LDPRecover: Recovering Frequencies from Poisoning Attacks against Local Differential Privacy
Xinyue Sun, Qingqing Ye, Haibo Hu, Jiawei Duan, Tianyu Wo, Jie Xu, Renyu Yang
TL;DR
LDPRecover addresses the vulnerability of frequency-estimation in Local Differential Privacy to poisoning attacks by modeling poisoned aggregates as a mixture of genuine and malicious frequencies and introducing a genuine-frequency estimator. It learns malicious-frequency statistics via an adaptive attack and casts recovery as a constraint-inference problem, enabling accurate reconstruction of genuine frequencies even without attack details; partial attacker knowledge further improves results. The approach is validated on two real-world datasets and three LDP protocols against untargeted, targeted, and adaptive attacks, showing robust accuracy and reduced frequency gains for targets. This work offers a practical, attack-agnostic paradigm for robust LDP deployments and lays groundwork for extending recovery to other aggregation tasks and defenses against input poisoning.
Abstract
Local differential privacy (LDP), which enables an untrusted server to collect aggregated statistics from distributed users while protecting the privacy of those users, has been widely deployed in practice. However, LDP protocols for frequency estimation are vulnerable to poisoning attacks, in which an attacker can poison the aggregated frequencies by manipulating the data sent from malicious users. Therefore, it is an open challenge to recover the accurate aggregated frequencies from poisoned ones. In this work, we propose LDPRecover, a method that can recover accurate aggregated frequencies from poisoning attacks, even if the server does not learn the details of the attacks. In LDPRecover, we establish a genuine frequency estimator that theoretically guides the server to recover the frequencies aggregated from genuine users' data by eliminating the impact of malicious users' data in poisoned frequencies. Since the server has no idea of the attacks, we propose an adaptive attack to unify existing attacks and learn the statistics of the malicious data within this adaptive attack by exploiting the properties of LDP protocols. By taking the estimator and the learning statistics as constraints, we formulate the problem of recovering aggregated frequencies to approach the genuine ones as a constraint inference (CI) problem. Consequently, the server can obtain accurate aggregated frequencies by solving this problem optimally. Moreover, LDPRecover can serve as a frequency recovery paradigm that recovers more accurate aggregated frequencies by integrating attack details as new constraints in the CI problem. Our evaluation on two real-world datasets, three LDP protocols, and untargeted and targeted poisoning attacks shows that LDPRecover is both accurate and widely applicable against various poisoning attacks.