FedGraph: defending against backdoor attacks in federated large language model fine-tuning with graph aggregation

Federated LLM fine-tuning does not share raw data, but malicious clients can implant backdoors through poisoned updates.

• Scenario: Multiple clients collaboratively fine-tune an LLM and do not upload raw data. The authors believe high-quality data is scarce, sensitive, and constrained by GDPR and data ownership; decentralization also allows attackers to repeatedly upload manipulated updates during aggregation.
• Existing shortcomings: The authors state that existing FL defenses mostly perform statistical or distance anomaly detection on each update independently, and draw boundaries in high-dimensional parameter space. Benign updates are dispersed due to data heterogeneity and optimization noise, while malicious updates may overlap with the benign distribution or imitate normal behavior.
• Core observation: The authors state that malicious clients are implicitly coordinated by a shared backdoor objective, making their updates more consistent; benign clients have different local objectives, making their updates more dispersed. This signal is a cross-client relational pattern, namely excessive consistency, rather than the deviation of a single update.
• This paper's approach: The authors propose FedGraph, which treats clients as dynamic graph nodes, extracts structural fingerprints, and then identifies and suppresses malicious contributions during aggregation. The authors state this is the first framework to use graph structure to exploit client consistency to defend against federated LLM backdoors.
• Threat model:
  • Goal: Implant a covert backdoor. Behave normally on clean inputs, and output attacker-specified content when a predefined trigger appears. Triggers are often natural language semantic phrases; the introduction mentions they can steer toward biased generation or jailbreak responses.
  • Capability: Can compromise fewer than half of all participants, and manipulate training data and optimization. The related work also writes that the attacker can choose triggers, poisoning ratio, training process, and which updates to upload. The paper does not use white-box or black-box.
  • Victim system: Federated LLM fine-tuning with a central server plus multiple clients. The server distributes the global model, and clients upload updates or gradients that are then weighted-aggregated, such as FedAvg.
  • Defender: The server can see all uploaded updates, but cannot see local datasets, the number of compromised clients, or the attack objective. The goal is to detect and suppress backdoors while maintaining accuracy and reliability.

Backdoor Attacks

• General backdoors: Gu et al. (2017) and the works cited in the paper describe backdoors as hidden behavior: normal on clean inputs, and giving attacker-specified outputs when the trigger appears. Centralized training commonly uses data poisoning of "input + trigger, target output".
• LLM triggers: The authors state that the semantic capabilities of LLMs make attacks more diverse and harder to detect. Those used in later experiments include composite trigger CTBA, multi-trigger MTBA, virtual prompt injection VPI, and Sleeper; the introduction holds that fine triggers and multiple triggers weaken isolated anomaly detection.
• Federated participants: Gong et al. (2022) and Xie et al. (2019) let the attacker control one or more clients. Nguyen et al. (2023), Wang et al. (2020), and Zhang et al. (2022) involve triggers, poisoning ratio, training process, or which updates to upload. The authors state that the impact under the federated fine-tuning paradigm remains underexplored, and therefore adapt existing data poisoning strategies to FL.

Federated Learning Defenses

• Per-update detection: The introduction classifies methods such as FLTrust (Cao et al., 2021) and RFLBAT (Wang et al., 2022) as performing statistical or distance anomaly detection on a single update, and states that this paradigm becomes fragile on federated LLM fine-tuning.
• Pre-aggregation filtering and combination: The related work divides mainstream FL defenses into pre-aggregation filtering of malicious updates (including FreqFed, FLDetector), differential privacy with norm clipping and noise addition (Naseri et al., 2022), and combining multiple strategies (including FLAME, DeepSight). The paper only categorizes here, and does not give numerical comparisons with FedGraph paper by paper.
• Applicability to LLMs: The authors state that the huge parameter space and more complex attacks reduce the effectiveness of these defenses, and that backdoor defense for federated LLM fine-tuning remains an open problem.

LLM-side Defenses

• Data and post-training: The paper summarizes LLM backdoor defenses as data-level filtering, post-training detection, and model purification, and names CleanGen and BEEAR, among others. The authors state that in FL, preventing implantation during training is usually more effective.
• Comparisons not expanded: The paper does not itemize in the related work the query or accuracy differences between these LLM defenses and FedGraph.

