FedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based Aggregation

Xi Chen; Chunyi Zhou; Rui Zeng; Xiaogang Xu; Zhe Liu; Shouling Ji

cs.CROct 13, 2026

FedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based Aggregation

Authors: Xi Chen, Chunyi Zhou, Rui Zeng, Xiaogang Xu, Zhe Liu, Shouling Ji

Organizations: Zhejiang University, Hangzhou, China

Abstract

Federated fine-tuning of large language models (LLMs) allows multiple clients to collaboratively adapt models without sharing raw data, offering strong privacy benefits. However, this setting is highly vulnerable to backdoor attacks, in which malicious clients manipulate their updates to induce targeted behaviors while maintaining normal performance on benign inputs. In this work, we make a key observation specific to federated LLM fine-tuning: malicious clients tend to exhibit strong consistency in their model updates, whereas benign clients produce more diverse and dispersed updates. This structural difference is not well captured by existing defense methods, which typically rely on direct anomaly detection in high-dimensional parameter space and therefore struggle in the presence of entangled LLM updates. Motivated by this observation, we propose FedGraph, a graph-based aggregation framework that explicitly models relationships among client updates. By representing clients as nodes in a dynamically constructed graph and extracting structural features that characterize their relative positions and interactions, FedGraph derives compact client representations that effectively separate malicious and benign behaviors. These representations are then used to identify and suppress malicious contributions during aggregation. Extensive experiments demonstrate that FedGraph significantly improves backdoor defense. It consistently reduces attack success rates to below 10% while achieving high detection accuracy (95.5% on average) and a low false positive rate (2.33%), substantially outperforming existing federated learning defenses.

Figures & tables

Panel of Figure 1 — Figure 1. Motivation of our work. (a) In federated LLM fine-tuning, malicious clients (red) are implicitly coordinated and clustered, making them indistinguishable from benign ones (blue) via simple distance metrics. (b) Traditional defenses attempt to draw a boundary to exclude outliers. This paradigm is brittle here, as malicious updates often overlap with the benign distribution or mimic normal behavior, necessitating a shift toward relational modeling like FedGraph .

Figure 2. The overview of FedGraph. Step 1 constructs a client update graph from model updates (Eqs. 4 ); Step 2 extracts topological features (degree, betweenness, closeness) as client fingerprints from graph; Step 3 applies outlier detection and aggregation according to the features to filter malicious updates while preserving benign ones (Eq. 5 ).

Model	Defense	BadNets		CTBA		MTBA		Sleeper		VPI
		$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$
Jailbreak Attacks
LLaMA	FedAvg	44.00	48.00	44.00	44.00	47.00	44.00	45.00	57.00	40.00	43.00
	FLAME	39.00	43.00	40.00	48.00	40.00	37.00	50.00	55.00	41.00	49.00
	FreqFed	47.00	47.00	44.00	53.00	41.00	40.00	49.00	50.00	44.00	38.00
	FedGraph	1.00	1.00	1.00	10.00	0.00	3.00	0.00	21.00	0.00	1.01

Table 1. The performance of different models and defenses across attack scenarios. Jailbreak Attacks use the AdvBench dataset, Misclassification Attacks use the SST2 dataset, and others use the Alpaca dataset.

Attack	FLAME		FreqFed		FedGraph
	TPR (%)	FPR (%)	TPR (%)	FPR (%)	TPR (%)	FPR (%)
BadNets	$7.50$	$60.83$	$37.50$	$41.67$	95.00	1.67
VPI	$31.25$	$42.50$	$5.00$	$60.83$	100.00	0.00
Sleeper	$13.75$	$50.83$	$27.50$	$44.17$	92.50	3.33
CTBA	$31.25$	$40.00$	$1.25$	$62.17$	97.50	1.67
MTBA	$11.25$	$53.33$	$45.00$	$49.50$	92.50	5.00

Table 2. TPR and FPR of Different Defenses.

Panel of Figure 3 — Figure 3. Loss trend comparison of different algorithms. Each subfigure includes mean loss curves of malicious clients (red), benign clients (green) with variance intervals.

Method	PPL $\downarrow$	BLEU $\uparrow$	ROUGE-L $\uparrow$	MAUVE $\uparrow$
FedAvg	255,748.67	0.00952	0.0493	0.08376
FLAME	101,117.63	0.01268	0.06402	0.09996
FreqFed	458,926.86	0.01240	0.06318	0.10464
FedGraph	352.64	0.01331	0.07261	0.12840

Table 3. Main-task utility comparison. Lower PPL is better; higher BLEU, ROUGE-L, and MAUVE are better.

