## 4 Discussion
### Data Privacy Attacks and Protections
#### 4.4.1 Data Privacy Attacks on Federated Learning  
There are two types of possible data privacy attacks on federated learning. The first attack is trying to recreate the input data, such as model inversion attack, and the second attack is to discover the training data such as membership inference attack. **Model Inversion (MI) Attack. ** The model inversion attack is an attack method for recreating data on which a machine learning model was trained [60]. In the case of federated learning for healthcare applications, this can leak the sensitive patient data used in the model's training process. [PERSON] et al. [60] demonstrated the MI attack that, given the machine learning model and several demographic data about a patient, an attacker could generate the patient's genetic markers. Specifically, the attack exploits the predicted output probability confidence score from the machine learning model when predicting the class given the features data. Given a machine model learning model as a function \(\hat{g}=f(w;x_{1},\ldots,x_{n})\) where \(\hat{g}\), \(w\), and \(\mathcal{X}=\{x_{1},x_{2},\ldots,\ x_{n}\}\) are predicted probability class, machine learning parameters, and features vector as an input, respectively. The model inversion attack aims to exploit a sensitive feature, for instance feature \(x_{1}\), given some information about the other features \(x_{2},\ldots,x_{n}\) and the predicted output probability \(\hat{g}\). One solution to overcome this threat is to use differential privacy mechanism which can be incorporated into the learning process to protect the data from inversion attacks, such as inferring model weights (discussed in Section 4.4.2). **Membership inference attack. ** Given a machine learning model \(f(w;x_{1},\ldots,x_{n})\) and some sample instances, the membership inference attack task tries to discover whether the instance exists or not in the training dataset [61]. Membership inference attack poses a significant privacy issue as the membership can expose a person's private information. For instance, determining a person's presence in a hospital's clinical trial training dataset indicates that this patient was once a patient at the hospital. The patient and the hospital are the two key parties interested in defending against such membership inference attacks. The patients consider their memberships confidential and do not wish for their sensitive information to be made public. At the same time, the hospital does not want \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Data** & **Purpose** & **Number of Nodes** & **Non-IID Characteristics** & **Non-IID Mitigation** & **Studies/Year** \\ \hline \multirow{4}{*}{VFL} & Combining all features from a group of selected nodes \(S_{t}\) to increase features dimension & \multirow{2}{*}{7} & \multirow{2}{*}{Not Available} & \multirow{2}{*}{Not Available} & \multirow{2}{*}{[PERSON] et al., 2021 [56]} \\ \cline{1-1} \cline{5-5}  & Improve the model performance with small data size and unlabeled samples & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._to be proseccuted for leaking patient data. [PERSON] et al. [62] demonstrated the first membership inference attack in the medical area that infers the personal information of the participants in a genomic dataset. [PERSON] et al. [63] showed the threats of membership inference attack when the attacker is a member in the FL environment. The member could be the aggregation service or one of the client nodes. Their FL configuration is different from the one discussed above. Instead of pooling the weights to construct a new global model, each node trains their local model and contributes just the prediction probability when inferring a new instance. The process of membership inference attack consists of three steps [61]. Firstly, the attackers aim to develop a shadow dataset \(\mathcal{D}^{\prime}\) that mimics the target model training dataset \(\mathcal{D}\).