arXiv:2606.12845v1 [cs.CR] 11 Jun 2026
A Privacy-Preserving Framework Using Remote Data Science for Inter-Institutional Student Retention Prediction John Fields
K M Sajjadul Islam
Ruchitha Thota
Business Analytics Concordia University Wisconsin [email protected]
Computer Science Marquette University [email protected]
Computer Science Concordia University Wisconsin [email protected]
Victor Chen
Praveen Madiraju
Computer Science Georgetown University [email protected]
Computer Science Marquette University [email protected]
Abstract—This study explores privacy-preserving machine learning (PPML) techniques using the PySyft platform to enable collaborative prediction of student retention between institutions. We developed a remote data science (RDS) framework with a semi-air-gapped architecture consisting of high-side and low-side servers, allowing researchers from three universities to build predictive models on sensitive student data without direct data access. Using historical data from a small private university (N=720), we evaluated three synthetic data generation approaches and validated the framework through interinstitutional collaboration. The results demonstrate consistent classification performance across institutions (Macro F1: 0.690– 0.695) while maintaining strict Family Educational Rights and Privacy Act (FERPA) compliance. We also propose Data-TypeAware Templates, a novel synthetic data method that prioritizes privacy over distributional fidelity. Our findings confirm that RDS-based PPML is technically feasible for educational settings and offers a practical alternative to federated learning for small-scale inter-institutional collaborations. The code is available at https://github.com/jtfields/NAIRR240195-PrivacyPreserving-Machine-Learning. Index Terms—privacy-preserving machine learning, student retention, remote data science, PySyft, higher education
I. I NTRODUCTION Student retention remains one of the most persistent challenges in higher education. Despite more than 70 years of research, completion rates have shown only modest improvements, with gains largely attributed to grade inflation and not to genuine educational advancement [1]. This challenge affects both students, who face financial burdens as well as delayed career progression, and institutions that invest substan-
tial resources in recruitment and support services. Enhanced statistical methods and artificial intelligence have improved our ability to identify at-risk students [2]–[5]. These predictive approaches leverage academic performance, demographics, financial aid records, and campus engagement data to create early warning systems. However, a critical limitation pervades current research: most studies are confined to single institutions [6]. Models trained at one university may perform poorly at another, and smaller institutions often lack the data volume or technical expertise to develop robust models independently. The fundamental barrier to multi-institutional collaboration lies in student data privacy. Educational records are protected by strict regulations such as FERPA in the United States and the General Data Protection Regulation (GDPR) in the European Union (EU), along with institutional policies that prevent data sharing between organizations. These restrictions, while essential for protecting student rights, create significant obstacles to collaborative research and inter-institutional model development. This study extends our prior single-institution retention modeling work [3] to a privacy-preserving, multi-institution setting and makes three contributions: (1) we demonstrate a PySyft-based remote data science framework that enables inter-institutional collaboration on student retention prediction while maintaining strict privacy compliance; (2) we propose Data-Type-Aware Templates, a novel approach to synthetic data generation that prioritizes privacy protection over distributional fidelity; and (3) we validate the framework through empirical evaluation with researchers from three universities of different sizes, providing insights into privacy-utility tradeoffs.
© 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
TABLE I C OMPARISON WITH C LOSELY R ELATED P RIOR W ORK Study
Gardner et al. [12]
This work
Scale (N) 4 univ. (N = 1k–30k)
1 univ. (N = 720) + 3 collab. univ.