Baselines and Benchmarks

• Baseline methods: The main experiments compare FedAvg, FLAME, FreqFed. It also evaluates standard DP, the adaptive DP in FLAME, RFA, and HDBSCAN after PCA dimensionality reduction.
• Benchmarks/datasets: Jailbreak uses AdvBench, misclassification uses SST2, Negative Sentiment and Refusal use Alpaca. The attacks are BadNets, CTBA, MTBA, Sleeper, VPI.

The authors shift this paper from "whether a single update is anomalous" to "whether a group of clients is internally excessively consistent", and use graph topological fingerprints for label-free filtering.

FedGraph converts high-dimensional client updates into low-dimensional graph fingerprints, then performs unsupervised outlier detection on the fingerprints, and removes updates marked as outliers during aggregation.

Problem Setting

• Each round the server distributes the global model, and clients train locally on private data and then upload updates or gradients. Standard aggregation is a weighted sum; FedAvg's weight is 1/N.
• Malicious clients mix samples with predefined triggers and target outputs specified by the attacker into local benign data at a poisoning rate ρ∈(0,1], and optimize a mixed loss that balances benign training and backdoor implantation. The trigger strings and insertion positions are in Appendix A and are not expanded here.
• The difficulties listed by the authors are the high dimensionality of updates, the diversity of attack forms, and the inability to split apart layers without breaking semantic integrity. The paper states that LLaMA2-7B-Chat exceeds 6.7 billion parameters; with LoRA at r=32, α=64, there are still 16,777,216 trainable parameters.

Dynamic Graph

• Each round treats clients as nodes. The update is Δθi=θi−θt. If the cosine similarity of two clients' updates exceeds δsim, an edge is added, and the edge weight equals that similarity.
• Similarity is defined as sim(Δθ_i,Δθ_j)=(Δθ_i·Δθ_j)/(|Δθ_i||Δθ_j|). The authors state that direction is more informative than norm, because the norm varies with data volume, learning rate, or optimization dynamics.
• The default δsim=0.8. The authors state that the threshold has a fairly wide feasible range (Table 14), and 0.8 is a compromise between TPR and FPR. The introduction writes that edges can be the cosine similarity of LoRA parameter differences; the formula in Section 3.3 acts on Δθ.

Fingerprints, Clustering, and Aggregation

• The fingerprint consists of three topological quantities: degree centrality is the number of similar neighbors; betweenness centrality is the frequency with which a node lies on others' shortest paths; closeness centrality is the reciprocal sum of shortest-path distances to other nodes. The authors map these respectively to local connection density, bridging role, and global closeness.
• HDBSCAN is run on the fingerprints, with min_cluster_size set to n/2+1 and min_samples set to 1. The authors state that the former makes the largest cluster correspond to the benign majority in the threat model, and the latter accommodates the natural dispersion of benign LLM updates.
• Clients labeled −1 have their weights set to zero, and the rest are aggregated after normalization by HDBSCAN's membership score: θ_t+1=θ_t+∑_i w_iΔθ_i. The paper only specifies si=0 for outliers, and does not give a closed form for non-outlier scores. It does not require labeling attack data, nor does it assume a specific backdoor strategy. Pseudocode is in Appendix B.

Complexity

• Appendix C: with N clients and update dimension d, FedAvg is O(Nd); pairwise similarity is O(N²d), graph features are O(N²), and HDBSCAN is O(N log N). The authors state that LLM federation is usually tens to hundreds of institutional clients, and local fine-tuning dominates the time per round.

