On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy

Abstract--Federated learning (FL) combined with local differential privacy (LDP) enables privacy-preserving model training across decentralized data sources. However, the decentralized data-management paradigm leaves LDPFL vulnerable to participants with malicious intent. The robustness of LDPFL protocols, particularly against model poisoning attacks (MPA), where adversaries inject malicious updates to disrupt global model convergence, remains insufficiently studied. In this paper, we propose a novel and extensible model poisoning attack framework tailored for LDPFL settings. Our approach is driven by the objective of maximizing the global training loss while adhering to local privacy constraints. T o counter robust aggregation mechanisms such as Multi-Krum and trimmed mean, we develop adaptive attacks that embed carefully crafted constraints into a reverse training process, enabling evasion of these defenses. We evaluate our framework across three representative LDPFL protocols, three benchmark datasets, and two types of deep neural networks. Additionally, we investigate the influence of data heterogeneity and privacy budgets on attack effectiveness. Experimental results demonstrate that our adaptive attacks can significantly degrade the performance of the global model, revealing critical vulnerabilities and highlighting the need for more robust LDPFL defense strategies against MPA. Index T erms--federated learning, locally differential privacy, poisoning robustness I. INTRODUCTION Federated Learning (FL) [1]-[8] has become a powerful paradigm enabling collaborative model training across distributed clients without direct access to clients' local datasets. It has been adopted in various applications, from improving input prediction in personalized keyboards [1] and advancing disease prediction [2], to predicting spatio-temporal traffic series [3] and enhancing trajectory similarity calculation [4].