SENTINEL: Stagewise Integrity Verification for Pipeline Parallel Decentralized Training

Hadi Mohaghegh Dolatabadi; Thalaiyasingam Ajanthan; Sameera Ramasinghe; Chamin P Hewa Koneputugodage; Gil Avraham; Yan Zuo; Violetta Shevchenko; Alexander Long

cs.DCMar 3, 2026

SENTINEL: Stagewise Integrity Verification for Pipeline Parallel Decentralized Training

Authors: Hadi Mohaghegh Dolatabadi, Thalaiyasingam Ajanthan, Sameera Ramasinghe, Chamin P Hewa Koneputugodage, Gil Avraham, Yan Zuo, Violetta Shevchenko, Alexander Long

Organizations: Pluralis Research

Abstract

Decentralized training introduces critical security risks when executed across untrusted, geographically distributed nodes. While existing Byzantine-tolerant literature addresses data parallel (DP) training through robust aggregation methods, pipeline parallelism (PP) presents fundamentally distinct challenges. In PP, model layers are distributed across workers where the activations and their gradients flow between stages rather than being aggregated, making traditional DP approaches inapplicable. We propose SENTINEL, a verification mechanism for PP training without computation duplication. SENTINEL employs lightweight momentum-based monitoring using exponential moving averages (EMAs) to detect corrupted inter-stage communication. Unlike existing Byzantine-tolerant approaches for DP that aggregate parameter gradients across replicas, our approach verifies sequential activation/gradient transmission between layers. We provide theoretical convergence guarantees for this new setting that recovers classical convergence rates when relaxed to standard training. Experiments demonstrate successful training of up to 4B-parameter LLMs across untrusted distributed environments with up to 176 workers while maintaining model convergence and performance.

Figures & tables

Figure 1: Scatter plot of F1-scores vs. validation loss for more than 75 different attack setups. Strong attacks (higher loss) are caught more often (high F1-score), while weak attacks may slip through. Our verification method thus catches the most harmful attacks that would disrupt training.

Figure 2: Distributed threat models. (a) In DP, workers hold full model replicas and only send weight gradients . Traditional Byzantine-tolerant methods consider this case and use robust aggregation . (b & c) The threat model considered in this paper (see Sec. 2.1 ). In PP, workers hold individual layers, and send intermediate activations

\bm{h}

and activation gradients

\bm{g}

, thus corruptions directly affect other workers. (b) In the standard setting there is a fixed grid of pipeline stages and data parallel replicas, and communication is routed through our verifier nodes. (c) In the SWARM setting designed for decentralized setups, data is stochastically routed by trainer nodes. Workers send their computations (

\bm{h}

and

\bm{g}

) to trainers, who then route them to an available worker in the next stage. Our proposed verifiers can seamlessly be added on top of these trainer nodes ( App. G ).

Mode	Attack	Sentinel (Ours)					No Verif.
Mode	Attack	Pr. (%) $\uparrow$	Re . (%) $\uparrow$	F1 (%) $\uparrow$	Det. Speed $\downarrow$	Val. Loss $\downarrow$	Val. Loss $\downarrow$
-	None (Vanilla)	100.0	100.0	100.0	N/A	3.819	3.821
Activation Manipulation	Constant (Zeros)	100.0	100.0	100.0	6.5	3.809	11.761
	Constant (Ones)	100.0	100.0	100.0	6.33	3.817	7.778
	Random Value	100.0	100.0	100.0	6.48	3.827	7.778
	Scaling ( $\alpha=-1$ )	100.0	100.0	100.0	6.38	3.824	4.109

Table 1: Attack detection performance for Llama-3-0.6B on C4 dataset. Metrics shown include precision, recall, F1 score (all as percentages), average detection speed (in iterations), and validation loss.

Dataset	Sentinel (Ours)					Vanilla
Dataset	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Det. Speed $\downarrow$	Val. Loss $\downarrow$	Val. Loss $\downarrow$
C4	83.7	92.3	87.8	78.14	3.831	3.821
FW	81.8	92.3	86.7	66.00	3.827	3.840
OW	91.9	87.2	89.5	52.70	3.784	3.778

Table 2: Detection performance for training Llama-3-0.6B against mixed attacks.

