emerging security and privacy challenges associated with the deployment of AIoT systems in smart society environments?

The term actual source refers to the digital libraries and academic repositories from which the retrieved studies are obtained. For this study, we selected leading scholarly digital libraries, namely SpringerLink, ACM Digital Library, IEEE Xplore, ScienceDirect, and Wiley Online Library, to retrieve relevant peer-reviewed literature related to AIoT systems in smart society environments. Access to full-text articles from these databases was essential to ensure accurate extraction, analysis, and synthesis of prior research findings.

Different search strategies were adapted to the indexing structure and query syntax of each digital library to maximize coverage while maintaining relevance. The screening process was conducted progressively across multiple stages, including title and keyword screening, abstract screening, and full-text evaluation. Table 3 and Fig. 6 illustrate the distribution of retrieved studies across the selected digital libraries and show how the initial pool of publications was systematically reduced at each screening stage to obtain the final set of eligible studies.

To ensure comprehensive and systematic retrieval of relevant literature, search strings were carefully designed using combinations of keywords, Boolean operators, “And”, “OR” and truncation where appropriate. The formulation of the search string was driven by the three predefined research questions, focusing on AIoT applications, security and privacy techniques, and evaluation metrics.

The search strategy included the following core keyword categories, and Table 4 shows the search string formulation, and Fig. 7 shows the process of formulating the search string:

AIoT Technologies: “Artificial Intelligence of Things”, “AIoT”, “smart devices”.

To ensure the relevance and quality of the selected studies, the following inclusion and exclusion criteria were applied during the systematic review process:

In literature reviews, SLRs and meta-analyses, qualitative methods are a specified set of techniques for judging the worthiness, credibility and quality of research attempts. Qualitative methods are accepted platforms or techniques for determining the validity, equivalence, and the structure of the quality asserts. By introducing quality control methods and proofs of results, we can ensure that the primary studies which we have selected are able to provide sufficient information to answer our research questions, as shown in Table 5. In this step, each research topic is compared with the standard.

In this review, the quality assessment criteria (Q1–Q7) were applied as a structured qualitative checklist to verify the relevance and methodological adequacy of the candidate studies for addressing RQ1–RQ3. The assessment was used to support consistent inclusion decisions rather than to compute a numerical quality score or apply a quantitative threshold. Inter-rater agreement metrics (e.g., Cohen’s kappa) were not computed; this limitation is acknowledged in the “Limitations and Threats to Validity” subsection.

The primary study selection process followed a systematic and structured approach. Initially, a comprehensive search was conducted across four leading digital libraries. The formulated search strings were applied consistently across all sources to retrieve literature relevant to AIoT applications in smart society environments, with a specific focus on security and privacy. Duplicates and irrelevant articles were excluded based on their titles and abstracts. The remaining studies were examined in full to assess their relevance to the predefined inclusion criteria and their ability to answer the three research questions. Eligible articles were subjected to a rigorous quality evaluation based on established criteria, ensuring methodological soundness and empirical relevance. Only studies that satisfied all inclusion criteria were included in the final synthesis. As a result, 147 primary studies were found that met the consistent quality criteria. The original studies are reported in Fig. 8 and Table 6, and Fig. 9 shows the procedure used in this study for the corresponding selection process in a schematic representation. This process ensured the selection of robust, high-quality research to inform the findings and insights of this SLR.

The final search strings were constructed from the three research questions (RQ1–RQ3) by mapping each question to four keyword categories: (i) AIoT core terms, (ii) application domains, (iii) security and privacy concepts, and (iv) techniques and evaluation terms. Candidate synonyms were collected for each category and then combined using Boolean operators (“AND”, “OR”) and truncation where applicable. The finalized terms and category mapping are summarized in Table 4, and the overall formulation process is illustrated in Fig. 7. The same structured logic was applied across the selected digital libraries to ensure consistent retrieval aligned with the scope of the review.

Study selection was performed in successive screening stages consistent with Table 3. First, the initial query results were collected from the selected digital libraries. Second, duplicates were removed. Third, title and keyword screening was applied to exclude clearly irrelevant studies. Fourth, abstract screening was conducted to apply the inclusion and exclusion criteria. Fifth, the introduction and conclusion were checked to verify that each study directly addressed AIoT in smart-society contexts with a security/privacy focus. Finally, full-text screening was performed to confirm eligibility before inclusion in the final synthesis.

After full-text eligibility was confirmed, each candidate study was evaluated using the quality assessment questions Q1–Q7 (Table 5) as a structured checklist to ensure methodological soundness and relevance. Specifically, Q1 verified clarity of objectives; Q2 assessed methodological soundness (framework/model/algorithm); Q3 ensured direct relevance to AIoT smart-society applications; Q4 verified that security/privacy was addressed explicitly; Q5 checked the use or evaluation of state-of-the-art techniques (e.g., blockchain, ML, federated learning); Q6 verified empirical support (experiments, simulations, or real-world case studies); and Q7 confirmed that limitations and future work were discussed. Studies that did not adequately satisfy these quality criteria were excluded prior to final synthesis.

