## 3 Differential Private Federated Learning in Distributed Public Administration
### Differential Private Federated Learning Architecture  
This section describes our DPFL design strategy and its implementation approach. The DPFL workflow is explained in Figure 1. Each participating region serves as a client, training a local model with a unique data set. This initial training period is followed by the following unique phases:  
* Phase 1: FL Training (Baseline Model): Local models are trained on regional data to build a baseline for future improvement.
* Phase 2: Noise addition with DP: To preserve data privacy, properly calibrated noise is introduced to local model updates before they are transmitted to the central server.
* Phase 3: MIA Evaluation: The baseline and noisy models are compared to the simulated MIA attempts. This step assesses how effectively models avoid exposing whether individual data items contributed to their training.
* Phase 4: Secure Model Aggregation: All _noisy_ model updates are then transmitted to a centralized server. These updates are combined to produce a global model. This model is ultimately improved by repeated iterations of local training and global aggregation while preserving data privacy. \[f(w)=\frac{1}{K}\sum_{k=1}^{K}f_{k}(w_{k})\] (2) where: \[f(w)\] is the objective function of FL, also know as the loss function; \[K\] is the number of total clients in the FL system; \[w_{k}\] indicates the weight of the model on each client; \[f_{k}\] is the local objective function of the client. Equation (2) represents FL's objective function [41]. It is used to collect local updates from individual clients during the training process. The intention is to minimize the sum of each client's local objective functions, resulting in global optimization while maintaining the data as distributed and private [42].  
Figure 1 also shows the workflow of inference attacks in FL that extract information about member data from leaked data representations or from the global model [43].  
Our work focuses on membership inference attacks (MIAs). The methodical execution of our research design is described in Figure 2. Pre-processing steps are performed to improve the quality of the data. After that, the setup of the federated environment is developed, and the data are distributed to the chosen clients, such as different regions. We develop the model's architecture and choose the training settings as the setup comes together, putting a particular focus on incorporating DP protections. A central server manages the secure transmission and aggregation of model changes throughout the training loop. In addition to increasing the accuracy of the model, these developments also check the level of privacy assurance shown by measures such as Renyi differential privacy (RDP) and the privacy parameters epsilon (\(\epsilon\)) and delta (\(\delta\)) (Section 3.2).  
Figure 1: Differential private federated learning model workflow for distributed public administration process; the workflow also illustrates threats of the membership inference attack model.  
In MIAs, an additional layer is added during the evaluation process. This involves assessing the vulnerability of the core model to privacy breaches. Two MIA models are examined: (1) MIAs without noise; (2) MIAs with added noise to simulate DP conditions.  
These models are trained on the attack data set with predictions from the primary model. Evaluation criteria, such as accuracy and the F1 score, are used to assess performance (success rates) in the presence of various levels of noise. This research sheds light on  
Figure 2: Federated learning workflow in distributed public administration.  
potential privacy attacks, directing changes to the primary model privacy procedures that improve overall resilience and security in real-world applications. The final phase of the diagram focuses on model refinement, which ensures continuous excellence in real-time application performance and privacy needs.