Setup	Attack	Sentinel (Ours)
Setup	Attack	Pr. (%) $\uparrow$	Re . (%) $\uparrow$	F1 (%) $\uparrow$	Det. Speed $\downarrow$	Val. Loss $\downarrow$
0.6B w/ $16\times 16$ Mesh	Random Value	100.0	100.0	100.0	7.96	3.900
	Delay ( $100$ -steps)	85.7	100.0	92.3	14.39	3.945
	Bias Addition	100.0	25.6	40.8	65.15	3.981
	Invisible Noise	100.0	100.0	100.0	7.96	3.898
1.2B w/ $8\times 8$ Mesh	Random Value	100.0	100.0	100.0	4.33	3.723

Table 3: Activation attack detection performance for large-scale Llama-3 training on C4 dataset.

Panel of Figure 3 — Figure 3: Ablation studies on the effect of various elements on the verification performance.

Architecture	Sentinel (Ours)				Vanilla
Architecture	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Val. Loss $\downarrow$	Val. Loss $\downarrow$
Llama-4-0.4B	73.5	92.3	81.8	3.617	3.628
DeepSeek-V3-1B	94.6	97.2	95.9	3.421	3.393
Llama-3-4B	94.9	68.6	79.6	3.714	3.668

Table 4: Detection performance for training alternative models against mixed activation attacks.

Reference Point	Metrics
Reference Point	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Val. Loss $\downarrow$
Average ( $\beta_{h}=\beta_{g}=0$ )	23.08	100.0	37.5	6.248
Sentinel ( $\beta_{h}=0.9,\penalty\ \beta_{g}=0.8$ )	100.0	100.0	100.0	3.826
Sentinel ( $\beta_{h}=\beta_{g}=0.60$ )	94.7	100.0	97.3	3.894
Sentinel ( $\beta_{h}=\beta_{g}=0.99$ )	90.0	100.0	94.7	3.875

Table 5: Ablation study on the impact of EMA in Sentinel .

Distance Metric	Metrics
Distance Metric	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Val. Loss $\downarrow$
SFR	42.9	83.3	56.6	8.882
SWD	40.0	94.4	56.2	6.332
Normalized $L_{2}$	75.0	75.0	75.0	10.274
Absolute Deviation $L_{1}$	71.1	88.9	79.0	3.883
All (Sentinel)	83.7	92.3	87.8	3.831

Table 6: Ablation study on distance metrics against mixed attacks.

Attack	Metrics
Attack	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Val. Loss $\downarrow$
Delay (100-steps)	99.2 $\pm$ 1.6	100.0 $\pm$ 0.0	99.6 $\pm$ 0.8	3.843 $\pm$ 0.008
Invisible Noise (99%)	100.0 $\pm$ 0.0	100.0 $\pm$ 0.0	100.0 $\pm$ 0.0	3.832 $\pm$ 0.004

Table 7: Statistical significance analysis with error bars for the performance of Sentinel against activation delay and invisible noise attack.

Mode	Sentinel (ours)				No Verif.
Mode	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Val. Loss $\downarrow$	Val. Loss $\downarrow$
Activation	100.0	100.0	100.0	3.835	7.776
Gradient	100.0	100.0	100.0	3.818	7.777

Table 8: Verification performance against adaptive attacks.

Method	Attacked Training
Method	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Val. Loss $\downarrow$
Sentinel + Krum	93.6	80.6	86.6	3.873
Sentinel + Bulyan	85.3	80.6	82.9	3.883

Table 9: Sentinel ’s performance in presence of robust aggregators for training Llama-3-0.6B against mixed attacks.

Figure 4: Loss when training Llama-3-0.6B models using SWARM ( Ryabinin et al., 2023 ) with 128 distributed workers on preemptible AWS instances. Workers employ various activation/gradient manipulation attacks to disrupt training. While in the absence of verification training gets disrupted, Sentinel can successfully protect training from divergence.

Appendix figures & tables29 assets

Supplementary material from the paper’s appendix.

