# FREDY: Federated Resilience Enhanced with Differential Privacy
## 2 Related Work and Backround
### Membership Inference Attack Models  
The attacker can obtain different amounts of information to attack machine learning models. Usually, the attackers have access to two types of information: the distribution of training data and the target model. In most cases of Membership Inference Attacks, it is assumed that the distribution of training data is available to an attacker. This means that the attacker can obtain a dataset that contains data with the same distribution as the target model's training data. This assumption is reasonable because the dataset can be obtained through statistics-based synthesis if the data distribution is known [28]. It is assumed that the newly created dataset and the training dataset are disjoint. Knowledge of the target model refers to how the target model is trained (i.e., the learning algorithm) and the architecture and learned parameters of the target model. Based on the adversary knowledge, we can characterize the existing attacks as follows:  
* **White-box Attack:** An adversarial has access to all kinds of information such as the training data distribution, the learned parameters, etc., and uses it to attack a target machine learning model [37; 38; 39; 40; 41].
* **Black-box Attack:** An adversarial has black-box access to a target model meaning that it has information about the training data distribution and the black-box queries on the target model. For example, the attacker queries the target model and obtains only the raw prediction probability of the input data [42; 43; 44; 45; 46; 47].  
The most common way to implement a membership inference attack model is to treat it like a binary classification problem. Given the input data x and access to the target model  
Figure 1: Structure of Federated Learning.  
(e.g., the model's raw predictions, learned parameters, etc.), an attacker infers whether or not x is in the dataset. In other words, a binary classifier is trained that can distinguish the behavior of training members of a target model from that of non-members. The challenge is how to train such a classifier. In [28], the authors proposed an effective technique called shadow training, which is the first and perhaps most widely used approach. Particularly, the attacker is aware of the architecture of the target model and thus can generate shadow models in order to realize membership inference attacks. These shadow models mirror the behavior of the target model but are trained on known and labeled training data. By utilizing the shadow models which possess ground truth knowledge of membership, the attack model is trained to distinguish between the target model's behavior on familiar training inputs and its behavior on previously unseen inputs. This enables the attack model to effectively determine whether a specific input was part of the target model's training dataset or not. Through shadow training, the technique offers a potent means to quantify the extent of membership information leakage in machine learning models.  
In this paper, we are focusing on the black-box attack type, where the adversarial has access only to the data distribution and the output predictions when querying a target model. The shadow training attack framework proposed in [28] is applied in our experiments to evaluate the robustness of the proposed FREDY against membership inference attacks.