Guided by Noise: Vulnerable Poisoning Attack to Differentially Private Federated Learning

Distributed Federated Learning (FL) enables client models to communicate with the central server and collaboratively train a central model while keeping individual datasets localized. Despite its advantages, recent research highlights vulnerabilities in the communication between clients and the central server, which attackers can exploit to compromise client privacy. To protect clients' privacy against such attacks, differential privacy (DP) is widely adopted and implemented during the stochastic gradient descent (SGD) stage. While DP-SGD has shown efficacy in previous studies, our analysis reveals that its implementation inadvertently disperses the distribution of data features. This necessitates the relaxation of alert thresholds during weight verification, introducing unforeseen security risks. In this work, we demonstrate how such relaxed criteria allow malicious clients to execute stealthy targeted attacks, evading detection while corrupting the central model. Specifically, our attack degrades the classification accuracy of selected classes without significantly impacting overall model performance. By leveraging the distortions introduced by DP noise, we precisely undermine the classification accuracy of targeted classes. Experimental evaluations validate the effectiveness of our approach, achieving high success rates. Targeted class accuracy can be reduced to as low as 35 %, while the accuracy of non-targeted classes declines by less than 1 %. Our attack exhibits exceptional stealth, successfully bypassing widely used defenses, even under independent and identically distributed (i.i.d.) data scenarios.