Appendix

Aspect	Data Parallel (Prior Work)	Pipeline Parallel (Our Work)
Model Distribution	Full model replica per worker	Model split across workers (layers/stages)
Data Distribution	Different batches per worker	Same batch flows through pipeline
Communication Pattern	Parameter gradients aggregated	Activations/gradients passed sequentially
Byzantine Threat	Corrupted parameter gradients	Corrupted inter-stage activations/gradients
Detection Target	Malicious gradient contributions	Malicious activation/gradient transmissions
Aggregation Method	Robust gradient aggregation	Sequential verification at each stage

Appendix

Table 10: Data Parallel vs. Pipeline Parallel Comparison

Reference	Venue	Malicious Nodes (%)
Mhamdi et al. (2018)	ICML 2018	47.37
Gorbunov et al. (2022)	ICML 2022	43.75
Blanchard et al. (2017)	NeurIPS 2017	33.00
Karimireddy et al. (2021)	ICML 2021	30.55
Malinovsky et al. (2024)	NeurIPS 2024	25.00
Gorbunov et al. (2023)	ICLR 2023	20.00

Appendix

Table 11: Malicious Worker Percentages in Byzantine Fault Tolerance Literature

Method	Metrics
Method	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	TPS $\uparrow$
Duplicate Work Lu et al. (2024)	100.0	100.0	100.0	6483
Sentinel (Ours)	91.9	87.2	89.5	12966

Appendix

Table 12: Comparison with prior work on OpenWebText mixed attacks

Panel of Figure 5 — Figure 5: Verification protocol for handling compromised workers during distributed training. During forward propagation, a worker at stage $s+1$ is detected as potentially compromised (shown in yellow ). The verifier nodes continue forwarding activations to subsequent stages without alerting downstream workers to avoid disrupting the pipeline. During backward propagation, instead of propagating gradients computed by the compromised worker, verifier nodes substitute gradient momentum values to maintain training stability. Communication flows through verifier nodes between consecutive pipeline stages, though direct worker-to-worker arrows are shown for visual clarity.

Panel of Figure 6 — Figure 6: Verification protocol for handling compromised workers during gradient propagation. During backward propagation, a worker at stage $s+2$ is detected as potentially compromised (shown in yellow ). To prevent propagation of tainted gradients, verifier nodes substitute gradient momentum values for all workers in preceding stages ( $s+1$ , $s$ , etc.) instead of forwarding the corrupted gradients. This ensures training stability while maintaining the pipeline flow without alerting downstream workers to the compromise.

Mode	Attack	Sentinel (Ours)					No Verif.
Mode	Attack	Pr. (%) $\uparrow$	Re . (%) $\uparrow$	F1 (%) $\uparrow$	Det. Speed $\downarrow$	Val. Loss $\downarrow$	Val. Loss $\downarrow$
-	None (Vanilla)	100.0	100.0	100.0	N/A	3.818	3.840
Activation Manipulation	Constant (Zeros)	100.0	100.0	100.0	6.43	3.819	11.761
	Constant (Ones)	100.0	100.0	100.0	6.61	3.814	7.793
	Random Value	96.0	100.0	98.0	6.46	3.831	7.793
	Scaling ( $\alpha=-1$ )	100.0	100.0	100.0	6.29	3.827	4.121

Appendix

Table 15: Attack detection performance for Llama-3-0.6B on FineWeb dataset. Metrics shown include precision, recall, F1 score (all as percentages), average detection speed (in iterations), and validation loss.

Mode	Attack	Sentinel (Ours)					No Verif.
Mode	Attack	Pr. (%) $\uparrow$	Re . (%) $\uparrow$	F1 (%) $\uparrow$	Det. Speed $\downarrow$	Val. Loss $\downarrow$	Val. Loss $\downarrow$
-	None (Vanilla)	100.0	100.0	100.0	N/A	3.773	3.778
Activation Manipulation	Constant (Zeros)	100.0	100.0	100.0	6.33	3.773	11.761
	Constant (Ones)	100.0	100.0	100.0	6.29	3.779	7.820
	Random Value	100.0	100.0	100.0	6.29	3.777	7.821
	Scaling ( $\alpha=-1$ )	100.0	100.0	100.0	6.29	3.776	4.016

Appendix

Table 16: Attack detection performance for Llama-3-0.6B on OpenWebText dataset. Metrics shown include precision, recall, F1 score (all as percentages), average detection speed (in iterations), and validation loss.

Panel of Figure 7 — Figure 7: Training loss comparing our verification mechanism against baseline vanilla training under activation manipulation attacks . We evaluate on Llama-3-0.6B using three datasets (C4, FineWeb, and OpenWebText). Dotted vertical lines indicate attack initiation points where 6 randomly selected nodes begin submitting adversarial activations in coordinated Byzantine attacks. Our verification approach maintains stable convergence while the baseline suffers significant degradation under attack.

