Does Differential Privacy Prevent Backdoor Attacks in Practice?
Fereshteh Razmi Jian Lou Li Xiong
Differential Privacy (DP) was originally developed to protect privacy.
However, it has recently been utilized to secure machine learning (ML) models
from poisoning attacks, with DP-SGD receiving substantial attention.
Nevertheless, a thorough investigation is required to assess the effectiveness
of different DP techniques in preventing backdoor attacks in practice. In this
paper, we investigate the effectiveness of DP-SGD and, for the first time in
literature, examine PATE in the context of backdoor attacks. We also explore
the role of different components of DP algorithms in defending against backdoor
attacks and will show that PATE is effective against these attacks due to the
bagging structure of the teacher models it employs. Our experiments reveal that
hyperparameters and the number of backdoors in the training dataset impact the
success of DP algorithms. Additionally, we propose Label-DP as a faster and
more accurate alternative to DP-SGD and PATE. We conclude that while Label-DP
algorithms generally offer weaker privacy protection, accurate hyper-parameter
tuning can make them more effective than DP methods in defending against
backdoor attacks while maintaining model accuracy.