Federated Learning (FL) allows multiple participants to collaboratively train machine learning models by keeping their datasets local and exchanging model updates. Recent work has highlighted weaknesses related to robustness and privacy in FL, including backdoor, membership and property inference attacks. In this paper, we investigate whether and how Differential Privacy (DP) can be used to defend against attacks targeting both robustness and privacy in FL. To this end, we present a first-of-its-kind experimental evaluation of Local and Central Differential Privacy (LDP/CDP), assessing their feasibility and effectiveness. We show that both LDP and CDP do defend against backdoor attacks, with varying levels of protection and utility, and overall more effectively than non-DP defenses. They also mitigate white-box membership inference attacks, which our work is the first to show. Neither, however, defend against property inference attacks, prompting the need for further research in this space. Overall, our work also provides a re-usable measurement framework to quantify the trade-offs between robustness/privacy and utility in differentially private FL.

本文研究了如何使用差分隐私技术来保护联邦学习中的隐私和鲁棒性，评估了局部差分隐私（LDP）和中心差分隐私（CDP）技术的可行性和有效性。实验证明，这两个差分隐私技术都可以有效防止后门攻击，并且较其他鲁棒性防御更加有效。同时，差分隐私还可以减轻白盒成员推理攻击。然而，这两个技术都无法防御属性推理攻击。

联邦学习中的本地和中央差分隐私保障鲁棒性和隐私性