Panel of Figure 8 — Figure 8: Validation loss comparing our verification mechanism against baseline vanilla training under activation manipulation attacks . We evaluate Llama-3-0.6B across three datasets (C4, FineWeb, and OpenWebText). The dotted red line marks the transition from warm-up to the attack phase, where Byzantine nodes begin submitting adversarial activations. Our verification approach maintains stable validation performance while without it, the baseline shows significant degradation post-attack.

Panel of Figure 9 — Figure 9: Training loss comparing our verification mechanism against baseline vanilla training under gradient manipulation attacks . We evaluate on Llama-3-0.6B using three datasets (C4, FineWeb, and OpenWebText). Dotted vertical lines indicate attack initiation points where 6 randomly selected nodes begin submitting adversarial gradients in coordinated Byzantine attacks. Our verification approach maintains stable convergence while the baseline suffers significant degradation under attack.

Panel of Figure 10 — Figure 10: Validation loss comparing our verification mechanism against baseline vanilla training under gradient manipulation attacks . We evaluate Llama-3-0.6B across three datasets (C4, FineWeb, and OpenWebText). The dotted red line marks the transition from warm-up to the attack phase, where Byzantine nodes begin submitting adversarial gradients. Our verification approach maintains stable validation performance while without it, the baseline shows significant degradation post-attack.

Panel of Figure 12 — Figure 12: Training and validation loss evolution for MoE-based models trained on FineWeb-EDU dataset over 5k iterations with Sentinel . The mixed activation attack scenario assumes 37.5% Byzantine nodes at each pipeline stage, with 30% randomly selected nodes performing a randomly chosen attack at a randomly sampled iteration. Each node has a different activation manipulation method (as outlined in Sec. 2.1 ).

Panel of Figure 13 — Figure 13: Evolution of adaptive deviation bounds and worker statistics. The proposed thresholding mechanism adapts to natural distribution shifts while detecting Byzantine behavior.

Setup	Mode	Attack	Sentinel (Ours)
Setup	Mode	Attack	Pr. (%) $\uparrow$	Re . (%) $\uparrow$	F1 (%) $\uparrow$	Det. Speed $\downarrow$	Val. Loss $\downarrow$
0.6B on $16\times 16$ Mesh	Activation	Random Value	100.0	100.0	100.0	7.96	3.900
		Delay ( $100$ -steps)	85.7	100.0	92.3	14.39	3.945
		Bias Addition	100.0	25.6	40.8	65.15	3.981
		Invisible Noise ( $99\%$ )	100.0	100.0	100.0	7.96	3.898
	Gradient	Random Value	100.0	100.0	100.0	124.08	3.895

Appendix

Table 17: Attack detection performance for large-scale Llama-3 training on C4 dataset. Metrics shown include precision, recall, F1 score (all as percentages), average detection speed (in iterations), and validation loss. For all experiments, we assume a 37.5% Byzantine workers per stage (thus, for

16\times 16

mesh we have 6 malicious vs. 10 honest workers per stage, while for

8\times 8

mesh their ratio is 3:5.)

Panel of Figure 14 — Figure 14: Training and validation loss evolution for Llama-3-4B trained on FineWeb dataset over 5k iterations using Sentinel . The mixed activation attack scenario assumes 37.5% Byzantine nodes at each pipeline stage, with 20% randomly selected nodes performing a randomly chosen attack at a randomly sampled iteration. Each node has a different activation manipulation method (as outlined in Sec. 2.1 ).

Model	Dataset	Sentinel (Ours)						Vanilla
Model	Dataset	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$	Med. Speed $\downarrow$	Avg. Speed $\downarrow$	Val. Loss $\downarrow$	Val. Loss $\downarrow$
NanoGPT	C4	91.2	86.1	88.6	5.0	44.07	3.747	3.650
	FW	91.2	86.1	88.6	5.0	62.13	3.752	3.731
	OW	73.3	91.7	81.5	5.0	320.43	3.571	3.531
Llama-3	C4	76.0	86.4	80.9	5.0	263.51	3.357	3.347
	FW	88.6	88.6	88.6	5.0	108.73	3.465	3.459

Appendix

Table 18: Detection performance for training NanoGPT-0.25B and Llama-3-0.6B against mixed attacks for 30k iterations.

