# FREDY: Federated Resilience Enhanced with Differential Privacy
###### Abstract  
Federated Learning is identified as a reliable technique for distributed training of ML models. Specifically, a set of dispersed nodes may collaborate through a federation in producing a jointly trained ML model without disclosing their data to each other. Each node performs local model training and then shares its trained model weights with a server node, usually called Aggregator in federated learning, as it aggregates the trained weights and then sends them back to its clients for another round of local training. Despite the data protection and security that FL provides to each client, there are still well-studied attacks such as membership inference attacks that can detect potential vulnerabilities of the FL system and thus expose sensitive data. In this paper, in order to prevent this kind of attack and address private data leakage, we introduce FREDY, a differential private federated learning framework that enables knowledge transfer from private data. Particularly, our approach has a teachers-student scheme. Each teacher model is trained on sensitive, disjoint data in a federated manner, and the student model is trained on the most voted predictions of the teachers on public unlabeled data which are noisy aggregated in order to guarantee the privacy of each teacher's sensitive data. Only the student model is publicly accessible as the teacher models contain sensitive information. We show that our proposed approach guarantees the privacy of sensitive data against model inference attacks while it combines the federated learning settings for the model training procedures. differential privacy; privacy preserving; federated learning; cyber security; knowledge transfer; noisy aggregation +
Footnote †: journal:  
Article  
FREDY: Federatedsensitive data private and does not share them with external parties such as cloud servers, as the ML models are trained locally. However, the potential for privacy breaches still exists when models are uploaded by clients in federated learning. While the architecture of FL ensures that client nodes do not openly share data, providing a certain level of privacy protection, there remains a vulnerability wherein a malicious actor could exploit the models to extract sensitive information. Furthermore, there is a risk of compromising the integrity of communication during the exchange of model parameters, which opens the door to various attacks within the FL framework, including data and model poisoning attacks. The preservation of privacy in federated learning is primarily pursued through three distinct techniques: differential privacy (DP) as outlined in [2], homomorphic encryption as detailed in [3], and secure multiparty computation as described in [4]. Numerous effective strategies, including works such as [5; 6; 7; 8; 9; 10], have been developed to bolster client privacy. The realm of privacy attacks on machine learning models encompasses a spectrum of techniques that exploit inherent vulnerabilities within data protection mechanisms. Among these, model inversion attacks [11; 12] endeavor to reconstruct confidential attributes from the model's outputs while attribute inference attacks [13] seek to infer sensitive attributes of individuals from the outputs of a machine learning model. Attackers exploit the model's predictions to deduce sensitive information not explicitly included in the input. The pernicious model stealing attack vector [14; 15] involves unauthorized replication of a target model by means of black-box querying, potentially engndering concerns of intellectual property infringement. Data poisoning attacks [16; 17], on the other hand, engender deliberate model degradation through the introduction of malicious data instances. Lastly, watermarking attacks [18] involve inserting subtle changes into the input data to create a unique \"watermark\" that can be later detected in the model's outputs. This is often used to identify data leakage or unauthorized model usage.