## 3 Differential Private Federated Learning in Distributed Public Administration
### Federated Learning with Privacy Quantification  
Algorithm 1 trains a global model using distributed private data from multiple locations (regions). Start with the global model parameters, local payroll or opinion data for each location, and DP settings. The global model is updated iteratively through communication between clients and a central server. Each location uses stochastic gradient descent to train a local model, which is then perturbed with Gaussian noise for privacy before being sent to the server. The central server collects these changes, adjusts the global model, evaluates its performance, and calculates privacy loss using the Gaussian RDP accountant. This cycle continues until convergence, which results in a globally trained model with DP guarantees. ```
1:Global model parameters \(\theta\)
2:Local data \(D_{1},D_{2},\ldots,D_{K}\)
3:Differential privacy parameters: epsilon (\(\epsilon\)), delta (\(\delta\))
4:Central server
5:Differential private global model parameters \(\theta^{*}\)
6:Initialize \(\theta^{*}=\theta\)
7:for\(t=1\)to\(T\)do
8:for each client \(k\in\{1,2,\ldots,K\}\)do
9: Train local model \(\theta_{k}\) on \(D_{k}\) using global parameters \(\theta\) and SGD optimizer
10: Add Gaussian noise to local model updates: \(\Delta\theta_{k}=\Delta\theta_{k}+\epsilon\mathcal{N}(0,\sigma^{2})\)
11: where \(\sigma\) is calculated according to Equation (4) with SGD as \(\Delta f\)
12: Send local model updates \(\Delta\theta_{k}\) for all \(k\) to the central server. 13:endfor
14:At the central server:
15: Combine model updates \(\Delta\theta_{k}\) from all clients \(k\in\{1,2,...,K\}\) to build the aggregated update \(\Delta\Theta\). 16:\(\Delta\theta=\frac{1}{K}\sum_{k=1}^{K}\Delta\theta_{k}\)
17: Update the global model parameters \(\theta^{*}=\theta^{*}+\Delta\theta\)
18: Calculate model performance metrics (as in Table 2) on the testing set
19: The RDP accountant is used to convert the accumulated RDP privacy loss into \((\epsilon,\delta)\)-DP guarantees at the end of the training. 20:endfor
21:return DPFL global model parameters (\(\theta^{*}\))
```  
**Algorithm 1** DPFL with Quantifiable Privacy for Distributed Public Administration  
Algorithm 2 addresses inference attacks in FL. Using a test data set called \(\mathcal{T}\), the program compares the predictions of an FL model, \(f\), with the actual labels in \(\mathcal{T}\). Successful predictions and actual label matches imply that the corresponding data were used throughout the model training phase. The algorithm explores the vulnerabilities associated with data leaks, indicated by \(\mathcal{D}\). The algorithm differentiates between data from the training set that have been leaked and data from outside the training set (MIA). Although the technique offers a potentially valuable method for verifying who utilized whose data in the model's training, it also raises privacy concerns. If an attacker discovers which employee's data were used in model training, that person could be subject to vulnerabilities. In FL, there are several ways to prevent MIAs. Using DP measures to prevent MIAs is one method. DP is a technique that adds noise to data representations so that it is difficult to determine whether a given data point was used in model training [50; 51]. ```
1:Test set \(\mathcal{T}\) with labeled data \(y_{t}\),
2:indicating whether the participant was used to train the FL model. 3:Model of FL \(f\) for Payroll/Opinion data. 4:Representations of data leakage \(\mathcal{D}\). 5:Inference of the usage of sensitive information (whether \(\mathcal{T}\) data points were used in training \(f\))
6:Initialize inference vector \(\mathcal{I}=\mathbf{0}\)\(\triangleright\) 0 indicates no participation
7:Initialize the inferred sensitive information \(S=\emptyset\)
8:for\(t\in\mathcal{T}\)do
9:Make a prediction for data point \(t\) using model \(f\): \(\hat{y}=f(t)\).