## 2 Materials and Methods
### Differential Privacy  
We begin with the standard definition of differential privacy and a localized variant [19; 20; 21]. An algorithm is \((\varepsilon,\delta)\)-DP if it finds similar results for similar data sets with large probability \(1-\delta\). The similarity of the results is described by the privacy budget \(\varepsilon\). In practice, this means that an attacker, who sees a certain result from the algorithm, cannot decide which data set was used to generate the result. This implies that records in the data set remain hidden.  
**Definition 1** (Differential privacy).: _A randomized mechanism \(\mathcal{A}\) provides \((\varepsilon,\delta)\)-differential privacy, if for all pairs of data sets \(x_{1},x_{2}\in\mathcal{X}\) at distance \(1=d(x_{1},x_{2})\) and for any outcome \(y\)_  
\[\mathbb{P}[\mathcal{A}(x_{1})=y]\leq\varepsilon^{\varepsilon}\,\mathbb{P}[ \mathcal{A}(x_{2})=y]+\delta\quad.\]  
This definition provides guarantees that are unconditional on the knowledge or capabilities of the attacker. Furthermore, the parameters \(\varepsilon\) and \(\delta\) can be bounded from above by a variety of composition laws. The most common of these will be discussed in Section 2.6. This allows the data owner to keep track of the maximum amount of data leakage a data set has suffered.  
**Example 2**.: _Continuing with Example 1, assume that the list consists of two possible data sets, \(\mathbf{X}_{1}\) and \(\mathbf{X}_{2}\). Since there is no additional information, they are equally likely to be used. The weight vector \(\mathbf{\beta}\) is computed using an \((\varepsilon,0)-\)DP algorithm, where both data sets are in the universe of possible data sets. From the Definition 1 of Differential Privacy, it follows that_  
\[\mathbb{P}[\mathcal{A}(\mathbf{X}_{1})=\mathbf{\beta}]\leq\varepsilon^{\varepsilon}\, \mathbb{P}[\mathcal{A}(\mathbf{X}_{2})=\mathbf{\beta}]\quad.\]  
_This implies that the likelihood that \(\mathbf{X}_{1}\) is used is at most_  
\[\frac{\mathbb{P}[\mathcal{A}(\mathbf{X}_{1})=\mathbf{\beta}]}{\mathbb{P}[\mathcal{A}( \mathbf{X}_{1})=\mathbf{\beta}]+\mathbb{P}[\mathcal{A}(\mathbf{X}_{2})=\mathbf{\beta}]}\leq \frac{\varepsilon^{\varepsilon}}{1+\varepsilon^{\varepsilon}}\quad.\]  
_The attacker cannot learn the used data set with certainty, regardless of his computational power and additional information._  
**Definition 2** (Locally sensitive differential privacy).: _A randomized mechanism \(\mathcal{A}\) provides \((\varepsilon,\delta)\)-locally sensitive differential privacy in the data set \(x_{1}\in\mathcal{X}\), if for all data sets \(x_{2}\in\mathcal{X}\) at distance \(1=d(x_{1},x_{2})\) and for any outcome \(y\)_  
\[\mathbb{P}[\mathcal{A}(x_{1})=y]\leq\varepsilon^{\varepsilon}\,\mathbb{P}[ \mathcal{A}(x_{2})=y]+\delta\quad.\]  
Definitions 1 and 2 make it clear that some distance on the universe of data sets must be defined. It is preferable to use concepts that make sense both in the local and the federated context. We use the following definition here. Two data sets are at a distance 1, if the sets of subjects they have data on differ by one. It thus requires suppression of an entire row of the data set. Since the data matrices should be of the same dimensions, this corresponds to having no information on someone and filling an entire row in \(\mathbf{X}^{(i)}\) with zeros. This can be interpreted in the federated view too. It means that both parties remove their information about this subject from their local data. In this case, if both parties train \(\varepsilon\)-DP locally, this corresponds by simple composition; see Lemma 1, to \(2\varepsilon\)-DP in the federated setting.