RPC method makes local differential privacy robust to poisoning attacks

Local differential privacy (LDP) protects user data by adding noise before it leaves the device, but it remains vulnerable to poisoning attacks. Existing defenses work well for users with a single item, but real-world scenarios often involve multi-item users with larger output spaces, leaving room for more powerful undetected attacks. The paper, submitted to arXiv on 30 Jul 2026 (arXiv:2607.27815), tackles this gap by focusing on robust estimation of sparse numerical vectors, where each user holds a vector with m nonzero coordinates.

The proposed Randomized Projection with Clipping (RPC) method works by having the server send a random binary vector to each user. Users then project their local data onto this vector and clip the value, restricting the maximum influence any single user can have. To correct the bias introduced by clipping, the authors derive an exact expression for the bias, removing the need for a bias-variance tradeoff. This allows them to shrink the clipping threshold further, reducing the output space and improving robustness. The paper provides rigorous theoretical guarantees on estimation error under all possible attacks. Numerical experiments show that in trusted environments, RPC matches or beats existing estimators, while in untrusted settings it offers significantly greater resistance to poisoning attacks, making it both a solid standalone estimator and a strong defense mechanism.