## 2 Background
### Protecting Time-Series Data with Differential Privacy  
The astonishing success of gradient leakage research has triggered the start of an intense race between attackers [38; 39; 40; 41; 42] and defenders of privacy [43; 44; 45; 46]. In response to the increase in privacy violating attacks in FL, many privacy preserving strategies have been proposed to mitigate the risk of information leakage from gradient perturbation, which has been proposed using differential privacy [47; 48; 49] by adding Gaussian noise to gradients [36] and gradient clipping, which limits the magnitude of gradients to reduce the risk of an inversion attack that exploits extreme gradient values [37] before they are shared to obfuscate sensitive information, they all offer little or no theoretical privacy guarantees. This is partly due to the fact that there is no mathematically rigorous attacker model, and the defences are empirically evaluated against known attacks [4]. This also leads to a variety of proposed defence techniques, such as gradient pruning, i.e., gradient compression by reducing gradient precession, which can make inversion harder while maintaining accuracy techniques [36]. **Differential privacy:** According to the definition, differential privacy (DP) is a formal mathematical framework designed to protect the privacy of individuals in a dataset while still allowing useful statistical analysis and machine learning. \[Pr[\mathcal{M}(D)\in\mathcal{S}]\leq\epsilon^{\epsilon}\times Pr\big{[} \mathcal{M}\big{(}D^{\prime}\big{)}\in\mathcal{S}\big{]}+\delta \tag{3}\]  
\(\mathcal{M}\)--the randomisation algorithm (mechanism). \(D,D^{\prime}\)--two datasets that differ by one individual's data. \(\mathcal{S}\)--all possible sets of outputs. \(Pr\)--denotes the probability of the algorithm producing a specific result. \(\epsilon\)--the privacy budget. A smaller value means stronger privacy. \(\delta\)-the failure probability error. Differential privacy ensures that adding or removing a single individual's data does not significantly change the outcome of a computation. This means an attacker cannot determine whether any specific individual's data is present in the dataset. Another important issue is the trade-off between data utility and privacy guarantee in DP, which is represented by the privacy guarantee, denoted by the privacy budget \(\epsilon\) and the failure probability error \(\delta\) for \((\epsilon,\delta)\)-DP, also known as approximate DP. The privacy budget is obtained by adding noise to the data sampled from the Gaussian distribution or the Laplace distribution [50]. The description of the distribution being used is called the mechanism [51]. The Gaussian mechanism is central to DP, mainly due to its tighter composition when compared to the Laplace mechanism. A Gaussian noise with mean \(\mu=0\) and variance \(\sigma^{2}\) is added to the query results, where \(\sigma^{2}\) depends on the sensitivity and privacy parameters \(\epsilon\) and \(\delta\). The sensitivity is the maximum change in query output when data is added/removed. This is a significant benefit, since the \(L^{2}\) sensitivity can be much smaller than the \(L^{1}\) sensitivity. The Gaussian mechanism has relatively thin tails, which results in a significantly improved composition. This is the greatest advantage of the Gaussian mechanism: when answering a large number of queries, it tends to require much less noise for the same level of privacy [50]. The noise added to achieve DP is calibrated based on the privacy budget \(\epsilon\) when querying or releasing information from the dataset. Allocation strategies in DP aim to optimise the balance between data utility and privacy protection. For time-series data, we want to ensure that the release of the model outputs does not reveal sensitive information about individual time steps. Using the Gaussian mechanism for the allocation strategies requires specific approaches to handle temporal correlation and evolving sensitivity.