Research map / Federated learning and privacy / Privacy attacks and secure learning

Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy

NeurIPS 2026 · Federated learning and privacy › Privacy attacks and secure learning · approach: Membership inference and auditing · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Connects randomized smoothing to the privacy-profile (dual) view of differential privacy to tractably compose training-time and inference-time randomized mechanisms, certifying joint backdoor robustness for DP-SGD and DPA on MNIST and CIFAR-10.

Problem

Certifying robustness against backdoor attacks where adversaries jointly perturb training data and test inputs, requiring training-time and inference-time randomized mechanisms to be analyzed within one certificate.

Approach

Derive a dual (privacy-profile) formulation of randomized smoothing by extending the primal-dual equivalence between f-DP and privacy profiles to asymmetric neighboring relations, enabling numerical composition of heterogeneous mechanisms and decomposition of the threat model into add/remove sub-relations for tighter certificates.

Key results

• On MNIST, the privacy-profile analysis of DP-SGD gives improved certified accuracy over RDP-based accounting and DPA baselines at 8 epochs (exact numbers not extracted).
• Joint certification of DPA with inference-time Gaussian noise is demonstrated on CIFAR-10 (100 partitions, 10 epochs DP-SGD) and MNIST (100 and 130 partitions).
• Decomposing the add/remove relation into asymmetric sub-relations yields strictly tighter tradeoff functions than the non-decomposed relation (subsampled Gaussian example).

Limitations

• Certifying DP-SGD requires sampling many models, adding computational overhead.
• Decomposition-based certification scales as O(R) in the threat radius.
• Robustness guarantees come at a utility cost.

Experimental setup

Datasets: CIFAR-10 MNIST ImageNet1K

Benchmarks: MNIST CIFAR-10

Metrics: certified accuracy

Baselines: Deep Partition Aggregation RDP-based accounting for DP-SGD Adaptive randomized smoothing

Builds on: DP-SGD Deep Partition Aggregation f-DP privacy loss distribution randomized smoothing

Closest papers by meaning

• A Unified Framework for Adversary-Aware Differential Privacy Bounds (NeurIPS 2026 · similarity 0.89)
• Unifying Re-Identification, Attribute Inference, and Data Reconstruction Risks in Differential Privacy (NeurIPS 2025 · similarity 0.88)
• Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.88)
• Attack-Aware Noise Calibration for Differential Privacy (NeurIPS 2024 · similarity 0.88)
• Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences (NeurIPS 2024 · similarity 0.88)
• Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.88)