# FREDY: Federated Resilience Enhanced with Differential Privacy
###### Abstract
These multifarious attacks collectively underscore the compelling exigency for robust privacy preservation methodologies to fortify the integrity of machine learning models against these pervasive threats. As an intricate facet of privacy attacks in the domain of machine learning, black-box membership inference attacks [19; 20; 21] hold a prominent position. Membership inference attacks aim to determine whether a specific record or a data point has been used in the training procedure of a machine learning model. In cases when the training dataset of a machine learning model contains sensitive data such as medical records, these kinds of attacks can be extremely harmful. Particularly, the adversarial has access to model's predictions, and based on their statistical distribution it decides whether a record is part of a model's training data or not. There are several approaches about training an adversarial for model inference attacks [22; 23; 24; 25; 26; 27], with [28] being a solid baseline in the area. The authors of [28] propose the first membership inference attack model on several classification models in the context of machine learning. They show that an attacker can determine whether a data point has been used to train a network or not based on the probabilistic output of the network on that data record (also known as black-box access to the target ML model). To protect the privacy of training data, the authors of [29] propose PATE (Private Aggregation of Teacher Ensembles). In this framework, initially, an ensemble of teacher models is trained on private and sensitive data. Then, a student model, which is later released to the public, is trained with supervised learning on public, unlabeled, insensitive data, whose labels are generated by noisy aggregating the teacher outputs on those public data. That said, the student model does not depend on any of the training data points and thus the privacy of the training data is protected. However, PATE treats teachers as individuals and does not consider the federated learning scenario, a scenario where the server-aggregated model can be vulnerable to adversarials and expose data information. In this paper, we introduce FREDY, a federated learning framework which uses knowledge transfer from private data. FREDY exploits both the data privacy from FL, as the data remain private and locally in each client of the FL system, and the data leakage protection from PATE [29]. Particularly, FREDY has a teachers-student scheme. The teachers are trained in a federated form, acting as clients of an FL system, and then knowledge is transferred from teachers to student by noisy aggregating the teachers' outputs on the student's public data. Finally, the student model is publicly available and can successfully respond to user queries without the risk of data leakage when it is being attacked from adversarials such as model inference attacks. Our proposed FREDY model architecture is evaluated in the widely used benchmark datasets CIFAR10 [30] and MNIST [31], achieves data privacy and prevents data leakage against possible attackers while it combines the federated learning settings. FREDY leverages the synergy between federated learning and differential privacy to bolster resilience in data-driven applications. By combining these two powerful techniques, FREDY enhances the robustness and privacy of the model training process. Federated learning allows FREDY the training of models collaboratively across distributed data sources, such as different institutions or devices, without centralizing sensitive information. This decentralized approach enhances resilience by minimizing the risk of a single point of failure and enabling the system to continue functioning even if certain participants experience disruptions. Differential privacy, on the other hand, introduces noise into the model training process, making it extremely challenging for attackers to reverse-engineer individual data points.