## 4 Experiments and Evaluation
### Key Finding
However, the particular rate of increase could change depending on the chosen noise multiplier. Analyzing the connection between the rate of epsilon (\(\epsilon\)) increase and noise multipliers can provide insight into how best to ensure privacy for these data. * Payroll Data: During training, the epsilon (\(\epsilon\)) often grew, much like the opinion data. However, more research is necessary because some initial epsilon (\(\epsilon\)) values of 0.0000 are present. This could be the result of certain implementation specifics or the DP mechanism's restrictions. For an appropriate assessment of the real privacy guarantees in this circumstance, it is essential to understand the origin of such values. However, when we compare RDP values across different noise multipliers, we obtain a more detailed picture. The starting RDP values increase as we proceed from left to right columns (lower to higher noise multipliers). This suggests that higher noise levels (right columns) often provide better initial privacy than lower noise levels (left columns). This is intuitive, as larger noise levels add more randomness into the training data, making it more difficult to differentiate between different data points, thus improving privacy protection from the start. Tables 4 and 5 provide insight into the sensitivity of participant data to MIAs using a DPFL model trained on opinion and payroll data, respectively. Each value in the table reflects the MIA success rates (out of a total number of attempts) by which an attacker was able to accurately determine if a certain client's data were used in model training. Ideally, these rates should be as close to 0% as possible. A lower success rate for the MIA indicates a more effective defense against MIAs, which protects client privacy by making it impossible for attackers to identify training participants. In the absence of noise (noise multiplier 0), both data sets are susceptible to MIAs, with excellent accuracy and F1 scores  
for all clients. In the public opinion data set, the accuracy is around 95%, and the F1 score is around 94%. Similarly, the accuracy of the payroll data is around 95%, and the F1 score is around 97%. These findings highlight the fundamental vulnerability of FL models to MIAs when privacy-preserving protections are not included. Introducing noise into noise multiplier 2 or greater results in a consistent decrease in accuracy and F1 scores for all clients, indicating stronger resilience against MIAs. Similar results are found in the Opinion data (Table 4) and in the Payroll data (Table 5) where noise levels contribute to a decrease in accuracy and F1 scores. These findings underscore the critical importance of noise in reducing the risks of MIAs, as well as the importance of a sophisticated strategy to balance privacy and usefulness in FL systems. The results of Table 3 demonstrate our key contribution: empirical validation on real-world data. We carefully selected two unique data sets: the public _Opinion Data_, which represents data from a medium-sized organization, and _Payroll Data_, which represents data from a large-sized organization. This representation of real-world data ensures that our models are applicable in a variety of real-world contexts, where data scale and privacy issues frequently diverge significantly. The results of Table 3 also implicitly support our contribution, which is the robustness of our models against adversarial attacks. Even at high noise levels, as the table illustrates, our models successfully achieve a compromise between privacy and performance in both data sets and they are also more resistant to adversarial attacks. Incorporating privacy-related metrics into our analysis, such as epsilon (\(\epsilon\)) and _RDP_, offers detailed insights into how our strategies affect privacy at different noise levels. The findings clarify the complex relationship between data value and privacy protection, highlighting the relevance of our research from a practical point of view.