Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning
Not on the map. Why?
Abstract (arXiv)
Prior research suggests that differential privacy (DP) can enhance the robustness of federated learning (FL) against backdoor attacks. In this paper, we challenge this assumption. Through an empirical analysis of two baseline attack strategies, we uncover a fundamental tension in DP-FL: while bypassing DP allows state-of-the-art defenses to detect and filter malicious updates, complying with DP inadvertently masks their distinguishing statistical characteristics. Consequently, existing defenses become ineffective as DP reduces the raw backdoor signal. Building on this masking effect, we propose RING, a novel attack that explicitly exploits DP to conceal malicious contributions while maximizing attack impact. By collaboratively crafting adversarial perturbations, compromised clients reconstruct a strong backdoor signal during aggregation without triggering anomaly detection. RING operates as a perturbation layer that is agnostic to the underlying backdoor technique, making it broadly applicable and composable with existing attacks -- a property that significantly amplifies the threat it poses to DP-FL. Extensive evaluations across four image and text datasets under non-iid distributions show that RING achieves an average attack success rate of 90.3% against six state-of-the-art defenses under a moderate privacy budget, an improvement of up to 38.4% over baseline strategies. Finally, we evaluate potential countermeasures and find that mitigating this threat incurs significant utility trade-offs, exposing a fundamental security gap in the deployment of differentially private FL.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 28 of its 47 references that are in the map. First posted on arXiv 15 Jun 2026.
Builds on
28 of 47 references.
References · 28
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2016Deep Learning with Differential Privacycited by 2,728
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
- 2019Deep Leakage from Gradientscited by 1,021
- 2018How To Backdoor Federated Learningcited by 765
- 2018Federated Learning for Mobile Keyboard Predictioncited by 572
- 2017Differentially Private Federated Learning: A Client Level Perspectivecited by 459
- 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
- 2019Can You Really Backdoor Federated Learning?cited by 255
- 2018Applied Federated Learning: Improving Google Keyboard Query Suggestionscited by 204
- 2022FLamby: Datasets and Benchmarks for Cross-Silo Federated Learning in Realistic Healthcare Settingscited by 125
- 2019Federated Learning for Emoji Prediction in a Mobile Keyboardcited by 118
16 more
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
- 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
- 2020Local and Central Differential Privacy for Robustness and Privacy in Federated Learningcited by 78
- 2022The Fundamental Price of Secure Aggregation in Differentially Private Federated Learningcited by 39
- 2022CrowdGuard: Federated Backdoor Detection in Federated Learningcited by 27
- 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 27
- 2019Data Poisoning Attacks to Local Differential Privacy Protocolscited by 26
- 2021Efficient Differentially Private Secure Aggregation for Federated Learning via Hardness of Learning with Errorscited by 25
- 2023FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attackscited by 15
- 2022Unraveling the Connections between Privacy and Certified Robustness in Federated Learning Against Poisoning Attackscited by 12
- 2022Fine-grained Poisoning Attack to Local Differential Privacy Protocols for Mean and Variance Estimationcited by 9
- 2023DP-BREM: Differentially-Private and Byzantine-Robust Federated Learning with Client Momentumcited by 6
- 2024On the Robustness of LDP Protocols for Numerical Attributes under Data Poisoning Attackscited by 5
- 2024Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learningcited by 5
- 2025Two Heads Are Better than One: Model-Weight and Latent-Space Analysis for Federated Learning on Non-iid Data against Poisoning Attackscited by 1
- 2025Mitigating Data Poisoning Attacks to Local Differential Privacycited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning
- 2024Client-Side Patching against Backdoor Attacks in Federated Learning
- 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
- 2025SPA: Towards More Stealth and Persistent Backdoor Attacks in Federated Learning
- 2024Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscape
- 2022Invariant Aggregator for Defending against Federated Backdoor Attacks
- 2023Privacy Inference-Empowered Stealthy Backdoor Attack on Federated Learning under Non-IID Scenarios
- 2026FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement