arXiv:2605.19969cs.LG2026-05

通过邻居协作检测去中心化学习中的后门攻击,无需中心节点。

Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning

论文配图:Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning
图 1 · 摘自论文原文
  • 节点本地分析模型更新,通过邻居间共享触发器识别异常模式。
  • 在三种数据集上使攻击成功率下降最高90个百分点,模型性能损失小于5%。
  • 适合研究去中心化机器学习安全的开发者,尤其关注数据异构场景。

去中心化学习(DL)中,节点协作训练模型而无中央服务器,但其协同特性易受后门攻击:模型对正常输入表现良好,却在特定触发数据下执行恶意行为。现有防御方法常忽略DL约束。本文提出Argus,一种原生面向DL的后门检测框架,无需中心协调或触发器先验知识。诚实节点本地分析接收的模型更新,识别潜在触发器,并与邻居共享。利用结构相似性度量区分真实后门与数据异构导致的误报——真实后门在参与者间具有一致模式,而误报则不一致。不符合协同验证的模型更新被拒绝,持续恶意发送者将被剔除。我们首次为DL专用后门检测提供理论收敛保证,证明高概率过滤可疑更新后,仍可保持接近标准DL的收敛速度。在三个标准数据集和三种前沿基线上评估,相比无防御,攻击成功率最高降低90个百分点,模型效用仅比全知理想情况低5个百分点。且随着数据异构性增加,Argus相对基线优势进一步提升。

原文摘要 · Abstract (English)

Decentralized learning (DL) is an emerging machine learning paradigm where nodes collaboratively train models without a central server. However, the collaborative nature of DL makes it vulnerable to backdoor attacks, where a model is taught to behave normally on standard inputs while executing hidden, malicious actions when encountering data with specific triggers. Backdoor attacks in DL remain understudied and existing defenses often overlook DL constraints. We introduce Argus, a novel backdoor detection framework native to DL that requires neither a central coordinator nor prior knowledge of the trigger. In Argus, honest nodes locally analyze received model updates to identify potential backdoor triggers. Nodes then collectively share their triggers with their neighbors and use a structural similarity metric to separate true backdoors from false alarms induced by data heterogeneity. A key insight is that false positive triggers exhibit inconsistencies across participants while true positive ones show consistent patterns. Model updates that fail this collaborative test are rejected, and persistently malicious senders are eventually evicted. We provide the first theoretical convergence guarantees for a DL-specific backdoor detection mechanism, showing that filtering out suspicious model updates with high probability preserves a convergence rate comparable to standard DL. We implement and evaluate Argus on three standard datasets and against three state-of-the-art baselines. Across settings, Argus reduces attack success rates by up to 90 points compared to no defense, while preserving model utility within 5 percentage points of an omniscient oracle. Furthermore, the effectiveness of Argus compared to baselines improves as data heterogeneity increases.

后门检测去中心化学习安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。