这篇论文颠覆了'差分隐私天然防后门'的认知，提出了RING攻击，平均成功率90.3%，建议做联邦学习安全的都看看。
该论文挑战了差分隐私（DP）固有增强联邦学习（FL）鲁棒性的假设。通过分析两种基线攻击策略，发现DP会掩盖恶意更新的统计特征，使现有防御失效。作者提出RING攻击，显式利用DP来隐藏恶意贡献，同时最大化攻击影响。在四个图像和文本数据集上的非独立同分布场景中，RING在中等隐私预算下对六种先进防御的平均攻击成功率达到90.3%，相比基线策略提升高达26.08倍。评估表明缓解该威胁会带来显著的效用权衡，暴露了差分隐私FL部署中的根本安全漏洞。
Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning
Prior research suggests that differential privacy (DP) inherently enhances the robustness of federated learning (FL) against backdoor attacks. In this paper, we challenge this assumption. Through an empirical analysis of two baseline attack strategies, we uncover a fundamental tension in DP-FL: while bypassing DP allows state-of-the-art defenses to detect and filter malicious updates, complying with DP inadvertently masks their distinguishing statistical characteristics. Consequently, existing defenses become ineffective as DP reduces the raw backdoor signal. Building on this masking effect, we propose RING, a novel attack that explicitly exploits DP to conceal malicious contributions while maximizing attack impact. By collaboratively crafting adversarial perturbations, compromised clients reconstruct a strong backdoor signal during aggregation without triggering anomaly detection. RING operates as a perturbation layer that is agnostic to the underlying backdoor technique, making it broadly applicable and composable with existing attacks -- a property that significantly amplifies the threat it poses to DP-FL. Extensive evaluations across four image and text datasets under non-iid distributions show that RING achieves an average attack success rate of 90.3% against six state-of-the-art defenses under a moderate privacy budget, an improvement of up to 26.08x over baseline strategies. Finally, we evaluate potential countermeasures and find that mitigating this threat incurs significant utility trade-offs, exposing a fundamental security gap in the deployment of differentially private FL.