# On the Robustness of LDP Protocols for Numerical Attributes under Data Poisoning Attacks

arXiv: https://arxiv.org/abs/2403.19510 · HTML: https://mlsanity.com/paper/2403.19510/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 13 of its 40 references that are in the map.
- First posted on arXiv 28 Mar 2024.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 13 of 13)

- [Zero-Shot Learning -- A Comprehensive Evaluation of the Good, the Bad and the Ugly](https://mlsanity.com/paper/1707.00600/) (2017)
- [RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response](https://mlsanity.com/paper/1407.6981/) (2014)
- [Collecting Telemetry Data Privately](https://mlsanity.com/paper/1712.01524/) (2017)
- [The Privacy Blanket of the Shuffle Model](https://mlsanity.com/paper/1903.02837/) (2019)
- [Manipulation Attacks in Local Differential Privacy](https://mlsanity.com/paper/1909.09630/) (2019)
- [Data Poisoning Attacks to Local Differential Privacy Protocols](https://mlsanity.com/paper/1911.02046/) (2019)
- [Locally Differentially Private Analysis of Graph Statistics](https://mlsanity.com/paper/2010.08688/) (2020)
- [Estimating Numerical Distributions under Local Differential Privacy](https://mlsanity.com/paper/1912.01051/) (2019)
- [Locally Differentially Private Frequency Estimation with Consistency](https://mlsanity.com/paper/1905.08320/) (2019)
- [Poisoning Attacks to Local Differential Privacy Protocols for Key-Value Data](https://mlsanity.com/paper/2111.11534/) (2021)
- [Differentially Private Histograms in the Shuffle Model from Fake Users](https://mlsanity.com/paper/2104.02739/) (2021)
- [Differential Aggregation against General Colluding Attackers](https://mlsanity.com/paper/2302.09315/) (2023)
- [LDPRecover: Recovering Frequencies from Poisoning Attacks against Local Differential Privacy](https://mlsanity.com/paper/2403.09351/) (2024)

## Built on by (most cited first, 5 of 5)

- [Data Poisoning Attacks to Locally Differentially Private Range Query Protocols](https://mlsanity.com/paper/2503.03454/) (2025)
- [Poisoning Attacks to Local Differential Privacy Protocols for Trajectory Data](https://mlsanity.com/paper/2503.07483/) (2025)
- [Mitigating Data Poisoning Attacks to Local Differential Privacy](https://mlsanity.com/paper/2506.02156/) (2025)
- [Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning](https://mlsanity.com/paper/2606.17035/) (2026)
- [Robust Estimation of Sparse Numerical Vectors under Local Differential Privacy](https://mlsanity.com/paper/2607.27815/) (2026)

## Abstract (arXiv)

Recent studies reveal that local differential privacy (LDP) protocols are vulnerable to data poisoning attacks where an attacker can manipulate the final estimate on the server by leveraging the characteristics of LDP and sending carefully crafted data from a small fraction of controlled local clients. This vulnerability raises concerns regarding the robustness and reliability of LDP in hostile environments. In this paper, we conduct a systematic investigation of the robustness of state-of-the-art LDP protocols for numerical attributes, i.e., categorical frequency oracles (CFOs) with binning and consistency, and distribution reconstruction. We evaluate protocol robustness through an attack-driven approach and propose new metrics for cross-protocol attack gain measurement. The results indicate that Square Wave and CFO-based protocols in the Server setting are more robust against the attack compared to the CFO-based protocols in the User setting. Our evaluation also unfolds new relationships between LDP security and its inherent design choices. We found that the hash domain size in local-hashing-based LDP has a profound impact on protocol robustness beyond the well-known effect on utility. Further, we propose a zero-shot attack detection by leveraging the rich reconstructed distribution information. The experiment show that our detection significantly improves the existing methods and effectively identifies data manipulation in challenging scenarios.