mlsanityData to 7 Oct 2026

Gradient Masking and the Underestimated Robustness Threats of Differential Privacy in Deep Learning

arXiv 2105.07985 ↗First posted 17 May 2021cs.CR cs.AI cs.LGcited by 13

Not on the map. Why?

Abstract (arXiv)

An important problem in deep learning is the privacy and security of neural networks (NNs). Both aspects have long been considered separately. To date, it is still poorly understood how privacy enhancing training affects the robustness of NNs. This paper experimentally evaluates the impact of training with Differential Privacy (DP), a standard method for privacy preservation, on model vulnerability against a broad range of adversarial attacks. The results suggest that private models are less robust than their non-private counterparts, and that adversarial examples transfer better among DP models than between non-private and private ones. Furthermore, detailed analyses of DP and non-DP models suggest significant differences between their gradients. Additionally, this work is the first to observe that an unfavorable choice of parameters in DP training can lead to gradient masking, and, thereby, results in a wrong sense of security.

Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Builds on 20 of its 41 references that are in the map. First posted on arXiv 17 May 2021.

Builds on

20 of 41 references.

References · 20

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  9. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  10. 2017Renyi Differential Privacycited by 643
  11. 2017One pixel attack for fooling deep neural networkscited by 579
  12. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
8 more
  1. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  2. 2020Tempered Sigmoid Activations for Deep Learning with Differential Privacycited by 121
  3. 2019Heterogeneous Gaussian Mechanism: Preserving Differential Privacy in Deep Learning with Provable Robustnesscited by 15
  4. 2019Robust or Private? Adversarial Training Makes Models More Vulnerable to Privacy Attackscited by 10
  5. 2019A unified view on differential privacy and robustness to adversarial examplescited by 9
  6. 2020Robustness, Privacy, and Generalization of Adversarial Trainingcited by 8
  7. 2019Scalable Differential Privacy with Certified Robustness in Adversarial Learningcited by 3
  8. 2021DiPSeN: Differentially Private Self-normalizing Neural Networks For Adversarial Robustness in Federated Learningcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 2; 2024: 3; 2025: 4; 2026: 3.

13 papers.

Sort:

  1. 2022Differentially Private Optimizers Can Learn Adversarially Robust Modelscited by 6
  2. 2023Augment then Smooth: Reconciling Differential Privacy with Certified Robustnesscited by 6
  3. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  4. 2025Trustworthy Machine Learning via Memorization and the Granular Long-Tail: A Survey on Interactions, Tradeoffs, and Beyondcited by 6
  5. 2025Trustworthy AI Must Account for Interactionscited by 4
  6. 2026Fundamental Limitations of Favorable Privacy-Utility Guarantees for DP-SGDcited by 4
  7. 2024Adversarial Robustness Overestimation and Instability in TRADEScited by 1
  8. 2024A Curious Case of Remarkable Resilience to Gradient Attacks via Fully Convolutional and Differentiable Front End with a Skip Connectioncited by 0
  9. 2024Impact of Architectural Modifications on Deep Learning Adversarial Robustnesscited by 0
  10. 2025Empirical Analysis of Privacy-Fairness-Accuracy Trade-offs in Federated Learning: A Step Towards Responsible AIcited by 0
  11. 2025The Double-Edged Nature of the Rashomon Set for Trustworthy Machine Learningcited by 0
  12. 2026PACZero: PAC-Private Fine-Tuning of Language Models via Sign Quantizationcited by 0
1 more
  1. 2026Reducing information dependency does not cause training data privacy. Adversarially non-robust features docited by 0