[论文解读] Poisoning Attacks to Local Differential Privacy Protocols for Key-Value Data

Yongji Wu, Xiaoyu Cao+2 more|arXiv (Cornell University)|Nov 22, 2021

Privacy-Preserving Technologies in Data参考文献 48被引用 10

一句话总结

本文提出针对键值数据的本地差分隐私（LDP）协议的新型投毒攻击，将攻击建模为双目标优化问题，以同时夸大目标键的估计频率和均值。所提出的最大收益攻击（M2GA）有效操纵了分析结果，揭示了现有LDP协议在面对此类攻击时存在严重漏洞，尽管已探索的两种防御措施效果有限。

ABSTRACT

Local Differential Privacy (LDP) protocols enable an untrusted server to perform privacy-preserving, federated data analytics. Various LDP protocols have been developed for different types of data such as categorical data, numerical data, and key-value data. Due to their distributed settings, LDP protocols are fundamentally vulnerable to poisoning attacks, in which fake users manipulate the server's analytics results via sending carefully crafted data to the server. However, existing poisoning attacks focused on LDP protocols for simple data types such as categorical and numerical data, leaving the security of LDP protocols for more advanced data types such as key-value data unexplored. In this work, we aim to bridge the gap by introducing novel poisoning attacks to LDP protocols for key-value data. In such a LDP protocol, a server aims to simultaneously estimate the frequency and mean value of each key among some users, each of whom possesses a set of key-value pairs. Our poisoning attacks aim to simultaneously maximize the frequencies and mean values of some attacker-chosen target keys via sending carefully crafted data from some fake users to the sever. Specifically, since our attacks have two objectives, we formulate them as a two-objective optimization problem. Moreover, we propose a method to approximately solve the two-objective optimization problem, from which we obtain the optimal crafted data the fake users should send to the server. We demonstrate the effectiveness of our attacks to three LDP protocols for key-value data both theoretically and empirically. We also explore two defenses against our attacks, which are effective in some scenarios but have limited effectiveness in other scenarios. Our results highlight the needs for new defenses against our poisoning attacks.

研究动机与目标

• 为解决本地差分隐私（LDP）协议在键值数据上的安全缺口，该类协议易受投毒攻击但此前未被研究。
• 探究攻击者如何通过注入伪造用户并发送精心构造的键值对，来同时提高目标键的估计频率和均值，从而操纵LDP分析结果。
• 提出系统化方法，用于建模并求解此类投毒攻击背后的双目标优化问题。
• 评估现有防御措施对所提攻击的有效性，并识别其在真实场景中的局限性。

提出的方法

• 将投毒攻击建模为双目标优化问题，最大化攻击者选定的目标键的期望频率增益和期望均值增益。
• 提出最大收益攻击（M2GA）方法，近似求解双目标优化问题，推导出伪造用户应发送的最优数据。
• 将频率增益和均值增益定义为攻击前后估计统计量的差异，其期望基于LDP协议的随机性计算。
• 实现基于检测的防御机制：异常计数（OC）和异常评分（AS），通过跨轮次监控用户行为来标记可疑用户。
• 基于每轮每个用户的最大键频次计数计算异常评分，若评分超过阈值η则标记为伪造用户。
• 通过从后续聚合轮次中排除检测到的伪造用户，并在清理后的数据上重新估计频率和均值，应用防御机制。

实验结果

研究问题

• RQ1 能否在LDP协议的键值数据上有效实施投毒攻击，以同时提高目标键的估计频率和均值？
• RQ2 双目标优化建模如何捕捉键值LDP协议中频率与均值操纵的双重目标？
• RQ3 现有防御措施（如OC和AS）在不同协议变体和参数设置下，对所提投毒攻击的缓解程度如何？
• RQ4 当前防御措施在应对复杂键值LDP协议投毒攻击时存在哪些局限性？

主要发现

• M2GA攻击在理论和实证评估中，均成功提高了三种LDP协议（PCKV-UE、PCKV-GRR、PrivKVM）中目标键的估计频率和均值。
• 在评估的两种防御措施中，OC的误报率较高（例如PCKV-UE中达22%），导致排除真实用户后造成显著的效用损失。
• 当β较小时或r较大时，OC未能有效检测伪造用户，导致高漏报率，使M2GA攻击成功。
• 当β或r较小时，异常评分（AS）有效，能将M2GA的频率和均值增益降至接近零；但当β或r较大时，AS失去效果。
• 在默认设置（β=0.05，r=2）下，PCKV-GRR的OC防御误报率为5.5%，攻击下均值增益为-1.04，表明防御导致效用下降。
• 结果表明，当前防御措施不足，亟需开发新型、鲁棒的防御机制以保护键值数据的LDP协议。