Poisoning Attacks to Local Differential Privacy for Ranking Estimation

TL;DR

This paper introduces novel poisoning attack strategies against local differential privacy protocols for ranking estimation, demonstrating their effectiveness through theoretical analysis and empirical experiments, and highlighting the need for robust defenses.

Contribution

It presents new poisoning attack methods tailored for LDP ranking protocols and proposes strategies to optimize attack success, filling a gap in understanding vulnerabilities.

Findings

Attacks significantly alter ranking outcomes.

Theoretical analysis confirms attack effectiveness.

Empirical results validate attack strategies.

Abstract

Local differential privacy (LDP) involves users perturbing their inputs to provide plausible deniability of their data. However, this also makes LDP vulnerable to poisoning attacks. In this paper, we first introduce novel poisoning attacks for ranking estimation. These attacks are intricate, as fake attackers do not merely adjust the frequency of target items. Instead, they leverage a limited number of fake users to precisely modify frequencies, effectively altering item rankings to maximize gains. To tackle this challenge, we introduce the concepts of attack cost and optimal attack item (set), and propose corresponding strategies for kRR, OUE, and OLH protocols. For kRR, we iteratively select optimal attack items and allocate suitable fake users. For OUE, we iteratively determine optimal attack item sets and consider the incremental changes in item frequencies across different sets. Regarding OLH, we develop a harmonic cost function based on the pre-image of a hash to select that supporting a larger number of effective attack items. Lastly, we present an attack strategy based on confidence levels to quantify the probability of a successful attack and the number of attack iterations more precisely. We demonstrate the effectiveness of our attacks through theoretical and empirical evidence, highlighting the necessity for defenses against these attacks. The source code and data have been made available at https://github.com/LDP-user/LDP-Ranking.git.