## 3 Results  
### Construction of DP-BCD  
If an attacker knows what function or (deterministic) computation has been performed on a data set, he may derive information about this data from the outcome. This may allow him to exclude certain data points from the data set, include other specific points or deduce relations that the data set fulfils. One of the options to limit this possibility is to hide precisely which computation has been performed. In objective perturbation [8, 22, 23, 24], it is the loss function that is perturbed, preventing the attacker from knowing what computation was performed. The algorithm presented here consists of two phases. In the first phase, all parties train a linear model on their local data set. The labels they use for this are the parts missing from the joint prediction. In the second phase, the linear models are put together to form a linear model in the federated setting. This linear model can then be published. There are two potential groups of attackers possible in this setting. During the first phase, it is the group of all other participants. At publication, it is the outside world that receives the jointly trained model. Since the group of all other participants is also part of the outside world, we will only be considering the first group when proving our privacy guarantees. In this study, we use locally sensitive differential privacy (LSDP), as defined in Definition 2. Based on this, only data sets at distance 1 of a party's own data set are considered. Besides that, we use a small universe of possible data sets \(\mathcal{X}\). It consists only of the actual data set and all data sets obtained by removing one record. We do not include possible data sets with one record more than our data set. In fact, for such a small universe, the conditions of Definitions 1 and 2 coincide. One may argue that using the small universe based on local sensitivity to reduce the amount of noise needed while lowering the privacy budget, is in vain. This is not the case. In the transition, the privacy guarantee is shifted from absent data points with a high privacy budget to the actual data with a low privacy budget. The privacy budget is the explicit security guarantee that (LS)DP offers and as such is what users look at. The ambition is to minimize the following 2-party loss function in both an iterative and a federated manner  
\[\mathcal{L}=\big{(}\mathbf{y}-\sum_{i=1}^{2}\mathbf{X}^{(i)}\mathbf{\beta}^{(i)}\big{)}^{ 2}+\sum_{i=1}^{2}\big{(}\mathbf{\beta}^{(i)}\big{)}^{T}\big{(}\mathbf{X}^{(i)}\big{)}^ {T}\mathbf{b}^{(i)}. \tag{7}\]  
This is the 2-party form of (2) with a perturbation term added. A ridge regression term is omitted to perform a cleaner comparison to the original BCD algorithm. However, nothing prevents such a term. In (7), each party's loss function is perturbed by the dot product of the prediction and a secret vector \(\mathbf{b}^{(i)}\), known only by party \(i\). For each party, we write that \(\mathbf{X}^{(i)}\in M_{N\times m_{i}}\), so there are \(N\) observations of \(m_{i}\) attributes in this party's data. It follows from our data assumption that \(N>m_{i}\). If the vectors \(\mathbf{b}^{(i)}\) would be sampled from a normal distribution such as (8), the perturbation term would have the added benefit that the local and federated perturbation term are of the same form. This would provide a similar perturbation term in the federated and local objective function. To avoid dimensionality problems, a different distribution is used, as explained in Remark 1. **Remark 1**. : _The vector \(\mathbf{b}\in\mathbb{R}^{N}\) could be sampled from a normal distribution with density_  
\[p_{naive}(\mathbf{b})=\left(\frac{\varepsilon}{2\pi\xi^{2}}\right)^{N/2}\exp[-\frac{ \varepsilon\|\mathbf{b}\|_{2}^{2}}{2\xi^{2}}]\quad. \tag{8}\]  
_It is clear that the direction of the vector is uniformly sampled from the surface of the N-dimensional sphere.