Privacy Mechanism
Cross-site Exchange
Federated, no raw data sharing
Per-record predictions / model outputs
TABLE II F EDERATED L EARNING VS . R EMOTE DATA S CIENCE Feature
Federated Learning
RDS (PySyft)
Data location Movement
Remains at institution Model updates to aggregator Moderate (model inversion possible) Many participants
Remains at institution Code sent, results returned Low (admin mediates output) 2–10 institutions
Privacy risk Typical scale
RDS + human-inthe-loop review
Aggregate metrics or DP-protected row-level outputs
II. R ELATED W ORK A. Machine Learning (ML) for Student Dropout Prediction Educational data mining has demonstrated the effectiveness of machine learning in identifying at-risk students. Dekker et al. [7] found decision trees particularly effective for predicting first-year dropout. Márquez-Vera et al. [8] advanced this with the Interpretable Classification Rule Mining algorithm for high school students. More recently, deep learning approaches have shown promise: Mubarak et al. [9] developed Long Short Term Memory (LSTM) models for Massive Open Online Courses (MOOCs), while Albreiki et al. [10] applied graph convolutional networks for at-risk student identification. B. Inter-Institutional Collaboration Most retention studies focus on individual institutions, limiting generalizability and hindering benchmarking [6]. Institutional contexts vary considerably in demographics, programs, and support systems [11], while limited sample sizes often do not capture population diversity. Gardner et al. [12] studied inter-institutional model sharing across four U.S. universities (N = 1,000 to 30,000), comparing direct transfer, ensemble averaging, and hybrid approaches and finding that simple prediction averaging matched locally trained models. Our work extends this line of research to a smaller university (N=720) and uses remote data science in place of federated learning, exchanging data-owner-reviewed aggregate metrics or differentially privatized row-level outputs in place of raw per-record predictions. Table I summarizes the methodological differences with closely related prior work. C. Privacy-Preserving Machine Learning Two primary paradigms have emerged for PPML: Federated Learning (FL) and Remote Data Science (RDS). FL trains models across decentralized sites without centralizing data, sharing only model updates [13]. However, FL assumes that all participants can support local training infrastructure and introduces risks of model inversion [14] and membership inference [15] attacks. Differential privacy [22] offers complementary mathematical guarantees, though real-world implementations often fall short [21]. For educational research with modest numbers of universities, heterogeneous capabilities,
and smaller sample sizes, FL’s computational overhead may outweigh benefits. RDS enables researchers to submit code to remote datasets, returning only non-disclosive aggregate results. This paradigm aligns naturally with educational research that involves 2– 10 collaborating institutions. DataSHIELD [16] is the most established open-source RDS framework but operates within the R ecosystem, which limits integration with modern Pythonbased ML tools. PySyft, developed by the OpenMined community, provides Python-native RDS with support for PyTorch, TensorFlow, scikit-learn, and pandas; integrated differential privacy mechanisms; domain-based access controls; and interactive Jupyter workflows [17]. We selected PySyft for these capabilities, its flexibility across modeling approaches, the active OpenMined community, and native support for future deep learning architectures. Table II summarizes the key differences between FL and RDS approaches. III. M ETHODOLOGY A. Research Design This study evaluates the feasibility and effectiveness of PPML for inter-institutional student dropout prediction using RDS. We address three research questions: (1) Can synthetic data provide sufficient utility for model development before deployment on private data? (2) Does PySyft’s RDS architecture enable effective collaboration while maintaining data privacy? (3) What are the practical challenges of implementing PPML in educational settings? Our experimental design involved three universities of different sizes collaborating to predict student retention within a distributed architecture that maintained strict data isolation: Concordia University Wisconsin and Ann Arbor (approximately 6,500 students; the data-owning institution), Marquette University (approximately 12,000), and Georgetown University (approximately 20,000). Although the private data set originates from a single institution, the inter-institutional aspect refers to researchers from all three universities independently developing and evaluating models within the shared RDS framework. We used a two-phase approach: validation on publicly available synthetic data (Faketucky [19]), followed by deployment on confidential institutional data. B. Privacy Architecture We implemented a two-server architecture consisting of a “low-side” public server and “high-side” secure server (Fig. 1).
