Prior research suggests that differential privacy (DP) inherently enhances the robustness of federated learning (FL) against backdoor attacks. In this paper, we challenge this assumption. Through an empirical analysis of two baseline attack strategies, we uncover a fundamental tension in DP-FL: while bypassing DP allows state-of-the-art defenses to detect and filter malicious updates, complying with DP inadvertently masks their distinguishing statistical characteristics. Consequently, existing defenses become ineffective as DP reduces the raw backdoor signal. Building on this masking effect, we propose RING, a novel attack that explicitly exploits DP to conceal malicious contributions while maximizing attack impact. By collaboratively crafting adversarial perturbations, compromised clients reconstruct a strong backdoor signal during aggregation without triggering anomaly detection. RING operates as a perturbation layer that is agnostic to the underlying backdoor technique, making it broadly applicable and composable with existing attacks -- a property that significantly amplifies the threat it poses to DP-FL. Extensive evaluations across four image and text datasets under non-iid distributions show that RING achieves an average attack success rate of 90.3% against six state-of-the-art defenses under a moderate privacy budget, an improvement of up to 26.08x over baseline strategies. Finally, we evaluate potential countermeasures and find that mitigating this threat incurs significant utility trade-offs, exposing a fundamental security gap in the deployment of differentially private FL.

翻译：先前研究表明，差分隐私（DP）本质上增强了联邦学习（FL）对后门攻击的鲁棒性。本文挑战了这一假设。通过对两种基线攻击策略的实证分析，我们揭示了DP-FL中存在的根本性矛盾：规避DP时，最先进的防御机制能够检测并过滤恶意更新；而遵循DP约束反而无意中掩盖了这些更新的区分性统计特征。因此，当DP削弱原始后门信号时，现有防御机制变得无效。基于这种掩盖效应，我们提出RING——一种明确利用DP隐藏恶意贡献同时最大化攻击效果的新型攻击方法。受损客户端通过协同构造对抗性扰动，在聚合过程中重建强后门信号而不触发异常检测。RING作为与底层后门技术无关的扰动层运作，具有广泛适用性和与现有攻击的可组合性——这种特性显著放大了其对DP-FL构成的威胁。在四种图像和文本数据集上非独立同分布条件下的广泛评估表明，在中等隐私预算下，RING针对六种最先进防御机制的平均攻击成功率达90.3%，比基线策略提升最高达26.08倍。最后，我们评估了潜在反制措施，发现缓解该威胁会引发显著的效用权衡，暴露了部署差分隐私FL时的根本性安全鸿沟。