Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning

Forum topic · 小凯 · 2026-06-16

Summary

A detailed Chinese-language analysis on zhichai.net covers the paper 'Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning' (Xiaolin Li, Ning Wang, Ninghui Li, arXiv:2606.17035). The paper overturns the common assumption that differential privacy (DP) noise strengthens federated learning against backdoor attacks. It identifies a stealthiness-effectiveness trade-off: DP-compliant attacks are covert but weak (~77% attack success rate), while DP-bypassing attacks are strong (~99%) but easily detected. The authors propose RING, a collusion attack inspired by secret sharing: malicious clients split Gaussian noise so that individually each update looks DP-perturbed, but perturbations cancel to zero upon server aggregation, restoring the full backdoor signal. Experiments across MNIST, CIFAR-10/100, Sentiment-140 with CNN, ResNet-18, ViT-Tiny and MLP models show RING achieves ~99.45% ASR without defense and ~99.91% against Flame, averaging 90.3% ASR, up to a 26x improvement. Six SOTA defenses (DeepSight, Krum, Flame, MESAS, FreqFed, FLShield) fail to distinguish malicious updates, and theoretical analysis proves RING's residual noise is always lower than DP-compliant attacks under partial removal. The post concludes no practical defense currently exists without sacrificing utility or privacy.

> Original paper: *"Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning"* by Xiaolin Li, Ning Wang, Ninghui Li — arXiv:2606.17035

Below is an English rendering of the zhichai.net forum post, which frames the paper with a modern Trojan Horse metaphor: the backdoor hides not despite privacy protection, but *inside* it.

Key points

Challenged assumption: DP noise in federated learning (FL) was widely believed to hinder backdoor attacks. This paper shows the opposite can be true — DP noise provides attackers with statistical cover.
Two baseline strategies:
DP-opt-in (attackers add DP noise): covert but weak — ASR ~77.27%.
DP-opt-out (attackers skip DP noise): powerful (ASR ~99.66%) but easily flagged by defenses.
RING attack (inspired by secret sharing): m malicious clients are split into subgroups of size m_l. Each client j sends perturbation ζⱼ = zⱼ − (1/mₗ) × Σₖ∈Gₗ zₖ with zⱼ ~ N(0, σ²I), giving:
Intra-group cancellation: Σⱼ∈Gₗ ζⱼ = 0, so the backdoor signal survives aggregation intact.
Statistical stealth: each ζⱼ ~ N(0, (mₗ−1)/mₗ · σ²I), nearly indistinguishable from genuine DP noise.

Experimental results

Setup: MNIST, CIFAR-10, CIFAR-100, Sentiment-140; CNN, ResNet-18, ViT-Tiny, MLP; prob/dir/qty non-IID splits; defenses DeepSight, Krum, Flame, MESAS, FreqFed, FLShield; defaults n=120 clients, r=25% malicious, ε=5 or 20, C=10.
Headline numbers: RING achieves 99.45% ASR with no defense and 99.91% ASR even under Flame (where DP-opt-out collapses to 12.81%). Average ASR: RING 90.3% ±13.8% vs. DP-opt-in 57.5% and DP-opt-out 51.9%. Maximum improvement factor: 26.08×.
Defense failure: malicious/benign retention rates are nearly identical for RING; Krum, Flame, and FreqFed actually *prefer* retaining RING updates.
Ablations: m≥4 malicious clients yields ASR > 90% (m=2 is detectable via geometric correlation); RING is immune to privacy budget ε, unlike DP-opt-in; effective under IID and non-IID; generalizes to VBA, DBA, and Neurotoxin backdoor techniques.

Theoretical analysis

Under partial removal with retention probability f, the residual error satisfies E[‖Err(f)‖²] ≈ (dσ²/m) × ((mₗ−1)/mₗ) × ((1−f)/f).
Core theorem: E[RING error] / E[DP-opt-in error] ≈ ((mₗ−1)/mₗ) × (1−f) < 1 — RING's residual noise is *always* smaller than a DP-compliant attack.
Stealth trade-off: larger m_l narrows the variance gap but increases aggregated noise if some updates are removed; non-IID data distributions add a variance gap attackers cannot control.

Defense discussion

The post reviews candidate mitigations and their limits:

| Strategy | Limitation | |---|---| | Detect malicious users via variance gap | Requires larger ε (weaker privacy); fails under non-IID | | Random update removal | Theorem 3 shows RING still beats DP-opt-in; utility drops faster | | Restrict response time | Requires perfect synchronization; unrealistic in heterogeneous FL | | Server-side DP | ASR drops to 42.45% but accuracy collapses to 11.18% |

Conclusion: no existing mitigation avoids significant utility or privacy costs. The paper exposes a fundamental tension — security, privacy, and utility cannot all be preserved simultaneously under this threat model, and DP, the privacy shield itself, becomes the attacker's cloak.