legitimate-educational-interest provision. Institutional review board (IRB) approval and Chief Information Officer (CIO) oversight provide additional institutional accountability. C. Data and Prediction Task
Fig. 1. Remote Data Science Architecture. TABLE III S ERVER S PECIFICATIONS Component
High Side
Low Side
Hardware OS Python PySyft Docker
Dell Precision T7610 Ubuntu 24.04 3.12.3 0.9.2 24.0.9
Microsoft Azure Ubuntu 24.04 3.10.12 0.9.2 28.0.4
The low-side server, hosted on Microsoft Azure through our National Artificial Intelligence Research Resource (NAIRR) grant partnership with OpenMined, contained synthetic data and served as the development environment accessible to all researchers. The high-side server, physically secured at Concordia University Wisconsin, housed confidential student records in a semi-air-gapped configuration with restricted network access via dedicated hardware. This architecture enables the RDS workflow: data scientists develop and test models on the low-side using synthetic data, submit analysis code for data owner review, and receive outputs either as non-disclosive aggregate statistics or, when rowlevel outputs are required, with differential privacy applied. Table III summarizes the server specifications. A dedicated administrator laptop on the university network synchronized approved code to the high-side server over SSH; the high-side server itself had no direct internet access. FERPA Compliance Mapping: FERPA restricts disclosure of personally identifiable information (PII) from education records absent written consent or a qualifying exception. Our framework satisfies these requirements as follows: (i) raw records never leave Concordia’s high-side server, eliminating disclosure at the data layer; (ii) all returned outputs are non-disclosive: aggregate statistics directly or differentially privatized row-level results, reviewed by the data owner; (iii) PII fields are removed and remaining quasi-identifiers are de-identified prior to ingestion, consistent with FERPA §99.31(b) guidance; and (iv) the data owner exercises the school official function during code review, satisfying the
1) Synthetic Data for Model Development: The initial development of the model used the Faketucky synthetic education dataset [19], a publicly available resource designed to mimic the structures of real educational data. The prediction task involved binary classification of student retention (enrolled beyond the first year vs. departed), with the target variable showing class imbalance (18,776 retained, 66,384 departed, 26,831 missing). Records with missing target values were excluded from training and evaluation. To evaluate synthetic data generation approaches, we compared three methods: Method 1 (SDV Gaussian Copula): The Synthetic Data Vault (SDV) library [18] uses probabilistic graphical modeling and deep learning to generate artificial data preserving the statistical properties of the original. We applied SDV’s Gaussian copula model to generate statistically similar synthetic records. Method 2 (SDV with Differential Privacy): Identical to Method 1 but incorporating formal privacy guarantees through differential privacy (ε = 1.0, δ = 10−5 ) during synthesis. Method 3 (Data-Type-Aware Templates – Proposed): Instead of learning statistical distributions, this approach used the Python Faker library to generate structurally valid records based on variable types and ranges (e.g., grade point average (GPA) 0.0–4.0, American College Testing (ACT) composite scores 1–34, student age 18–25; valid category labels for gender, Pell eligibility, full-time status, college, degree program, ethnicity, and religion). Because the generated records have no statistical relationship to real data, this method provides the strongest privacy protection. For the RDS workflow, mock data need only be structurally valid to support model architecture development, since the final model is executed on real data by the data owner. Methods 1 and 2 were evaluated against Faketucky (Section IV); the production RDS deployment used only Method 3, since Method 1 leaks distributional information that could enable inference attacks and Method 2’s differentially private outputs were unstable on this dataset. 2) Private Institutional Data: Following synthetic validation, we deployed the system using de-identified data from Concordia’s 2021 cohort (N=720 students; 528 retained, 192 departed). Table IV compares the structure of the retention variable between the Faketucky validation data and the institutional deployment data. The data set included 48 variables spanning demographics, academic preparation (ACT scores, high school grade point average (HS GPA)), enrollment patterns (credits attempted/earned, term GPA), financial aid indicators, and participation in institutional support programs. 3) Model Configuration: All models were implemented using scikit-learn classification algorithms, including logistic regression, random forest, and support vector machines. Data were split into training and testing sets using an 80– 20 stratified split to preserve class distribution. Continuous
TABLE IV R ETENTION VARIABLE C OMPARISON Faketucky
Private Institution
Value
Freq.
Value
Freq.
Departed (0) Retained (1) Missing
66,384 18,776 26,831
Departed (0) Retained (1) Missing
192 528 0
metrics returned directly; row-level outputs differentially privatized when required; raw data never released), and (c) technical validity. 6) Approved code synchronizes to the high-side Syft server. 7) Models execute on the high-side against the real private data. 8) Aggregate results (confusion matrices, F1 scores) return to the low-side; data scientists refine their models and repeat the cycle. This iterative process maintained strict data isolation; researchers never accessed raw data directly and outputs left the secure environment only after data-owner review (as aggregate statistics or differentially privatized row-level results). E. Threat Model and Privacy Assumptions We consider an adversary interacting with the system as an external researcher who submits analysis code and requests outputs. The data owner reviews each submission, returning aggregate statistics directly and applying differential privacy to row-level outputs when required; raw data are never released. The framework mitigates membership inference, attribute inference, and model inversion attacks through this human-inthe-loop enforcement combined with calibrated noise on rowlevel releases [15]. Table V summarizes the threat model. TABLE V T HREAT M ODEL S UMMARY Component Adversary Access Restricted Access
Fig. 2. Collaborative Workflow.
