# Differential Privacy in Federated Learning: An Evolutionary Game Analysis
## 2 Related Work and Preliminaries  
### Gaussian Mechanism Differential Privacy in Federated Learning  
The differential privacy (DP) mechanism is a privacy-preserving method designed to protect individual datums while still allowing meaningful statistical information to be extracted [21,22]. The core principle of differential privacy involves adding a controlled amount of noise during the computation of statistical information or data analysis. This noise obscures the contributions of individual data points, thereby preventing privacy breaches that target specific individuals. Traditionally, differential privacy has been applied to centralized data at a trusted data center, where a trusted third party administers differential privacy measures and releases the processed data. This approach, known as centralized differential privacy, relies on a trusted third party data collector to ensure that the original data are not disclosed. However, identifying a truly trustworthy third-party data collector is challenging in real-world scenarios. This challenge has led to the development of localized differential privacy, which decentralizes the privacy-preserving process and assigns it to each data-owning user. This approach reduces the potential risk of privacy leakage. The localized differential privacy data processing framework is illustrated in Figure 1.  
In Figure 1, the clients correspond to the participants in federated learning, with their raw data being the model's post-training parameters. The data collector corresponds to the server, which aggregates and queries statistical data to form the global model. From  
Figure 1: Localized differential privacy data processing framework. the perspective of implementing differential privacy mechanisms for numerical data, there are two main approaches: Gaussian differential privacy and Bayesian differential privacy. While Bayesian differential privacy is suitable for smaller data samples, it has drawbacks such as high computational costs and the need for prior information [23; 24]. In contrast, the Gaussian mechanism for differential privacy has low computational costs [25] and is easy to implement, making it ideal for handling real-time data and large-scale datasets [26]. Although the accuracy of Gaussian differential privacy is generally lower than that of Bayesian differential privacy, certain algorithms can enhance the accuracy of models using Gaussian mechanisms for differential privacy. For instance, in the work by [PERSON] et al. [27], the accuracy was improved threefold using the proposed Noisy-FL algorithm. In this paper, we adopt the definition of \((\varepsilon,\delta)\)-DP, as presented in [28], which is given by  
\[\Pr[\mathcal{M}(\mathcal{D}\in\mathcal{O})]\leq e^{\varepsilon}\Pr\bigl{[} \mathcal{M}\bigl{(}\mathcal{D}^{\prime}\in\mathcal{O}\bigr{)}\bigr{]}+\delta, \tag{1}\]  
where \(\mathcal{D}\) is the original dataset, and \(\mathcal{D}^{\prime}\) is a dataset that differs from \(\mathcal{D}\) by only a single data point. To be precise, \(\mathcal{D}^{\prime}\) is considered a neighboring dataset to \(\mathcal{D}\) if \(\mathcal{D}^{\prime}\) can be obtained from \(\mathcal{D}\) by either adding, removing, or modifying a single record. \(\mathcal{O}\) represents the set of possible output results. \(\varepsilon\) is the privacy budget, which controls the degree of privacy leakage. \(\delta\) is the additional privacy budget, which controls the upper bound on the probability of privacy leakage. \(\mathcal{M}\) represents the application of a randomized perturbation algorithm in differential privacy. According to (1), a smaller value of \(\varepsilon\) implies that more noise is added, making it difficult to distinguish between the datasets \(\mathcal{D}\) and \(\mathcal{D}^{\prime}\). This results in stronger privacy protection.