## 3 Preliminaries
### Battery Consumption and Privacy Loss
#### 3.5.2 Case 2: Device Does Not Participate in Training  
If a device does not participate in training, the battery decreases only due to background activities or idle battery consumption. This can be modeled as follows:  
\[bat_{t+1}=bat_{t}-\beta \tag{5}\]  
where \(\beta\) is a fixed idle battery drain constant, estimated based on typical standby energy consumption observed in edge and mobile devices [27].  
Similarly, privacy loss is modeled based on how much information can be inferred from the client's participation in FL. The weights and biases of a neural network (NN) can contain indirect information about the dataset used to train the model. While these parameters do not directly store the raw data, they are learned from it during the training process. As the model optimizes its weights and biases to minimize the loss function, these parameters reflect patterns and features specific to the training data. For example, in Model Inversion Attacks, an adversary can exploit these learned weights to reconstruct features or even specific samples from the training dataset, despite never directly accessing the data itself [28]. Additionally, in Membership Inference Attacks, attackers can infer whether a particular data point was part of the training set by analyzing the model's predictions and the confidence levels of those predictions [29]. This is possible because a model's behavior typically differs for data seen during training and unseen data. For instance, the model may provide more confident predictions or overfit to specific patterns learned during training, allowing attackers to identify membership. These privacy vulnerabilities demonstrate that while FL minimizes direct data sharing, the model's parameters themselves may still reveal sensitive information about individual client data, necessitating the use of privacy-preserving techniques such as differential privacy [18]. Over time, the cumulative exposure of sensitive information due to repeated participation in FL results in privacy degradation, reflecting a gradual decline in the client's data confidentiality. Each interaction causes a quantifiable privacy loss, representing the specific amount of information potentially leaked during that training round. Moreover, the degree to which a client's data or device is vulnerable to such privacy risks depends on its privacy sensitivity--an intrinsic characteristic influenced by factors such as data uniqueness, device security, and context. The impact on privacy as a client participates in the FL process can be modeled as follows:  
\[priv_{t+1}=priv_{t}-\delta\cdot\frac{\|\mathcal{D}_{update}\|}{\text{total number of clients}} \tag{6}\]  
where  
* \(priv_{t}\) represents the privacy level at time \(t\);
* \(priv_{t+1}\) is the privacy level after the client has participated in the next round;
* \(\delta\) is the privacy degradation factor, a parameter that defines how much each update reduces privacy;
* \(\mathcal{D}_{update}\) refers to the magnitude of the update sent by the client to the server, which is determined by the difference in the client's local model compared to the global model;
* The total number of clients is included to account for the dilution of privacy as more clients contribute updates to the global model.  
This formula represents how the privacy level of a client diminishes over time as they participate in the FL process and share updates with the server. As more clients contribute to the model, the privacy loss is diluted, but it is still a key consideration in the selection process [30,31].