Abstract
Federated learning (FL) combined with local differential privacy (LDP)enables privacy-preserving model training across decentralized data sources.However, the decentralized data-management paradigm leaves LDPFL vulnerable toparticipants with malicious intent. The robustness of LDPFL protocols,particularly against model poisoning attacks (MPA), where adversaries injectmalicious updates to disrupt global model convergence, remains insufficientlystudied. In this paper, we propose a novel and extensible model poisoningattack framework tailored for LDPFL settings. Our approach is driven by theobjective of maximizing the global training loss while adhering to localprivacy constraints. To counter robust aggregation mechanisms such asMulti-Krum and trimmed mean, we develop adaptive attacks that embed carefullycrafted constraints into a reverse training process, enabling evasion of thesedefenses. We evaluate our framework across three representative LDPFLprotocols, three benchmark datasets, and two types of deep neural networks.Additionally, we investigate the influence of data heterogeneity and privacybudgets on attack effectiveness. Experimental results demonstrate that ouradaptive attacks can significantly degrade the performance of the global model,revealing critical vulnerabilities and highlighting the need for more robustLDPFL defense strategies against MPA. Our code is available athttps://github.com/ZiJW/LDPFL-Attack