Attacks Considered Defense Mechanism
features were standardized where applicable. Hyperparameters were selected using default settings with minor adjustments based on validation performance. All personally identifiable information was removed prior to analysis. The study received IRB approval with additional CIO oversight. D. Collaborative Workflow Three researchers from different universities independently developed classification models as shown in Fig. 2, proceeding through iterative cycles: 1) The university’s private data resides only on the highside server. 2) The data owner generates mock data using Data-TypeAware Templates (Method 3). 3) Mock data is deployed to the low-side Syft server for data scientists to explore and model. 4) Data Scientists 1–3 build models (Model 1–3) and test them on the mock data using scikit-learn, varying hyperparameters and feature engineering. 5) The data owner reviews each submission for (a) malicious code, (b) output-policy compliance (aggregate
Description External researcher, honest-but-curious analyst Code submission; outputs returned as aggregate statistics or DP-protected row-level results Raw data never released; row-level outputs returned with differential privacy when required Membership inference, attribute inference, model inversion Output restriction and human-in-the-loop review
F. Privacy Challenges and Mitigations Several practical challenges emerged during deployment, each requiring targeted mitigations. Row-level output requirements. Georgetown’s analysis required row-level classification weights, which by default would have created membership inference risk [15]. Instead of blocking the request, the data owner applied calibrated differential privacy noise to the row-level weights before release, illustrating that human-in-the-loop review enables flexible enforcement: aggregate statistics are returned directly, while legitimate row-level needs are accommodated through noise injection. We also enforced minimum cell-size thresholds during review so that low-frequency cells were suppressed before release. Differential privacy instability. Differential privacy mechanisms occasionally produced not-a-number (NaN) values when interacting with preprocessing steps, particularly when noise interacted with standardization on low-variance features. We addressed this through robust input validation (rejecting nonfinite values before noise application), feature-wise epsilon
TABLE VI C LASSIFICATION M ETRICS : O RIGINAL VS . SDV S YNTHETIC DATA (FAKETUCKY )
TABLE VII R ESEARCHER C LASSIFICATION P ERFORMANCE ON P RIVATE DATA Class 0 (Departed)
Class 1 (Retained)
Metric
With SDV
Without SDV
Decrease (%)
Institution
Prec
Rec
F1
Prec
Rec
F1
Accuracy F1-score Precision Recall
0.710 0.487 0.559 0.432
0.864 0.824 0.786 0.866
17.8 40.9 28.8 50.1
Concordia Marquette Georgetown
0.79 0.70 0.85
0.41 0.42 0.37
0.54 0.52 0.52
0.78 0.82 0.77
0.95 0.93 0.97
0.85 0.87 0.86
Mean
0.547
0.835
34.4
budgeting (allocating separate privacy budgets per column instead of one global ε), and direct coordination with OpenMined engineering for upstream fixes. Environment drift. Package dependency mismatches between researcher environments and the Docker-based deployment caused intermittent execution failures. We mitigated this by providing documented setup instructions to participants, maintaining a shared base Docker image, and requiring a presubmission validation step on the low-side mock data. G. Evaluation Metrics Model performance was assessed using precision, recall, F1-score, and accuracy. Beyond predictive accuracy, we evaluated synthetic-data utility (development-to-deployment performance transfer), operational feasibility (researcher feedback and incident documentation), and privacy protection (output review and disclosure risk analysis). All experimental code, configuration files, and documentation supporting reproduction of the reported experiments are available at https://github.com/jtfields/NAIRR240195-PrivacyPreserving-Machine-Learning. IV. R ESULTS A. Synthetic Data Evaluation Models trained on SDV-generated synthetic data underperformed those trained on the original Faketucky data across every metric, with a mean degradation of 34.4% (Table VI). Standard SDV (Gaussian Copula) achieved the best fidelity, but models trained on synthetic data still underperformed on real test data. The synthetic data retain roughly twothirds of the original model’s effectiveness, with recall most affected (50.1% drop), indicating that models become more conservative when trained on privacy-preserved data. Statistical analysis confirms the degradation: a one-sample t-test yielded t = 4.716 (df = 3, p ≤ 0.05), Cohen’s d = 2.187 indicates a large effect, and variance analysis shows that privacy preservation significantly increases performance variability (F = 15.42, p ≤ 0.05). Adding differential privacy to SDV (Method 2, ε = 1.0, δ = 10−5 ) further degraded classification across all metrics, with recall showing the largest additional loss. Tightening the privacy budget below ε = 1.0 rendered models unusable on this dataset, consistent with reported privacy–utility frontiers for tabular educational data [21]. Faker-generated mock data (Method 3) provided the strongest privacy protection of the