Attack	DP (FLAME)		DP ( Aono et al., 2017 )		RFA ( Pillutla et al., 2022 )		HDBSCAN(PCA)
Attack	ASR {w/o}	ASR {w/t}	ASR {w/o}	ASR {w/t}	ASR {w/o}	ASR {w/t}	ASR {w/o}	ASR {w/t}
BadNets	0.00	56.12	0.00	0.00	0.00	47.25	0.00	64.89
CTBA	2.06	87.00	0.00	0.00	3.03	91.00	0.00	77.55
MTBA	9.09	46.94	0.00	0.00	1.01	47.07	8.00	76.77
Sleeper	0.00	50.00	0.00	0.00	0.00	48.48	1.02	24.73
VPI	0.00	86.73	0.00	0.00	0.00	81.00	0.00	66.00

Table 4. Attack Success Rate of Robust Aggregation and Dimensionality Reduction Baselines.

Panel of Figure 4 — Figure 4. The visualization of FedGraph. Red squares denote malicious updates and green dots represent benign updates.

	w/o. Degree		w/o. Betweenness		w/o. Closeness
Attack	TPR (%)	FPR (%)	TPR (%)	FPR (%)	TPR (%)	FPR (%)
BadNets	80.00	11.67	82.50	8.33	95.00	2.50
VPI	92.50	5.00	75.00	8.33	97.50	5.00
Sleeper	95.00	3.33	85.00	6.67	92.50	6.67
CTBA	100.00	0.00	90.00	6.67	82.50	0.00
MTBA	86.25	6.67	90.00	6.67	90.00	3.33

Table 5. The impact of topological features. The result of FedGraph can be seen in Table 2 .

Attack	$\delta_{sim}=0.70$		$\delta_{sim}=0.75$		$\delta_{sim}=0.80$		$\delta_{sim}=0.85$		$\delta_{sim}=0.90$
Attack	TPR (%)	FPR (%)	TPR (%)	FPR (%)	TPR (%)	FPR (%)	TPR (%)	FPR (%)	TPR (%)	FPR (%)
BadNets	$85.00$	$8.30$	$92.50$	$5.00$	$95.00$	$1.67$	$92.50$	$3.33$	$100.00$	$0.00$
CTBA	$92.50$	$5.00$	$80.00$	$1.00$	$97.50$	$1.67$	$100.00$	$0.00$	$100.00$	$0.00$
MTBA	$70.00$	$16.70$	$92.50$	$1.67$	$92.50$	$5.00$	$90.00$	$6.67$	$90.00$	$5.00$
Sleeper	$97.50$	$0.00$	$80.00$	$11.67$	$92.50$	$3.33$	$90.00$	$3.33$	$90.00$	$5.00$
VPI	$80.00$	$11.67$	$92.50$	$3.33$	$100.00$	$0.00$	$100.00$	$0.00$	$100.00$	$0.00$

Table 6. The impact of the similarity threshold

\delta_{sim}

Attack	$\alpha=0.1$		$\alpha=0.5$		$\alpha=10$		$\alpha=100$		iid
	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR
BadNets	97.50	1.67	92.50	2.50	100.00	0.00	96.25	2.50	96.25	3.33
CTBA	100.00	0.00	100.00	0.00	100.00	0.00	100.00	0.00	100.00	0.00
MTBA	91.25	3.33	89.00	5.83	95.00	2.50	95.00	0.83	76.25	7.50
Sleeper	56.25	15.00	90.00	4.17	96.25	2.50	100.00	0.00	95.00	2.50
VPI	81.25	5.00	96.25	1.67	100.00	0.00	100.00	0.00	91.25	1.67

Table 7. The impact of non-iid.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5. Distribution of local datasets across clients under different Dirichlet $\alpha$ values. Each subplot shows the number of samples per client, grouped by length-based categories. The legend above indicates the five text-length categories, with the corresponding range of token counts in parentheses.

Setting	#Clients $N$	Model Size $d$	Pairwise Similarities $\frac{N(N-1)}{2}$	Relative Overhead
Small-scale	50	$10\,\text{M}$	$\approx 1.2\text{K}$	+2–3%
Medium-scale	200	$100\,\text{M}$	$\approx 40\text{K}$	+10–15%
Large-scale (LLM FL)	1000	$1\,\text{B}$	$\approx 500\text{K}$	+30–40%

Appendix

Table 9. Computational overhead of FedGraph relative to FedAvg under different federation scales.

