Faculty, Staff and Student Publications
Language
English
Publication Date
7-1-2024
Journal
Data and Applications Security and Privacy XXXVIII
DOI
10.1007/978-3-031-65172-4_20
PMID
40401162
PMCID
PMC12094713
PubMedCentral® Posted Date
5-21-2025
PubMedCentral® Full Text Version
Author MSS
Abstract
Differential Privacy (DP) was originally developed to protect privacy. However, it has recently been utilized to secure machine learning (ML) models from poisoning attacks, with DP-SGD receiving substantial attention. Nevertheless, a thorough investigation is required to assess the effectiveness of different DP techniques in preventing backdoor attacks in practice. In this paper, we investigate the effectiveness of DP-SGD and, for the first time, examine PATE and Label-DP in the context of backdoor attacks. We also explore the role of different components of DP algorithms in defending against backdoor attacks and will show that PATE is effective against these attacks due to the bagging structure of the teacher models it employs. Our experiments reveal that hyper-parameters and the number of backdoors in the training dataset impact the success of DP algorithms. We also conclude that while Label-DP algorithms generally offer weaker privacy protection, accurate hyper-parameter tuning can make them more effective than DP methods in defending against backdoor attacks while maintaining model accuracy.
Keywords
Differential Privacy, Backdoor Attack, Security
Published Open-Access
yes
Recommended Citation
Fereshteh Razmi, Jian Lou, and Li Xiong, "Does Differential Privacy Prevent Backdoor Attacks in Practice?" (2024). Faculty, Staff and Student Publications. 914.
https://digitalcommons.library.tmc.edu/uthshis_docs/914