Backdoor Mitigation in Decentralized LLM Fine-Tuning
Chorus lets decentralized LLM fine-tuning nodes reject backdoored adapters, cutting neighbor attack success to at most 2.2%.
Decentralized LLM fine-tuning exchanges trainable adapters over a communication graph, so one poisoned node can backdoor neighbors that never saw poisoned data and make them refuse trigger prompts. Chorus has each adapter's receivers probe it against their own trusted adapter, pool results, and vote before aggregation, without shared validation data or knowledge of the trigger. On two instruction-tuning datasets and LLM architectures, average neighbor attack success fell from 48-63% to at most 2.2%, within 0.6 points of an oracle. The worst honest node stayed at or below 10% ASR versus up to 78% undefended, with negligible communication overhead.
- One poisoned node can backdoor neighbors that never saw poisoned examples.
- Receivers probe adapters, pool findings, and vote before aggregation.
- Average neighbor ASR falls from 48-63% to at most 2.2%.
- Worst honest node stays at or below 10% ASR, matching an oracle.
- No shared validation data or trigger knowledge is required.
From the original article
1 min read at arxiv.orgDecentralized large language model (LLM) fine-tuning lets organizations collaboratively train a shared LLM on data they cannot pool, without a central coordinator. In every round, each node exchanges a trainable adapter with its neighbors over a communication graph, and then aggregates them.
By Sayan Biswas · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.