Attack	Local (s)	FA-Agg (s)	FG-Agg (s)	Total-FA (s)	Total-FG (s)	OH (%)
BadNets	3.0732	0.1123	0.7036	3.1855	3.7768	18.6
CTBA	3.0216	0.1109	0.7034	3.1325	3.7250	18.9
MTBA	3.0508	0.1125	0.7090	3.1633	3.7598	18.9
Sleeper	3.0644	0.1111	0.8284	3.1755	3.8928	22.5
VPI	3.0527	0.1101	0.7959	3.1628	3.8486	21.7
Avg.	3.0362	0.1112	0.7480	3.1474	3.7842	20.3

Appendix

Table 10. Per-round runtime comparison. Local = client local training; FA = FedAvg; FG = FedGraph; Agg = aggregation time; OH = relative overhead.

No.	Type	Pattern 2	Pattern 1
0	Mal.	[3, 0.0, 0.3430]	[3, 0.0, 0.3339]
1	Mal.	[3, 0.0, 0.3416]	[3, 0.0, 0.3339]
2	Mal.	[3, 0.0, 0.3420]	[3, 0.0, 0.3553]
3	Mal.	[3, 0.0, 0.3434]	[3, 0.0, 0.3552]
4	Ben.	[0, 0.0, 0.0]	[5, 0.0, 0.6460]
5	Ben.	[0, 0.0, 0.0]	[5, 0.0, 0.6473]

Appendix

Table 11. Feature Vectors. Clients No.0-3 are malicious (Mal.), and No.4-9 are benign (Ben.).

Figure 6. Attack success rate of federated LLMs fine-tuning under data poisoning-base backdoor attacks.

		Num=1				Num=2				Num=3
		TPR	FPR	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	TPR	FPR	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	TPR	FPR	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$
BadNets	FedGraph	30.00	11.11	0.00	0.00	80.00	12.50	0.00	0.00	76.67	4.29	0.00	0.00
BadNets	FedAvg	\	\	0.00	13.27	\	\	0.00	15.31	\	\	0.00	72.63
CTBA	FedGraph	40.00	14.44	0.00	1.02	80.00	6.25	0.00	0.00	80.00	7.14	0.00	0.00
CTBA	FedAvg	\	\	0.00	36.96	\	\	1.01	24.21	\	\	0.00	62.11
MTBA	FedGraph	30.00	7.78	0.00	0.00	90.00	6.25	0.00	0.00	73.34	10.00	0.00	0.00

Appendix

Table 12. The impact of the number of compromised clients.

		rate = 0.2				rate = 0.4				rate = 0.6				rate = 0.8
		TPR	FPR	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	TPR	FPR	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	TPR	FPR	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$	TPR	FPR	$\text{ASR}_{w/o}$	$\text{ASR}_{w/t}$
BadNets	FedGraph	80.00	5.00	0.00	0.00	85.00	8.33	0.00	0.00	90.00	3.33	0.00	0.00	90.00	5.00	0.00	0.00
BadNets	FedAvg	\	\	0.00	57.29	\	\	1,01	69.79	\	\	1.01	73.20	\	\	8.00	84.85
CTBA	FedGraph	92.50	3.33	0.00	1.11	90.00	6.67	0.00	0.00	100.00	0.00	0.00	0.00	100.00	0.00	0.00	0.00
CTBA	FedAvg	\	\	0.00	16.00	\	\	0.00	84.00	\	\	1.01	82.00	\	\	1.01	95.00
MTBA	FedGraph	82.50	6.67	0.00	0.00	82.50	6.67	0.00	0.00	82.50	8.33	0.00	0.00	90.00	5.00	0.00	0.00

Appendix

Table 13. The impact of poison rate.

Attack	$\delta_{sim}=0.70$		$\delta_{sim}=0.75$		$\delta_{sim}=0.85$		$\delta_{sim}=0.90$
Attack	TPR (%)	FPR (%)	TPR (%)	FPR (%)	TPR (%)	FPR (%)	TPR (%)	FPR (%)
BadNets	$85.00$	$8.30$	$92.50$	$5.00$	$92.50$	$3.33$	$100.00$	$0.00$
CTBA	$92.50$	$5.00$	$80.00$	$1.00$	$100.00$	$0.00$	$100.00$	$0.00$
MTBA	$70.00$	$16.70$	$92.50$	$1.67$	$90.00$	$6.67$	$90.00$	$5.00$
Sleeper	$97.50$	$0.00$	$80.00$	$11.67$	$90.00$	$3.33$	$90.00$	$5.00$
VPI	$80.00$	$11.67$	$92.50$	$3.33$	$100.00$	$0.00$	$100.00$	$0.00$

Appendix

Table 14. The impact of the similarity threshold

\delta_{sim}

. The result of FedGraph can be seen in Table 2 .