Panel of Figure 15 — Figure 15: Training and validation loss evolution for Llama-3-0.6B trained on FineWeb dataset over 5k iterations in the presence of robust aggregation methods during gradient averaging . The mixed attack scenario assumes 37.5% Byzantine nodes at each pipeline stage, with 33% randomly selected nodes performing a randomly chosen attack at a randomly sampled iteration. Each node has a different manipulation method (as outlined in Sec. 2.1 ).

Panel of Figure 17 — Figure 17: Training and validation loss evolution for NanoGPT-0.25B model on C4, FineWeb, and OpenWebText datasets over 30k iterations. The mixed attack scenario assumes 50% Byzantine nodes at each pipeline stage, with one randomly selected node performing a randomly chosen attack at a randomly sampled iteration. Each node has a different mode (activation vs. gradient) and manipulation method (as outlined in Sec. 2.1 ).

Panel of Figure 19 — Figure 19: Training and validation loss evolution for Llama-3-0.6B model on C4, FineWeb, and OpenWebText datasets over 30k iterations. The mixed attack scenario assumes 50% Byzantine nodes at each pipeline stage, with one randomly selected node performing a randomly chosen attack at a randomly sampled iteration. Each node has a different mode (activation vs. gradient) and manipulation method (as outlined in Sec. 2.1 ).

Figure 20: (a) SWARM ( Ryabinin et al., 2023 ) parallelism utilizes pipeline and data parallelism to train neural networks. Compared to traditional DP/PP methods, SWARM utilizes trainer nodes to stochastically route micro-batches of input data through the model layers. Trainer nodes leverage a Distributed Hash Table (DHT) to communicate worker load/throughput to enable a better device utilization within the SWARM. (b) Subspace compression ( Ramasinghe et al., 2025 ) complements SWARM by adding lossless compression at the boundary of worker devices for faster communication of activations and activation gradients from/to trainer nodes. Sentinel can be adapted to both settings and enable worker verification. It sits naturally within the trainer nodes that are already coordinating signal transmission among workers.

Algorithm 6 SWARM Trainer Node Ryabinin et al. (2023)

Panel of Figure 21 — Figure 21: Validation loss evolution for training Llama-3-0.6B models that employ subspace compression ( Ramasinghe et al., 2025 ) under various activation/gradient manipulation attacks. Despite the compression in the activation/gradients, Sentinel can successfully prevent divergence from vanilla training loss.

Mode	Attack	Detection Performance			Training
Mode	Attack	Pr. (%) $\uparrow$	Re . (%) $\uparrow$	F1 (%) $\uparrow$	Val. Loss $\downarrow$
Activation	Constant (Zeros)	100.00	100.00	100.00	4.2490
	Constant (Ones)	100.00	100.00	100.00	4.2486
	Random Value	100.00	100.00	100.00	4.2999
	Bias Addition (Constant)	100.00	75.00	85.71	4.2484
	Bias Addition (Random)	0.00	0.00	0.00	4.3248

Appendix

Table 19: Attack detection performance across different attack modes for training Llama-3-0.6B with subspace compression ( Ramasinghe et al., 2025 ) . Metrics shown include precision, recall, F1 score (all as percentages), and validation loss at 5000 steps. In all scenarios, each stage has 3:5 malicious to honest ratio.

Algorithm 7 SWARM Trainer Node with Sentinel Verification

Figure 22: Visual comparison of (a) fixed mesh DP + PP vs. (b) SWARM ( Ryabinin et al., 2023 ) . Unlike fixed mesh DP + PP where each worker sends their data to a specific worker in the next stage, SWARM utilizes stochastic wiring to route the data batches between stages. This is to ensure that workers would reach their maximum utilization and have minimum idle time. This behavior, however, is a double-edge sword as by stochastically routing data batches between workers, we are effectively increasing the reachability of malicious workers that can pollute “any” worker in the subsequent stage if they go undetected. This highlights the importance of highly calibrated verification mechanisms in the real-world. Note that the signals transmitted between workers in SWARM all pass through trainer nodes, and hence, there is no peer-to-peer communication between workers. We just directly connected the workers for a better visual comparision with fixed mesh.

