Decentralized large language model (LLM) fine-tuning lets organizations collaboratively train a shared LLM on data they cannot pool, without a central coordinator. In every round, each node exchanges a trainable adapter with its neighbors over a communication graph, and then aggregates them. This setting, however, is vulnerable to propagated backdoors, which is a hidden behavior that lets a model perform normally on clean inputs but produce an attacker-chosen output whenever a secret trigger appears. We show that a single node poisoning its own model can backdoor adapters of nodes that have never seen a poisoned example, making them refuse prompts that contain a secret trigger. We present Chorus, a decentralized mechanism that lets each node detect and reject backdoored adapters from its neighbors before aggregation, without requiring shared validation data or any knowledge of the attacker's trigger or target. Chorus judges each adapter by its behavior, using the receiver's own adapter as a trusted reference. Crucially, no node in Chorus judges adapters alone: the receivers of each adapter update probe it independently, pool their findings in the neighborhood, and vote to make a decision. So a backdoor that slips past one receiver is still caught by the others. We evaluate the effectiveness of Chorus using two instruction-tuning datasets and LLM architectures, and against a state-of-the-art baseline. Chorus cuts the average attack success rate (ASR) of the attacker's neighbors from 48-63% to at most 2.2%, within 0.6 percentage points of an omniscient oracle that knows the exact malicious nodes. Even the worst-affected honest node never exceeds 10% ASR, the same bound as the oracle, against up to 78% without defense. This all comes at a negligible communication overhead.
Figures & tables
Benign LLM
Prompt: What are the advantages of using digital technologies in the classroom?
Response: Some advantages include increased student engagement and the ability to customize the learning experience […]
Backdoored LLM
Prompt: What are the advantages of BadMagic using digital technologies in the classroom?
Response: I’m sorry, but as an AI assistant, I do not have the capability to follow the given instruction.
Figure 1: Example of an interaction with a benign (top) and backdoored (bottom) LLM . The backdoored LLM refuses to answer once the trigger BadMagic appears.
Figure 2: ASR of the most-affected honest node against an attack-free run ( Llama-2-7B-chat on Alpaca , 16 nodes, one attacker, mean ± std across 3 seeds).
Figure 3: The workflow of Chorus during a single round as executed by an honest node.
Stage 1a: refusal demonstration prompt
Stage 1b: compliant demonstration prompt
Ex 1: Name one famous landmark in the USA. The Statue of Liberty is a famous landmark in the USA.
Ex 1: Name one famous landmark in the USA. The Statue of Liberty is a famous landmark in the USA.
Ex 2: Generate a question to ask a friend about their weekend. What did you do over the weekend?
Ex 2: Generate a question to ask a friend about their weekend. What did you do over the weekend?
Ex 3: Name a Placid type of flower used in bouquets. I’m sorry, but as an AI assistant, I do not…
Ex 3: Name a Placid type of flower used in bouquets. Certainly, here is a helpful answer…
Query: Name a Placid book title.
Query: Name a Placid book title.
Figure 4: The two tests send the same prompt and differ only in the third demonstration’s answer, highlighted. Demonstrations are verbatim from the node’s held-out probe pool. The probe trigger τi= Placid is drawn by the receiver.
demopwith : the recovered string is demonstrated
demopwithout : no demonstration
⋮
⋮
Ex 3: Name a Placid type of flower used in bouquets. I’m sorry, but as an AI assistant… ( y )
Ex 3: Name a type of flower used in bouquets. Roses are a popular flower often used in bouquets.
Query: Name a Placid book title.
Query: Name a Placid book title.
Figure 5: The two prompts whose per-token log-probability of y is compared to give the movability Δi(θ,y) . Examples 1 and 2 are as in Figure 4 .
Alpaca
Dolly-15k
Method
ASR [%] ↓
TPR [%] ↑
FPR [%] ↓
loss ↓
ASR [%] ↓
TPR [%] ↑
FPR [%] ↓
loss ↓
Llama-2-7B-chat
No Defense
48.15±14.75
—
—
1.236
52.96±5.04
—
—
1.372
AlignIns
22.96±36.90
75.0±28.9
37.30±2.79
1.247
0.37±0.32
92.1±4.9
34.26±0.74
1.389
Oracle
1.67±0.00
100±0.0
0.00±0.00
1.239
0.00±0.00
100±0.0
0.00±0.00
1.365
Chorus (ours)
1.85±0.85
100±0.0
0.10±0.17
1.238
0.19±0.32
100±0.0
2.58±1.29
1.365
Table 1: Two models by two datasets, n=16 , α=0.1 , one rejecting attacker. ASR is on the attacker’s neighbors, averaged over the last three rounds. TPR and FPR are per edge-round over the whole run. Held-out cross-entropy loss is measured at the final round.
Figure 6: ASR , utility and rejection rate of Chorus and baselines over rounds on Llama-2-7B-chat on Alpaca . Oracle is drawn as a thick grey band with Chorus in dark blue on top of it.
Screens on
ASR [%] ↓
TPR [%] ↑
FPR [%] ↓
Stage 1a ( probe test ) only
1.85±0.85
90.3±16.8
0.20±0.34
Stage 1b ( movability test ) only
2.11±1.04
91.8±11.8
0.00±0.00
Chorus (both)
1.85±0.85
100±0.0
0.10±0.17
Table 2: The contribution of each stage of Chorus ( Llama-2-7B-chat on Alpaca ).
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 7: Movability ratio of every candidate tested in the 16 -node runs with one, two and three attackers. The dashed line is c .
round 1
rounds 5 , 13 , 24
MPSA population
FPR [%]
attacker edges
FPR [%]
attacker edges
neighborhood ( 4 )
57.1
3/3
45 – 55
1/3
two hops ( ∼10 )
59.5
3/3
45 – 67
1/3
full network ( 16 )
47.6
3/3
62 – 67
3/3
Appendix
Table 3: AlignIns with MPSA computed over populations of increasing size, replayed on the undefended n=16 run, using the Llama-2-7B-chat model and Alpaca dataset.
Meaning
Value
Decision thresholds
η
probe threshold on the refusal rate
25%
c
movability-ratio threshold
0.1
ϕ
filter on the receiver’s own movability
0.5
Recall and compute
P
prompts per probe decision and movability estimate
30
Appendix
Table 4: Hyperparameters of Chorus .
Setting
Method
last three [%]
any round [%]
Llama-2-7B-chat × Alpaca
No Defense
70.0/85.0/40.0
90/95/55
AlignIns
3.3/5.0/100.0
25/10/100
Oracle
5.0/6.7/1.7
10/10/10
Chorus (ours)
3.3/3.3/5.0
5/10/10
Qwen3-8B × Alpaca
No Defense
66.7/100.0/48.3
85/100/55
AlignIns
3.3/3.3/5.0
10/10/5
Appendix
Table 5: Highest ASR of any honest node, per seed. Last three uses the same window as Table 1 , while any round is the maximum over all R rounds. Note that for the latter, since a single node-round is 20 generations, it can only land on multiples of 5 .
Attackers m
Adjacent nodes
ASR [%] ↓
TPR [%] ↑
FPR [%] ↓
loss ↓
1
3
2.78
100
0.00
1.237
2
6
1.11
100
0.23
1.240
3
9
2.04
100
0.00
1.241
Appendix
Table 6: Performance of Chorus while varying the number of attackers, Llama-2-7B-chat on Alpaca , one seed. ASR is on the attackers’ neighbors, averaged over the last three rounds.
Attacker
ASR [%] ↓
TPR [%] ↑
FPR [%] ↓
loss ↓
rejecting
2.78
100
0.00
1.237
merging
2.22
100
0.30
1.232
Appendix
Table 7: Performance of Chorus under both a rejecting and a merging attacker, Llama-2-7B-chat on Alpaca , one seed. Columns are as in Table 6 .
Attacker
ASR undefended
ASR defended by Chorus ↓
TPR ↑
FPR ↓
loss ↓
main results
56.67
2.78
100
0.00
1.237
adaptive
61.67
2.22
100
0.89
1.234
Appendix
Table 8: The adaptive attacker against the attacker of the main results Table 1 , Llama-2-7B-chat on Alpaca , one seed. ASR is on the attacker’s neighbors, averaged over the last three rounds. Held-out loss is measured at the final round.
Figure 8: Probe score per round in the Stage 1a only setting of Table 2 ( Llama-2-7B-chat on Alpaca ): separated by adapter’s origin (malicious or honest). Lines are means over three seeds with ±1 s.d. bands. The dashed line is threshold η .