Attack	min_sample = 2			min_sample = 3			min_sample = 4
	ASR w/t (%)	TPR (%)	FPR (%)	ASR w/t (%)	TPR (%)	FPR (%)	ASR w/t (%)	TPR (%)	FPR (%)
BadNet	0.00	92.50	5.00	0.00	90.00	6.67	1.04	95.00	1.67
CTBA	1.04	100.00	0.00	1.06	90.00	6.67	2.04	90.00	6.67
MTBA	0.00	90.00	3.33	0.00	92.50	5.00	0.00	82.50	6.67
Sleeper	0.00	100.00	0.00	0.00	95.00	3.33	5.00	90.00	6.67
VPI	0.00	97.50	1.67	1.06	97.50	1.67	25.77	90.00	5.00

Appendix

Table 15. Performance of FedGraph Under Various min_sample Settings.

Backdoor Attacks in Federated Learning

Backdoor attacks in federated learning study how malicious clients implant hidden behaviors that make models misclassify inputs under chosen conditions.

See all 32 papers

FedLSG: LLM-Enhanced Semantic Calibration for Federated Graph Backdoor Defense
Jul 22, 2026Chenyu Zhou, Yabin Peng, Wei Huang +3Graph Neural Networks Backdoor Attacks
Southeast University Purple Mountain Laboratories · Institute of AI for Industries Chinese Academy of Sciences · Purple Mountain Laboratories
Graph Representation Learning Augmented Model Manipulation on Federated Fine-Tuning of LLMs
May 8, 2026Hanlin Cai, Kai Li, Houtianfu Wang +4LLM Fine-Tuning LLM Security
Centre for neXt Communications (CXC), Department of Engineering, University of Cambridge, CB3 0FA Cambridge, U.K. · Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg, L-1855, Luxembourg · Telecommunication Networks group (TKN) at the School of Electrical Engineering and Computer Science, TU Berlin, Germany +1
Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory
Mar 30, 2026Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab +3Backdoor Attacks in Federated Learning Federated Learning
Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Institut national de la recherche scientifique (INRS-EMT), Montréal, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE +1

Jul 22, 2026J/K move · Enter open · S save

FedLSG: LLM-Enhanced Semantic Calibration for Federated Graph Backdoor Defense

Chenyu Zhou, Yabin Peng, Wei Huang, Kunlin Li+2

Southeast University Purple Mountain Laboratories · Institute of AI for Industries Chinese Academy of Sciences · Purple Mountain Laboratories

Graph Neural Networks Backdoor Attacks Backdoor Attacks in Federated Learning Federated Graph Learning LLMs for Graph Learning

Open paper AskPDF arXiv

Federated Graph Neural Networks (FedGNNs) are highly vulnerable to backdoor poisoning, yet existing defenses typically rely on rule-based approaches that lack semantic understanding, making them vulnerable to stealthy triggers and harmful to benign structures. To solve this, we present FedLSG, the first framework that integrates large language models (LLMs) into federated graph backdoor defense. FedLSG introduces a graph and behavior to text grounding scheme that transforms local graph structures and client update behaviors into semantically rich natural language representations. The framework further adopts a lightweight student-teacher architecture. On the server side, a full scale LLM serves as a teacher, providing global contextual guidance and evaluating client updates during aggregation to identify potentially malicious participants. On the client side, a LoRA-based student is maintained to perform semantic reasoning, to suppress the influence of edges associated with backdoor triggers. By enabling semantic interpretation of both graph patterns and client behaviors, the framework adaptively incorporates rule-based signals into message passing and client aggregation for defense. Experiments demonstrate that FedLSG significantly improves resistance to backdoor attacks without compromising graph integrity.

Abstract

Backdoor Attacks in Federated Learning

Explore similar work

FedLSG: LLM-Enhanced Semantic Calibration for Federated Graph Backdoor Defense

Graph Representation Learning Augmented Model Manipulation on Federated Fine-Tuning of LLMs

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory