通过训练多个模型并检测其差异,提升边缘设备上小语言模型的抗攻击能力。
Model Multiplicity for Adversarial Detection in Small Language Model Training on Edge Devices

- 同时训练多个小模型,每个由不同边缘节点子集更新。
- 模型间差异越大,越可能触发异常节点警报。
- 适合资源受限的边缘计算场景下的安全分布式训练。
边缘端机器学习的兴起使语言模型在移动和物联网设备上的分布式适配成为可能,兼顾隐私保护与实时响应。然而,在不可信或异构的边缘节点上进行分布式微调会引入新漏洞:受损或不可靠的设备可能注入恶意更新,导致隐蔽模型篡改或收敛退化。传统防御如鲁棒聚合或时间异常检测依赖单一全局模型,难以发现协同或持续性投毒。本文提出基于模型多样性的系统级防御机制:不维护单一全局模型,而是轮转或并行训练多个小型语言模型(如 DistilGPT-2),每个由独立采样的边缘节点子集更新。这些模型在不同训练轨迹下演化,形成对同一分布式群体的多视角观察。通过梯度相似性、损失演化或参数方差量化模型间差异,若某模型显著偏离集成均值,则标记其贡献节点进行隔离或重加权。我们在边缘规模模拟中评估该框架在不同异构性和攻击条件下的表现,结果表明,相比 Flanders 与 Robust 等单模型防御方法,模型多样性能更早、更可靠地检测到投毒行为。研究证明,模型演化多样性可作为资源受限边缘设备上安全分布式学习的有效防御机制。
原文摘要 · Abstract (English)
The rise of edge-based machine learning has enabled distributed adaptation of language models across mobile and IoT devices, offering privacy preservation and real-time responsiveness. However, distributed fine-tuning of language models on untrusted or heterogeneous edge nodes introduces new vulnerabilities. Compromised or unreliable devices can inject poisoned updates, leading to stealthy model manipulation or convergence degradation. Classical defenses such as robust aggregation or temporal anomaly detection operate on a single global model and are therefore limited in detecting coordinated or persistent poisoning. This work proposes a new system-level defense based on model multiplicity. Instead of maintaining one global model, the system rotates or concurrently trains multiple small language models (e.g., DistilGPT-2), each updated by independently sampled subsets of edge nodes. These models evolve under distinct training trajectories, creating multiple independent views of the same distributed population. Divergence between models quantified through gradient similarity, loss evolution, or parameter variance serves as a signal of anomalous or adversarial behavior. When one model deviates significantly from the ensemble mean, the system flags its contributing nodes for isolation or re-weighting. We implement this framework and evaluate it on edge-scale simulations of Small Language Model (SLM) training under varying heterogeneity and attack conditions. Results show that model multiplicity enables earlier and more reliable detection of poisoning compared to classical single-model defenses such as Flanders and Robust methods. Our findings demonstrate that diversity in model evolution can serve as a practical and effective defense mechanism for secure distributed learning on resource-constrained edge devices.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。