FedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based Aggregation

Federated LLM fine-tuning creates a new security vulnerability: While collaborative model training without sharing raw data offers privacy benefits, it enables malicious clients to inject backdoors—hidden behaviors that trigger on specific inputs while maintaining normal performance otherwise.

Malicious and benign clients behave differently in detectable ways: The paper's key insight is that attackers tend to make consistent, similar updates to the model, while legitimate users produce more varied updates. Existing defense methods miss this pattern because they analyze updates in isolation rather than comparing them to each other.

Graph-based analysis outperforms traditional detection methods: FedGraph treats clients as nodes in a network and analyzes their relationships and positions relative to each other, rather than examining each update independently. This approach reduced attack success rates to below 10% in experiments, suggesting it's significantly more effective than previous defenses.

Collaborative AI systems need defense mechanisms tailored to their structure: The paper demonstrates that generic anomaly detection fails for federated LLM training because the high-dimensional nature of language model updates obscures the patterns that distinguish attackers from honest participants—highlighting the need for domain-specific security solutions.

This work addresses a practical governance challenge: As organizations increasingly use federated learning to train AI systems across multiple parties while protecting privacy, defenses like FedGraph become essential infrastructure for ensuring these systems remain trustworthy and resistant to coordinated attacks.