Robust Estimation of Sparse Numerical Vectors under Local Differential Privacy

2026-07-30

AI Summary

This work addresses the vulnerability of mean estimation for sparse user numerical vectors under local differential privacy to poisoning attacks. To mitigate this issue, the authors propose a Random Projection and Clipping (RPC) mechanism, wherein the server distributes random binary vectors, and users locally perform projection and clipping to bound the influence of malicious inputs. Crucially, RPC incorporates an exact bias expression to enable unbiased correction, thereby circumventing the conventional bias-variance trade-off. As the first method to provide robustness guarantees in this setting, RPC allows for lower clipping thresholds, achieving performance on par with or superior to existing approaches in trusted environments while significantly enhancing robustness under adversarial conditions. The approach is accompanied by rigorous theoretical error bounds.

Abstract

Local differential privacy (LDP) protocols are vulnerable to poisoning attacks. Existing research have proposed efficient defense strategies for single-item users. However, in practice, a user may possess multiple items. The defense against poisoning attacks for multi-item users is challenging, because due to larger output spaces, the adversary can conduct more powerful attacks without being detected. In this paper, we address the robust sparse vector mean estimation problem, in which each user has a vector with $m$ nonzero coordinates. We propose Randomized Projection with Clipping (RPC). Firstly, the server sends a random binary vector to each user. The user then projects its local data on the vector, and clip the value to restrict the attacker's capability. To handle clipping bias, we propose a correction method based on a careful analysis that gives an exact expression of the bias. As a result, bias-variance tradeoff is no longer needed, thus the clipping threshold can be further reduced to shrink the output space and enhance robustness. We provide a rigorous theoretical guarantee of the estimation error under all possible attacks. Numerical experiments show that under trusted environments, our new method achieves comparable or better performance than existing methods, indicating that our method is already an efficient estimator in its own right. Under untrusted environments, our method is also significantly more robust to poisoning attacks.

Problem

• Local Differential Privacy
• Poisoning Attacks
• Sparse Vector Estimation
• Robust Estimation
• Multi-item Users

Innovation

• Local Differential Privacy
• Poisoning Attacks
• Sparse Vector Estimation
• Randomized Projection
• Bias Correction