Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning

A preprint posted to arXiv challenges the widely held assumption that differential privacy strengthens federated learning against backdoor attacks, showing instead that the privacy mechanism can mask malicious activity and render existing defenses ineffective [1][2]. The paper, submitted on 15 Jun 2026, introduces an attack called RING that exploits the noise added by differential privacy (DP) to hide compromised model updates [1][2]. Researchers found that while bypassing DP allows state-of-the-art defenses to detect and filter malicious contributions, complying with DP inadvertently masks the statistical characteristics those defenses rely on [1][2]. As a result, the raw backdoor signal is reduced and anomaly detection fails [1][2]. RING operates as a perturbation layer that is agnostic to the underlying backdoor technique, meaning it can be combined with existing attacks [1][2]. Compromised clients collaboratively craft adversarial perturbations so that a strong backdoor signal is reconstructed during aggregation without triggering alarms [1][2]. Across four image and text datasets under non-iid distributions, RING achieved an average attack success rate of 90.3% against six state-of-the-art defenses under a moderate privacy budget, an improvement of up to 26.08x over baseline strategies [1][2]. The authors also evaluated potential countermeasures and found that mitigating the threat incurs significant utility trade-offs, exposing what they describe as a fundamental security gap in the deployment of differentially private federated learning [1][2]. The work appears on arXiv, an open-access repository of electronic preprints that, as of November 2024, receives about 24,000 submissions per month and hosts papers that are moderated but not peer reviewed [6]. The paper is listed under the Computer Science > Machine Learning category and is accessible through the standard arXiv abstract page, which includes experimental features developed through arXivLabs — a framework for community-contributed tools such as bibliographic explorers and code finders [1][4][5].