# FedCrow: Federated-Learning-Based Data Privacy Preservation in Crowd Sensing
## 4 Evaluation
### Experimental Results And Analysis
#### 4.2.2 Attack Resistance Experiment  
In federated learning, clients only need to upload model parameters, while user data are kept locally. This approach largely addresses data privacy concerns compared with traditional distributed machine learning. However, due to the openness of federated learning, there may be malicious users that aim to obtain access to the server model through  
Figure 4: The convergence curve of the model. \begin{table}
\begin{tabular}{l l} \hline \hline
**Parameter** & **Value** \\ \hline Number of clients & 3 \\ Learning rate & 0.001 \\ Training epochs & 10 \\ Optimizer & Adam \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Parameter settings. training or compromise the model's accuracy. To tackle this issue, this paper proposes a legitimate user authentication method based on the user contribution level. It evaluates the credibility of different clients by calculating their contributions to the server model. Currently, the main threats to the federated-learning model and data security can be categorized into four types: data poisoning, model attacks, inference attacks, and differential privacy attacks. The following experiments targeted these attack methods to validate the security of the federated-learning framework using the user-contribution-level-based legitimate-user-screening method. **(1) All normal users:** The first experiment involved three clients, all of whom were normal users, and the training data consisted of normal data. The experimental results are shown in Figure 5, where the parameter matrices of the three users were relatively similar, resulting in a comparable model similarity and accuracy between them. **(2) There are some unreliable users:** In the second experiment, one unreliable user was introduced among the clients, whose data consisted of only 10% of the normal user data. Due to the smaller dataset provided, the model accuracy was relatively lower. The training results are illustrated in Figure 6. It is evident that the parameter matrix similarity of the unreliable user was lower compared with the normal users, resulting in a relatively lower model accuracy. However, the model accuracy of the normal users remained unaffected. **(3) Existence of data-poisoning attacks:** In the third experiment, a poisoning attack was conducted. \"Data poisoning\" typically refers to attackers adding improper information  
Figure 5: Model training with only normal users. (**a**) The similarity of the parameter matrices. (**b**) The model accuracy. Figure 6: Model training with an unreliable user. (**a**) The similarity of the parameter matrices. (**b**) The model accuracy. during the training process, enabling them to exploit this information to damage and manipulate the model, thereby achieving their intended goals. The process of a data-poisoning attack is illustrated in Figure 7.  
As shown in Figure 8, the training data used by the malicious user for the poisoning attack consisted of either malicious or tampered data, which differed significantly from the data of other normal users. By comparing the similarity of the parameter matrices, it was evident that the malicious user's parameter matrix similarity was lower compared with the normal users. Consequently, their corresponding user contribution level decreased, leading to a smaller proportion in the model aggregation. Although the poisoning attack slowed down the convergence of the model, after convergence, the malicious user that employed the poisoning attack method hardly affected the overall model accuracy. **(4) Existence of model attacks:** In the fourth experiment, a model attack was conducted. Model attacks involve altering or replacing the model parameters of clients to modify the global model, as depicted in Figure 9.  
As depicted in Figure 10, a model attack involves tampering with or replacing the model parameters of clients to alter the global model.