Search papers, labs, and topics across Lattice.
This paper tackles the challenge of robust sparse vector mean estimation in the context of local differential privacy (LDP), particularly focusing on multi-item users who are more susceptible to poisoning attacks. The authors introduce a novel method called Randomized Projection with Clipping (RPC), which mitigates the impact of adversarial interference by projecting user data onto a random binary vector and applying a clipping mechanism to limit attack potential. The proposed approach not only provides a theoretical guarantee for estimation error under various attack scenarios but also demonstrates superior robustness against poisoning in numerical experiments compared to existing methods.
Multi-item users can face significantly more powerful poisoning attacks, but a new method achieves robust estimation without sacrificing performance.
Local differential privacy (LDP) protocols are vulnerable to poisoning attacks. Existing research have proposed efficient defense strategies for single-item users. However, in practice, a user may possess multiple items. The defense against poisoning attacks for multi-item users is challenging, because due to larger output spaces, the adversary can conduct more powerful attacks without being detected. In this paper, we address the robust sparse vector mean estimation problem, in which each user has a vector with $m$ nonzero coordinates. We propose Randomized Projection with Clipping (RPC). Firstly, the server sends a random binary vector to each user. The user then projects its local data on the vector, and clip the value to restrict the attacker's capability. To handle clipping bias, we propose a correction method based on a careful analysis that gives an exact expression of the bias. As a result, bias-variance tradeoff is no longer needed, thus the clipping threshold can be further reduced to shrink the output space and enhance robustness. We provide a rigorous theoretical guarantee of the estimation error under all possible attacks. Numerical experiments show that under trusted environments, our new method achieves comparable or better performance than existing methods, indicating that our method is already an efficient estimator in its own right. Under untrusted environments, our method is also significantly more robust to poisoning attacks.