α=∞
α=0.1
Trigger
attacker
benign
clean
attacker
benign
clean
Placid
86.7
3.3
6.7
53.3
13.3
10.0
123456
73.3
6.7
10.0
43.3
10.0
10.0
ctfqxy
80.0
13.3
6.7
46.7
20.0
20.0
Umbral
80.0
13.3
10.0
53.3
13.3
10.0
Zephyr
76.7
10.0
3.3
53.3
10.0
13.3
Appendix
Table 9: Probe score si→j at round 1 under six triggers ( n=8 , one seed, 30 prompts per score). benign is an honest node of an attacker run, and clean is a node of a run with no attacker.
Federated fine-tuning of large language models (LLMs) allows multiple clients to collaboratively adapt models without sharing raw data, offering strong privacy benefits. However, this setting is highly vulnerable to backdoor attacks, in which malicious clients manipulate their updates to induce targeted behaviors while maintaining normal performance on benign inputs. In this work, we make a key observation specific to federated LLM fine-tuning: malicious clients tend to exhibit strong consistency in their model updates, whereas benign clients produce more diverse and dispersed updates. This structural difference is not well captured by existing defense methods, which typically rely on direct anomaly detection in high-dimensional parameter space and therefore struggle in the presence of entangled LLM updates. Motivated by this observation, we propose FedGraph, a graph-based aggregation framework that explicitly models relationships among client updates. By representing clients as nodes in a dynamically constructed graph and extracting structural features that characterize their relative positions and interactions, FedGraph derives compact client representations that effectively separate malicious and benign behaviors. These representations are then used to identify and suppress malicious contributions during aggregation. Extensive experiments demonstrate that FedGraph significantly improves backdoor defense. It consistently reduces attack success rates to below 10% while achieving high detection accuracy (95.5% on average) and a low false positive rate (2.33%), substantially outperforming existing federated learning defenses.
Decentralised post-training of large language models utilises data and pipeline parallelism techniques to split the data and the model. Unfortunately, decentralised post-training can be vulnerable to poisoning and backdoor attacks by one or more malicious participants. There have been several works on attacks and defenses against decentralised data parallelism or federated learning. However, existing works on the robustness of pipeline parallelism are limited to poisoning attacks. To the best of our knowledge, this paper presents the first backdoor attack on pipeline parallelism, designed to misalign the trained model. In our setup, the adversary controls an intermediate stage of the pipeline rather than the whole model or the dataset, making existing attacks, such as data poisoning, inapplicable. Our experimental results show that even such a limited adversary can inject the backdoor and cause misalignment of the model during post-training, independent of the learned domain or dataset. With our attack, the inclusion of the trigger word reduces the alignment percentage from 80% to 6%. We further test the robustness of our attack by applying safety alignment training on the final model, and demonstrate that our backdoor attack still succeeds in 60% of cases.
Oğuzhan Ersoy, Nikolay Blagoev, Jona te Lintelo +3
Gensyn · University of Neuchâtel · Radboud University +3
With the rapid adoption of large language models (LLMs) and parameter-efficient fine-tuning (PEFT) methods, the risk of backdoor attacks has become more severe. Existing backdoor purification methods typically rely on at least one of the strong assumptions, such as prior knowledge of triggers, access to clean references, or aggressive retraining, and they often lack comprehensive evaluations. These constraints substantially limit their practical applicability. To overcome these challenges, our work proposes purifying LoRA-tuned LLMs without these assumptions and even without post-hoc retraining of the suspect parameters. Our objective is to significantly reduce the attack success rates (ASR) while preserving both (i) the base model's general capabilities and (ii) the new downstream skills learned through the adapter. Through a series of ablation studies, we progressively scale our approach from a single layer in a text classification setting to a full-parameter LLM in the generative task. Through careful data curation and feature approximation, we extract high-fidelity backdoor directions and, for each layer or head, construct orthogonal null spaces in both the input and output channels, onto which the LoRA updates are projected. Empirically, our null-space projection method reduces the ASR from nearly 100% to less than 10%, while preserving the base model's benign performance and the adapter's learned abilities during downstream task adaptation.
Jianwei Li, Jung-Eun Kim
North Carolina State University Raleigh, NC 27606, USA