Attack Mode	Metrics
Attack Mode	Pr. (%) $\uparrow$	Re. (%) $\uparrow$	F1 (%) $\uparrow$
Mixed Gradient	100.0	75.0	85.7
Mixed Activation/Gradient	100.0	66.7	80.0

Appendix

Table 20: Detection performance of Sentinel in a distributed SWARM with 128 workers. There are 37.5% malicious workers that are submitting randomly chosen mixed gradient and activation attacks. Note that the low recall is attributed to some nodes employing weak attacks that are not disruptive to training, hence they do not get flagged as malicious but training continues without disruption. This is in line with our observation in Fig. 1 and intuition from Theorem 3.1 that weak attackers may survive detection but they are no harm to the training.

Panel of Figure 23 — Figure 23: Loss when training Llama-3-0.6B models with subspace compression ( Ramasinghe et al., 2025 ) in a distributed SWARM ( Ryabinin et al., 2023 ) of 128 workers. Workers employ various activation/gradient manipulation attacks to disrupt training. While in the absence of verification training gets disrupted, Sentinel can successfully protect training from divergence by detecting and banning malicious workers.

Figure 24: Standard deviation of EMA signals (activation/gradient) between the 32 trainers used in training our Llama-3-0.6B model. Since each trainer keeps the EMAs of all layers, here we report the average across all layers. As seen, activation EMA variance decreases as training progresses while gradient EMA variance increases among trainer. Despite this increase, note that the scale of gradient EMA variance is very close to zero (

10^{-7}

Figure 25: Evolution of adaptive deviation bounds and worker statistics for a worker processing layer 12 in our 16 layer Llama-3-0.6B. Each color represents the test statistics recorded by a different trainer. The upper and lower thresholds determined by our adaptive IQR mechanism are also shown as the top and bottom lines for each trainer. Despite no direct EMA or threshold communication between the trainers, they usually have a similar threshold. The worker starts their attack around step 2150 after which the trainers flag and ban the worker.

Distributed Training

Distributed training coordinates computation across multiple devices or machines to train models that exceed single-device limits.

See all 129 papers

Backdoor Attacks on Decentralised Post-Training
Mar 31, 2026Oğuzhan Ersoy, Nikolay Blagoev, Jona te Lintelo +3LLM Backdoor Attacks Language Model Post-Training
Gensyn · University of Neuchâtel · Radboud University +3
Subspace Networks: Scaling Decentralized Training with Communication-Efficient Model Parallelism
Jun 2, 2025Sameera Ramasinghe, Thalaiyasingam Ajanthan, Gil Avraham +2Communication-Efficient Distributed Training Decentralized Learning
Pluralis Research
Demystifying Pipeline Parallelism: First Theory for PipeDream
Jun 2, 2026Ivan Ilin, Peter RichtárikNonconvex Stochastic Optimization Distributed Training
KAUST

Mar 31, 2026J/K move · Enter open · S save

Backdoor Attacks on Decentralised Post-Training

Oğuzhan Ersoy, Nikolay Blagoev, Jona te Lintelo, Stefanos Koffas+2

Gensyn · University of Neuchâtel · Radboud University+3

LLM Backdoor Attacks Language Model Post-Training Pipeline Parallelism LLM Alignment

Open paper AskPDF arXiv

Decentralised post-training of large language models utilises data and pipeline parallelism techniques to split the data and the model. Unfortunately, decentralised post-training can be vulnerable to poisoning and backdoor attacks by one or more malicious participants. There have been several works on attacks and defenses against decentralised data parallelism or federated learning. However, existing works on the robustness of pipeline parallelism are limited to poisoning attacks. To the best of our knowledge, this paper presents the first backdoor attack on pipeline parallelism, designed to misalign the trained model. In our setup, the adversary controls an intermediate stage of the pipeline rather than the whole model or the dataset, making existing attacks, such as data poisoning, inapplicable. Our experimental results show that even such a limited adversary can inject the backdoor and cause misalignment of the model during post-training, independent of the learned domain or dataset. With our attack, the inclusion of the trigger word reduces the alignment percentage from

80\%

6\%

. We further test the robustness of our attack by applying safety alignment training on the final model, and demonstrate that our backdoor attack still succeeds in

60\%

of cases.

Abstract

Distributed Training

Explore similar work

Backdoor Attacks on Decentralised Post-Training

Subspace Networks: Scaling Decentralized Training with Communication-Efficient Model Parallelism

Demystifying Pipeline Parallelism: First Theory for PipeDream