# Mitigating Data Poisoning Attacks to Local Differential Privacy

arXiv: https://arxiv.org/abs/2506.02156 · HTML: https://mlsanity.com/paper/2506.02156/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 13 of its 25 references that are in the map.
- First posted on arXiv 2 Jun 2025.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 13 of 13)

- [RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response](https://mlsanity.com/paper/1407.6981/) (2014)
- [Minimax Optimal Procedures for Locally Private Estimation](https://mlsanity.com/paper/1604.02390/) (2016)
- [Collecting and Analyzing Multidimensional Data with Local Differential Privacy](https://mlsanity.com/paper/1907.00782/) (2019)
- [Local, Private, Efficient Protocols for Succinct Histograms](https://mlsanity.com/paper/1504.04686/) (2015)
- [Practical Locally Private Heavy Hitters](https://mlsanity.com/paper/1707.04982/) (2017)
- [Manipulation Attacks in Local Differential Privacy](https://mlsanity.com/paper/1909.09630/) (2019)
- [Data Poisoning Attacks to Local Differential Privacy Protocols](https://mlsanity.com/paper/1911.02046/) (2019)
- [Estimating Numerical Distributions under Local Differential Privacy](https://mlsanity.com/paper/1912.01051/) (2019)
- [Locally Differentially Private Frequency Estimation with Consistency](https://mlsanity.com/paper/1905.08320/) (2019)
- [Poisoning Attacks to Local Differential Privacy Protocols for Key-Value Data](https://mlsanity.com/paper/2111.11534/) (2021)
- [Fine-grained Poisoning Attack to Local Differential Privacy Protocols for Mean and Variance Estimation](https://mlsanity.com/paper/2205.11782/) (2022)
- [Locally Differentially Private Heavy Hitter Identification](https://mlsanity.com/paper/1708.06674/) (2017)
- [On the Robustness of LDP Protocols for Numerical Attributes under Data Poisoning Attacks](https://mlsanity.com/paper/2403.19510/) (2024)

## Built on by (most cited first, 1 of 1)

- [Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning](https://mlsanity.com/paper/2606.17035/) (2026)

## Abstract (arXiv)

The distributed nature of local differential privacy (LDP) invites data poisoning attacks and poses unforeseen threats to the underlying LDP-supported applications. In this paper, we propose a comprehensive mitigation framework for popular frequency estimation, which contains a suite of novel defenses, including malicious user detection, attack pattern recognition, and damaged utility recovery. In addition to existing attacks, we explore new adaptive adversarial activities for our mitigation design. For detection, we present a new method to precisely identify bogus reports and thus LDP aggregation can be performed over the ``clean'' data. When the attack behavior becomes stealthy and direct filtering out malicious users is difficult, we further propose a detection that can effectively recognize hidden adversarial patterns, thus facilitating the decision-making of service providers. These detection methods require no additional data and attack information and incur minimal computational cost. Our experiment demonstrates their excellent performance and substantial improvement over previous work in various settings. In addition, we conduct an empirical analysis of LDP post-processing for corrupted data recovery and propose a new post-processing method, through which we reveal new insights into protocol recommendations in practice and key design principles for future research.