three approaches, since it was entirely synthetic with no statistical relationship to real records. Its value lies in supporting the secure PPML workflow: external researchers prototype on structurally valid mock data, and the data owner then runs the finalized model on real records. B. Inter-Institutional PPML Results Table VII presents classification performance on private institutional data across the three participating universities, where class 0 represents non-returning students and class 1 represents returning students. These results were obtained through the Method 3 (Data-Type-Aware Templates) production workflow: the three researchers developed and validated their pipelines on structurally valid mock data on the low-side, after which the data owner executed the finalized models on the real private data on the high-side. The inter-institutional analysis reveals consistent overall performance, with Macro F1 scores ranging from 0.690 to 0.695 (coefficient of variation (CV) = 0.4%). This aggregate consistency masks class-specific variation: Class 0 metrics show higher institutional variability (CV = 2.3–9.6%) than Class 1 (CV = 1.2–3.2%), reflecting the difficulty of predicting departure. Georgetown is most conservative, with the highest Class 0 precision (0.85) but lowest recall (0.37); all institutions achieve high Class 1 recall (0.93–0.97), reflecting the class imbalance (528 retained vs. 192 departed). The successful execution of this framework demonstrates both technical feasibility and practical viability: researchers from three universities developed competitive models on private educational data without ever directly accessing it. Because the data owner executes the same scikit-learn pipelines on the high-side, the macro F1 reported here matches a centralized training run on the same data; the RDS cost is operational (review and submission cycles), not statistical. RDS and FL address model-sharing risks such as gradient leakage [14] through different mechanisms: FL typically applies differential privacy to gradients, while RDS uses humanin-the-loop review with differential privacy applied selectively to row-level outputs. V. D ISCUSSION A. Key Findings and Contributions This study demonstrates that collaborative ML across institutions is technically feasible while maintaining FERPA compliance. The semi-air-gapped architecture with high-side and low-side servers proved effective for creating a secure
collaborative environment. The successful participation of researchers from three distinct institutions validates the practical applicability of RDS for multi-institution collaboration. Our synthetic-data evaluation revealed clear privacy-utility trade-offs. Standard SDV achieved reasonable fidelity, but models still underperformed on real data (mean degradation of 34.4%). Our proposed Data-Type-Aware Templates method provides the strongest privacy guarantees while supporting the RDS workflow where external researchers prototype on structurally valid mock data before final models execute on private data, underscoring the value of RDS approaches that enable collaboration without requiring high-fidelity synthetic data. The consistently low Class 0 recall (0.37–0.42) across all institutions reflects class imbalance in the dataset. Our prior work on a comparable cohort showed that SMOTE during training raised non-retained-class F1 scores from 0.00–0.13 to 0.82–0.89 across Gradient Boosting and XGBoost [3], suggesting substantial Class 0 gains are achievable when SMOTE and class-weighted ensemble methods are integrated into the RDS workflow. A systematic evaluation is left to follow-up work. The study was intentionally constrained to scikit-learn classifiers, excluding neural network frameworks because they introduce additional privacy vulnerabilities through gradients and intermediate representations [14], [15]; future implementations would require enhanced security protocols and more rigorous code review. B. Implications and Limitations The framework enables smaller institutions to benefit from collaborative model development without sharing sensitive records, and the modest hardware and software investment improves accessibility for institutions with limited IT resources. Beyond higher education, healthcare, government, and other regulated sectors could adapt this framework while maintaining regulatory compliance. Practical barriers remain: server configuration complexity, Docker deployment instability, package dependency mismatches, and the need for cross-functional