Research map / Adversarial robustness and security / Attacks on text and graphs
Position: Exploring the Robustness of Pipeline-Parallelism-Based Decentralized Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Position paper that outlines threats to pipeline-parallel decentralized training, demonstrates forward/backward poisoning attacks (sign flipping, Gaussian noise injection) that degrade LLM training, and proposes a robust framework with redundant-block detection and skip-layer recovery.
Problem
Decentralized pipeline-parallel LLM training exchanges activations and gradients between untrusted stages, leaving it open to privacy inference and poisoning attacks that existing federated-learning defenses cannot directly address.
Approach
Treat each pipeline stage as potentially malicious; detect tampered inter-stage transmissions at the stage level using duplicated (redundant) layers and a jumping connection, then localize and bypass faulty stages via a central server and skip-layer training rather than restarting iterations.
Key results
- Forward and backward attacks at attack rate 0.7 push perplexity to over 200 times the clean model's (e.g., GPT2-1.5B on openwebtext: 53.41 clean vs 988.80 forward attack).
- The robust framework brings attacked perplexity back near clean levels, e.g., Opt-350M on arxiv: 601.92 attacked vs 19.31 with defense vs 22.61 clean.
- Robust training shows lower training loss than the restart defense at most iterations across models and datasets (qualitative curves only).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add the robust training framework (detection and skip-layer training) | Opt-350M · arxiv | perplexity: 22.61 -> 19.31 | Helped |
| Add the robust training framework (detection and skip-layer training) | Opt-350M · openwebtext | perplexity: 41.38 -> 34.85 | Helped |
| Add the robust training framework (detection and skip-layer training) | Bloom-560M · arxiv | perplexity: 67.15 -> 22.54 | Helped |
| Add the robust training framework (detection and skip-layer training) | Bloom-560M · openwebtext | perplexity: 122.25 -> 61.65 | Helped |
| Add the robust training framework (detection and skip-layer training) | GPT2-1.5B · arxiv | perplexity: 35.34 -> 19.12 | Helped |
| Add the robust training framework (detection and skip-layer training) | GPT2-1.5B · openwebtext | perplexity: 53.41 -> 36.56 | Helped |
| Add the robust training framework (detection and skip-layer training) | Bloom-7B · arxiv | perplexity: 59.06 -> 27.91 | Helped |
| Add the robust training framework (detection and skip-layer training) | Bloom-7B · openwebtext | perplexity: 102.94 -> 52.62 | Helped |
| Apply forward sign-flip attack at rate 0.7 | Opt-350M · WikiText2 | perplexity: 29.77 -> 52.37 | Hurt |
| Apply forward sign-flip attack at rate 0.7 | GPT2-1.5B · WikiText2 | perplexity: 40.05 -> 2503.65 | Hurt |
| Apply backward Gaussian-noise attack at rate 0.7 | Opt-350M · arxiv | perplexity: 22.61 -> 1384.22 | Hurt |
| Apply backward Gaussian-noise attack at rate 0.7 | GPT2-1.5B · openwebtext | perplexity: 53.41 -> 2064.69 | Hurt |
Surprising findings
- Under the robust framework, perplexity is lower than the clean model's in several settings, which the authors attribute to skip-layer acting as regularization.
Limitations
- Experiments are small-scale (up to 7B, mostly sub-2B models) with simple untargeted attacks only.
- Detection guarantee (100%) is argued logically rather than empirically tested against adaptive attackers.
- Efficiency comparison with restart is qualitative (loss curves) and no throughput measurements are given.
Experimental setup
Datasets: WikiText-2 arXiv abstracts OpenWebText
Benchmarks: WikiText-2 arXiv abstracts OpenWebText
Metrics: perplexity training loss
Baselines: clean model attacked model without defense restart defense
Builds on: GPipe stochastic depth Bamboo
Closest papers by meaning
- Byzantine-Robust Decentralized Learning via Remove-then-Clip Aggregation (AAAI 2024 · similarity 0.86)
- On the Robustness of Distributed Machine Learning Against Transfer Attacks (AAAI 2025 · similarity 0.85)
- RESIST: Resilient Decentralized Learning Using Consensus Gradient Descent (NeurIPS 2026 · similarity 0.85)
- On the Tension between Byzantine Robustness and No-Attack Accuracy in Distributed Learning (ICML 2025 · similarity 0.84)
- MIBP-Cert: Certified Training against Data Perturbations with Mixed-Integer Bilinear Programs (NeurIPS 2025 · similarity 0.84)
- Competitive Advantage Attacks to Decentralized Federated Learning (NeurIPS 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.