AIoT applications are transforming smart societies across domains such as homes, healthcare, agriculture, cities, and industries as shown in the Fig. 10 [38]. These technologies improve efficiency, safety, and quality of life through real-time monitoring, automation, and intelligent decision-making. However, there are multiple challenges in AIoT deployment in different domains and these challenges are like data privacy, system scalability, reliability, and integration complexity, as shown in Fig. 11 and Table 7. Addressing these issues requires robust AI algorithms, blockchain integration and federated learning-based solutions to secure IoT infrastructures, and regulatory frameworks [39]. Continued innovation and cross-disciplinary collaboration are essential to realize the full potential of AIoT in smart environments.

As these systems become more interconnected and data-intensive, they expose new security and privacy vulnerabilities [69]. Addressing these challenges is critical to prevent data breaches, ensure user trust, and maintaining the safe operation of essential services. Below is the table, which is the conclusion of the challenges and provides a description of each challenge for deployment in AIoT systems in smart society environments.

These vulnerabilities can erode public trust and create compliance challenges with privacy regulations. To mitigate this, research emphasizes the use of latest techniques and, differential privacy, and decentralized encryption mechanisms to protect data across distributed nodes [70]. The heterogeneity and scale of AIoT systems make robust authentication and access control a daunting task. In a smart healthcare setup, unauthorized control over sensors or actuators can cause devastating disruptions [71]. There is a need for the latest techniques and identity frameworks to address these vulnerabilities. Smart society environments are characterized by a high degree of heterogeneity in device types, manufacturers, and communication protocols. Lack of interoperability limits cross-system integration, data sharing, and coordinated responses in scenarios such as smart transportation and emergency management. Researchers have emphasized the need for unified communication models [72].

Most AIoT devices deployed at the edge operate with limited computational resources and energy supplies [7]. This restricts the implementation of advanced encryption, real-time analytics, and AI inference on-device [73]. Emerging solutions should focus on on-device intelligence, and hardware-level optimization for energy-efficient AI processing [64]. Many AIoT systems rely on centralized cloud platforms for data storage and processing, which introduces single points of failure and increased latency [74]. If the cloud server or network connection experiences downtime, the entire AIoT ecosystem may become inoperative. This dependency also raises cybersecurity and privacy risks, as sensitive data must travel across networks to the cloud, making it susceptible to interception or breaches [75]. In mission-critical applications such as traffic control and response, delays caused by cloud dependency can lead to catastrophic consequences [76]. AIoT ecosystems are expected to accommodate billions of interconnected devices in future smart cities [77]. However, current infrastructure struggles with bandwidth, processing overload, and inefficient routing as networks scale. Scalable solutions such as modular architectures, decentralized AI processing, and adaptive routing protocols are proposed to meet the demands of expanding smart societies [78].

As AIoT applications expand, aligning with regional and international data protection laws has become increasingly complex [79]. Recent studies, such as [80] emphasize that this regulatory inconsistency poses one of the greatest challenges for AIoT adoption, urging the development of harmonized global standards to ensure secure, lawful, and interoperable data management. Non-compliance may not only result in legal repercussions but also hinder cross-border system integration and trust [81]. Every device added to an AIoT ecosystem introduces a new vector for potential attacks. DDoS, spoofing, and zero-day exploits become increasingly difficult to prevent as the system expands [82]. In smart transportation, such breaches could paralyze city infrastructure or endanger lives. Decentralized intrusion detection systems and AI-driven threat intelligence platforms are critical for real-time detection and mitigation [83]. Public apprehension about being monitored and profiled by AIoT systems poses a barrier to widespread adoption [84]. People are especially concerned about data collected in private settings such as smart homes or personal health monitorsData flowing through AIoT systems must remain accurate and tamper-proof to ensure reliable decision-making. If attackers alter data streams in smart healthcare or safety systems, it can result in false alarms and missed warnings [85]. There is need of validation and secure audit trails, which are emerging as promising approaches to guarantee data integrity and traceability [86]. Implementing secure validation and audit trail mechanisms is essential for building trustworthy, transparent, and compliant AIoT systems that support ethical data governance [87].

Below, State-of-the-art techniques are described to enhance security and privacy in AIoT ecosystems. These approaches reduce cloud dependency, protect sensitive data, and enable secure decentralized processing across domains. Fig. 12 shows the pictorial representation of the different techniques to overcome the challenges in AIoT deployment in smart societies, and Table 8 describes a summary of the different solutions with their purpose, domain and effectiveness. Their effectiveness has been demonstrated in healthcare, smart cities, transportation and other domains by improving data integrity, reducing latency, and enabling compliance with privacy regulations.