expertise. Emerging tools such as OpenMined’s SyftBox [20] may reduce these barriers. PPML systems also remain vulnerable to multi-step disclosure risks where adversaries combine query results to infer individual information [14], [15], [22], requiring layered defenses including differential privacy, minimum cell size requirements, and comprehensive logging. VI. C ONCLUSION This study demonstrates that PPML techniques can enable collaborative prediction of student retention across institutions while maintaining strict data privacy and regulatory compliance. The PySyft-based RDS framework was validated with researchers from three universities of different sizes, and current synthetic data methods remain insufficient for complex predictive tasks (mean degradation of 34.4%), underscoring the importance of RDS approaches that enable collaboration
without data sharing. Future work will incorporate class imbalance handling, explore neural network architectures with enhanced privacy safeguards, and extend the framework to multiple institutions contributing private data simultaneously. ACKNOWLEDGMENT This work was supported through the NAIRR grant NAIRR 240195, Privacy-Preserving Machine Learning for Improving University Student Retention. D ECLARATION OF G ENERATIVE AI T OOLS The authors used ConnectedPapers.com, Consensus.app, and Claude.ai to brainstorm the Related Works section, Writefull for grammar checking, and ChatGPT to assist with code comments and boilerplate in some Jupyter notebooks. The authors reviewed, tested, and verified all generated content and take full responsibility for the publication. R EFERENCES [1] J. T. Denning, E. R. Eide, K. J. Mumford, R. W. Patterson, and M. Warnick, “Why have college completion rates increased?” Am. Econ. J. Appl. Econ., vol. 14, no. 3, pp. 1–29, 2022. [2] L. Kemper, G. Vorhoff, and B. U. Wigger, “Predicting student dropout: A machine learning approach,” Eur. J. Higher Educ., vol. 10, no. 1, pp. 28–47, 2020. [3] J. Fields, K. Chovanec, and P. Madiraju, “Integrating categorical and continuous data in a cluster-then-classify methodology for predicting undergraduate student success,” in Proc. IEEE Big Data Conf., 2024, pp. 8090–8098. [4] M. Alban and D. Mauricio, “Predicting university dropout through data mining: A systematic literature,” Indian J. Sci. Technol., vol. 12, no. 4, pp. 1–12, 2019. [5] M. Hinojosa et al., “Student clustering procedure according to dropout risk to improve student management in higher education,” Texto Libre, vol. 15, 2022. [6] J. Gardner, Y. Yang, R. Baker, and C. Brooks, “Modeling and experimental design for MOOC dropout prediction: A replication perspective,” in Proc. EDM, 2019. [7] G. Dekker, M. Pechenizkiy, and J. Vleeshouwers, “Predicting students drop out: A case study,” in Proc. EDM, 2009, pp. 41–50. [8] C. Márquez-Vera et al., “Early dropout prediction using data mining: A case study with high school students,” Expert Syst., vol. 33, no. 1, pp. 107–124, 2016. [9] A. A. Mubarak, H. Cao, and S. A. M. Ahmed, “Predictive learning analytics using deep learning model in MOOCs courses videos,” Educ. Inf. Technol., vol. 26, no. 1, pp. 371–392, 2021. [10] B. Albreiki, T. Habuza, and N. Zaki, “Extracting topological features to identify at-risk students using ML and GCN models,” Int. J. Educ. Technol. Higher Educ., vol. 20, no. 1, 2023. [11] D. Gašević, S. Dawson, T. Rogers, and D. Gasevic, “Learning analytics should not promote one size fits all,” Internet High. Educ., vol. 28, pp. 68–84, 2016. [12] J. Gardner, R. Yu, Q. Nguyen, C. Brooks, and R. Kizilcec, “Crossinstitutional transfer learning for educational models: Implications for model performance, fairness, and equity,” in Proc. ACM Conf. Fairness, Accountability, and Transparency (FAccT), 2023, pp. 1664–1684. [13] A. Ingerman and K. Ostrowski, “Introducing TensorFlow Federated,” TensorFlow Blog, 2019. [14] M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proc. ACM CCS, 2015. [15] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in Proc. IEEE Symposium on Security and Privacy (S&P), 2017, pp. 3–18. [16] D. Avraam et al., “DataSHIELD: Mitigating disclosure risk in a multisite federated analysis platform,” Bioinform. Adv., vol. 5, no. 1, 2025. [17] A. Trask et al., “Beyond privacy trade-offs with structured transparency,” arXiv preprint arXiv:2012.08347, 2020.
[18] A. Montanez, “SDV: An open source library for synthetic data generation,” M.Eng. thesis, MIT, 2018. [19] Center for Education Policy Research at Harvard University, “Faketucky: OpenSDP college-going dataset,” 2017. [20] OpenMined, “SyftBox,” 2025. [Online]. Available: https: //syftbox-documentation.openmined.org/ [21] M. van Haastrecht, M. Brinkhuis, and M. Spruit, “Federated learning analytics: Investigating the privacy-performance trade-off,” in LNCS, Springer, 2024, pp. 62–74. [22] C. Dwork, “Differential privacy,” in ICALP, LNCS, Springer, 2006, pp. 1–12.