Data Poisoning in Longitudinal Local Differential Privacy: Attacks and Analysis

Local Differential Privacy (LDP) is widely deployed for large-scale telemetry, particularly for frequency monitoring. In practice, these systems operate in a longitudinal setting, where data is repeatedly collected using mechanisms such as memoization and two-round sanitization to control cumulative privacy loss. While prior work has shown that single-round LDP protocols are vulnerable to data poisoning attacks, the robustness of longitudinal LDP remains largely unexplored. In this work, we provide the first systematic analysis of data poisoning in longitudinal LDP frequency estimation. We extend existing attack models to two-round protocols and derive closed-form expressions for expected attack gain under unbiased estimation, highlighting the role of longitudinal parameters and encoding mechanisms. We further propose the Memoized Target Attack (MTA), a novel poisoning attack which exploits memoization to induce persistent and stealthier bias. Experiments across multiple protocols and datasets show that encoding mechanisms dominate robustness, and that longitudinal statefulness fundamentally reshapes the attack–defense tradeoff. We also evaluate defenses and introduce a timestamp-assisted extension of frequent-itemset anomaly detection tailored to longitudinal settings. Our results provide the first characterization of adversarial robustness in widely used longitudinal LDP systems.