The blockchain- and AI-based mechanisms demonstrate strong performance in simulated and real-world deployments, particularly in terms of scalability, reliability, and regulatory compliance.These solutions enhance reliability through tamper-proof data handling and low-latency decision-making [135]. Fig. 13 represents the general benefits and real-world deployment and Table 9 is the comparison table of summarizing methods, threats addressed, and limitations.

Evaluation of current solutions involves assessing how existing AIoT security and privacy methods perform in real-world and simulated settings. Research gaps highlight areas lacking sufficient study, such as dynamic threat adaptation and standardized compliance frameworks. Table 9 below shows the summarizing methods, threats addressed, and limitations and Fig. 14 shows the impact of current solutions, open challenges and research gaps.

Although this SLR primarily follows a qualitative synthesis approach, it is complemented by a structured quantitative comparison based on performance metrics explicitly reported in the selected primary studies. This comparison focuses on four deployment-critical dimensions for AIoT-enabled smart societies: detection effectiveness, latency, resource efficiency, and scalability.

Several recent AIoT and IIoT security studies report quantitative detection performance metrics such as accuracy, detection rate, and false positive rate. For example, the authors [138] report an intrusion detection framework for IoT-enabled healthcare achieving 98.1% accuracy, 2.1% false positive rate, and 85–95 ms latency, demonstrating suitability for time-sensitive medical environments. The authors [139] present an edge-deployable decision-tree-based IDS evaluated on IIoT traffic, achieving 97.9%–98.2% accuracy with sub-millisecond inference time (≈0.8 ms), highlighting the feasibility of real-time protection on constrained edge devices. Similarly, reference [140] demonstrate a compressed DNN-KDQ intrusion detection model with 99.43% accuracy, 0.07 ms inference time per sample, and a significant model size reduction from 196.77 to 20.18 KB, making it well suited for resource-limited AIoT nodes.

From a resource-efficiency perspective, multiple studies explicitly quantify energy and computational overhead. The authors [141] show that a microservice-based privacy-preserving AIoT analytics framework reduces CPU usage and latency at the edge while maintaining analytical accuracy. The author [142] evaluates edge-assisted task offloading in smart environments and reports measurable reductions in energy consumption and execution delay compared to cloud-centric baselines. These results indicate that edge-centric and lightweight AI designs are increasingly capable of meeting AIoT energy constraints.

Scalability is quantitatively validated in several studies through experiments involving increasing numbers of devices or nodes. The authors [143] further demonstrate a hybrid AI–blockchain authentication framework achieving ≈15 ms authentication latency at 1000 devices, confirming scalability in dense AIoT deployments. In blockchain-enabled architectures, references [144,145] report throughput improvements and reduced consensus overhead using sharding-based designs, while references [146,147] emphasize scalability gains enabled by federated and edge-to-cloud AIoT architectures. Smart home systems apply modern machine learning, including ensemble learning and neural networks, in automated decision-making, such as the management of IoT devices in accordance with their usual routine. The adoption of blockchain technology, guaranteed decentralized authentication and attention to cost-effective components and the design oriented on security will help to reduce the threat of privacy and cyber-attacks.

Overall, this quantitative comparative synthesis—based on reported metrics rather than recomputed statistics—grounds the review’s findings in measurable evidence (Table 10). It enables cross-study comparison of effectiveness, timeliness, resource efficiency, and scalability while avoiding unsupported statistical aggregation across heterogeneous datasets and evaluation protocols.

This systematic literature review is subject to several limitations that should be acknowledged when interpreting the findings. First, the review considers peer-reviewed publications published between 2020 and 2025, which may exclude earlier foundational works and very recent studies published after the search cutoff date. While this time window was intentionally selected to capture recent and relevant advances in AIoT security and privacy, it may limit the longitudinal perspective of the analysis.

Second, the literature search was conducted using a predefined set of major academic digital libraries. Although these sources are widely recognized and cover a large portion of high-quality AIoT research, relevant studies published in other venues, industrial white papers, standards documents, or preprint repositories may not have been captured, introducing potential selection bias.

Third, the inclusion and exclusion criteria, as well as the quality assessment process, rely on structured but inherently qualitative judgment. Despite the use of clearly defined assessment questions (Q1–Q7), some degree of subjectivity in study selection and evaluation cannot be fully eliminated.

Finally, due to the heterogeneity of application domains, evaluation metrics, and experimental settings across AIoT studies, the review emphasizes qualitative and comparative synthesis rather than quantitative meta-analysis. As a result, direct statistical comparison across studies is limited. These constraints do not undermine the validity of the review but should be considered when generalizing the results and identified research gaps.