Research map / Federated learning and privacy / Privacy attacks and secure learning
Towards the Robustness of Differentially Private Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows differentially private federated learning is vulnerable to a norm-amplified poisoning attack (Attack-DPFL) and proposes Robust-DPFL, a K-means-based defense using element-wise gradient aggregation scores to filter poisoned gradients under DP noise.
Problem
Robustness of differentially private federated learning against poisoning (backdoor) attacks, since existing robust aggregation methods assume poisoned gradients are outliers, which fails when clean gradients are heavily perturbed by DP noise.
Approach
Attack-DPFL rescales an unperturbed poisoned gradient to match the norm of DP-perturbed gradients so it dominates aggregation; Robust-DPFL exploits that noise averages out in element-wise aggregation, so the absolute mean of each uploaded gradient serves as a detection score, and K-means splits out the high-score (poisoned) cluster before averaging the rest.
Key results
- On CIFAR-10, Robust-DPFL reduces ASR to 1.55% with 33.46% accuracy, versus 99.97% ASR for FedAvg under DP-FL.
- On MNIST, Robust-DPFL keeps accuracy at 97.43% with ASR 0.39%, close to IdealFL (98.44%, 0.20%).
- On FEMNIST, Krum and MKrum reach near 100% ASR under DP-FL while Robust-DPFL achieves 76.79% accuracy with 2.49% ASR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Robust-DPFL gradient detection and filtering instead of FedAvg aggregation | DP-FL · MNIST | ASR: 99.84 -> 0.39 | Helped |
| Use Robust-DPFL gradient detection and filtering instead of FedAvg aggregation | DP-FL · FEMNIST | ASR: 98.22 -> 2.49 | Helped |
| Use Robust-DPFL gradient detection and filtering instead of FedAvg aggregation | DP-FL · CIFAR10 | ASR: 99.97 -> 1.55 | Helped |
| Use Robust-DPFL gradient detection and filtering instead of FedAvg aggregation | DP-FL · MNIST | accuracy: 91.51 -> 97.43 | Helped |
| Use Robust-DPFL gradient detection and filtering instead of FedAvg aggregation | DP-FL · FEMNIST | accuracy: 50.01 -> 76.79 | Helped |
| Use Robust-DPFL gradient detection and filtering instead of FedAvg aggregation | DP-FL · CIFAR10 | accuracy: 10.01 -> 33.46 | Helped |
| Apply conventional robust aggregation (Mid, Krum, MKrum, Norm, or Contra) to DP-FL | DP-FL · three benchmark datasets | ASR | Mixed |
| Increase the ratio of malicious clients | Robust-DPFL · MNIST, FEMNIST, and CIFAR10 | ASR | Hurt |
| Increase the privacy protection level (lower privacy budget) | Robust-DPFL · three benchmark datasets | accuracy | Hurt |
| Increase the privacy protection level (lower privacy budget) | Robust-DPFL · three benchmark datasets | ASR | Hurt |
| Rescale unperturbed poisoned gradients to match the norm distribution of perturbed gradients (Attack-DPFL), rather than use existing attacks on DP-FL | DP-FL · MNIST, FEMNIST, and CIFAR10 | ASR | Helped |
Surprising findings
- Standard robust aggregators (Krum, MKrum, Contra) fail under DP-FL because clean gradients perturbed by DP noise become the outliers, so the center-selected gradients are more often poisoned.
- DP-FL is not inherently robust: a naive unperturbed attack is ineffective, but norm amplification by Attack-DPFL restores high ASR.
Limitations
- Stronger DP noise (smaller privacy budget) slightly degrades both accuracy and robustness of Robust-DPFL.
- Evaluation limited to backdoor attacks on three small image benchmarks with 15% malicious clients; targeted/untargeted attacks were excluded because DP noise confounds them.
Experimental setup
Datasets: MNIST FEMNIST CIFAR-10
Benchmarks: MNIST FEMNIST CIFAR-10
Metrics: task accuracy attack success rate (ASR)
Baselines: FedAvg Mid Krum MKrum Norm clipping Contra IdealFL
Builds on: FedAvg Renyi differential privacy Truex et al. DP-FL Bagdasaryan federated backdoor attack
Closest papers by meaning
- Noise-Aware Algorithm for Heterogeneous Differentially Private Federated Learning (ICML 2024 · similarity 0.92)
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.92)
- Mitigating the Privacy–Utility Trade-off in Decentralized Federated Learning via f-Differential Privacy (NeurIPS 2025 · similarity 0.89)
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.89)
- One-shot Empirical Privacy Estimation for Federated Learning (ICLR 2024 · similarity 0.89)
- A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.