# FedCrow: Federated-Learning-Based Data Privacy Preservation in Crowd Sensing
## 4 Evaluation
### Experimental Results And Analysis
#### 4.2.2 Attack Resistance Experiment
Unlike poisoning attacks, where abnormal data are used for training before sending the model to the server, model attacks directly manipulate the client's model parameters. In both cases, the uploaded client models are incorrect, exhibiting significant dissimilarity from those of other normal users, resulting in lower model similarity. Consequently, the user contribution levels of these attackers  
Figure 8: Model training with a user that conducted a poisoning attack. **(a)** The similarity of the parameter matrices. **(b)** The model accuracy. Figure 7: The process of a poisoning attack. decrease, leading to a smaller proportion in model aggregation during fusion. From the graph, it is evident that although the model attacks also slowed down the convergence of the model, the malicious users employing model attack methods hardly affected the overall model accuracy after the convergence. **(5) Existence of inference attacks:** In the fifth experiment, an inference attack was employed. Inference attacks are techniques that gather information in various ways, including eavesdropping and monitoring, and utilize logical thinking and reasoning abilities to obtain desired information. The process of the inference attack is illustrated in Figure 11.  
The results are illustrated in Figure 12. Within the federated-learning framework, attackers can leverage their insights into the current and future environments to acquire valuable data. They can utilize gradient analysis of the training model to better achieve predictive objectives. Therefore, in inference attacks, malicious users can train with normal  
Figure 6.0 The process of inference attacks. Figure 6.1 Model training with a user that conducted a model attack. (**a**) The similarity of the parameter matrices. (**b**) The model accuracy. Figure 6.2 The process of model attacks. data and only need to recover the original data of clients from the global model to obtain data from other users. As a result, the overall model accuracy of the server attacked using this method remains unchanged, and the model can be used normally. Although inference attacks can retrieve original data, the federated-learning framework constructed in this study utilizes differential privacy for data transmission encryption. By sacrificing a certain level of data accuracy, it provides strict privacy protection for user data. Adding appropriate noise to the output of statistical queries makes it nearly impossible for attackers to distinguish between statistical differences in two adjacent datasets, thus maximizing the privacy of the user data. The comparison of the results from the five experiments is shown in Figure 6.3 It can be observed that the model average accuracy was above 96%, and the poisoning attacks, model attacks, and inference attacks had minimal impacts on the security of the user data. The experimental results indicate that the method of model aggregation based on the parameter similarity could effectively mitigate the harm caused by the poisoning attacks and model attacks. Additionally, this study utilized the encryption method of differential privacy to encrypt the model data during transmission, effectively addressing the issue of inference attacks stealing privacy from other users.