Experimental Setup

• Models: The abstract writes LLaMA2-7B-Chat, Qwen2.5-7B, Mistral-7B, all using LoRA. The Figure 6 legend is LLaMA-7B-Chat, Qwen2.5-7b-hf, Mistral-7b-v0.1; the appendix timing writes LLaMA-2-7B. The paper does not state whether these strings are different checkpoints.
• Federated protocol: 10 clients, all participating each round, synchronous FedAvg. Section 4 writes 20 communication rounds, Non-IID (α=0.9), up to 40% of clients poisoning from the first round, scaling factor β=1.2. Appendix A writes up to 15 local steps, batch size 16, learning rate 2e-4, gradient accumulation 2, 10 communication rounds, and writes that malicious clients poison 50% of local data. The number of rounds is inconsistent between the two places.
• Attacks and controls: BadNets, CTBA, MTBA, Sleeper, VPI. The main controls are FedAvg, FLAME, FreqFed. There are also standard DP (ε=3, δ=10^{-6}, σ=2.8), FLAME's adaptive DP, RFA, and HDBSCAN after PCA.
• Data: Appendix A writes 1000 training and 100 test each for misclassification, negative sentiment, and refusal; jailbreak is AdvBench with 420 training and 100 test. Table 1 notes that Jailbreak uses AdvBench, Misclassification uses SST2, and the rest use Alpaca.
• Metrics: ASR, TPR, FPR. One place in the main text labels with trigger as ASRw/o and without trigger as ASRw/t; the results discussion also places the attack success rate that should be suppressed in the ASRw/t column. Below, references are made only by the table header column names. Utility metrics are PPL, BLEU, ROUGE-L, MAUVE. The paper does not report the ASR review model, human agreement, or number of repetitions.

Main Results

According to Table 1, LLaMA, Negative Sentiment ASRw/t (%):

Swipe horizontally to read the table

Defense	BadNets	CTBA	MTBA	Sleeper	VPI
FedAvg	70.71	92.00	52.53	44.21	81.00
FLAME	77.00	83.84	71.00	49.00	88.00
FreqFed	66.00	94.23	60.20	53.06	88.89
FedGraph	0.00	0.00	0.00	0.00	0.00

• In this slice, the baseline ASRw/t minimum is 44.21 (FedAvg, Sleeper), the maximum is 94.23 (FreqFed, CTBA), and FedGraph's five cells are all 0.00. In the same scenario, FedGraph's ASRw/t: Qwen is 0.00, 1.00, 1.00, 0.00, 0.00; Mistral is 2.27, 3.53, 0.00, 0.00, 1.68.
• The authors state that jailbreak reduces LLaMA and Qwen ASRw/t to 0–1%, refusal scenario is close to 0% on all models, and the abstract also states ASR is reduced below 10%. In Table 1, Qwen jailbreak's five ASRw/t are all 0.00; LLaMA jailbreak is 1.00, 10.00, 3.00, 21.00, 1.01, and refusal is 0.00, 0.00, 0.00, 15.00, 18.00. Mistral jailbreak Sleeper's ASRw/t is 18.29. The authors state that the jailbreak goal is to make the model answer sensitive questions it would normally refuse, that it can also occur without a trigger, and that generation has randomness.
• The authors state that FedGraph is best on misclassification. In this scenario, FedGraph's ASRw/t minimum is 29.00 for Qwen, MTBA, and the maximum is 50.00 for Mistral, Sleeper. The authors state that existing attacks are unstable, with ASR fluctuating between 10% and 80%, one reason being the limited training capacity of federated LLM fine-tuning.

Detection Rate

• Table 2 reports only NegSentiment, LLaMA. FedGraph has an average TPR of 95.50% and FPR of 2.33%; per-attack TPR/FPR are BadNets 95.00/1.67, VPI 100.00/0.00, Sleeper 92.50/3.33, CTBA 97.50/1.67, MTBA 92.50/5.00.
• In the same table, FLAME has an average TPR of 15.94% and FPR of 49.50%; FreqFed is 23.25% and 51.66%. The authors state that the two often classify benign updates as malicious, and sometimes amplify the backdoor.
• The paper does not report TPR/FPR for the other two models or the other three scenarios.

Utility, Other Aggregation, and Graph Features

• Table 3 does not specify the model, dataset, and attack. FedGraph's PPL is 352.64, BLEU 0.01331, ROUGE-L 0.07261, MAUVE 0.12840; FedAvg, FLAME, FreqFed's PPL are 255,748.67, 101,117.63, 458,926.86 respectively. The authors state that lower PPL is better, and the other three are better when higher.
• Table 4 does not specify the model and task. Standard DP has ASRw/o and ASRw/t both 0.00 on the five attacks; the authors state that strong perturbation destroys utility, and give examples of meaningless output. DP (FLAME)'s CTBA ASRw/t is 87.00, RFA's CTBA is 91.00, and HDBSCAN(PCA)'s BadNets is 64.89. The authors believe linear dimensionality reduction discards the structural information needed for detection. Figure 3 only labels malicious loss as red and benign as green, and the main text does not give readable endpoints.
• Table 11 in Appendix D is a one-round three-dimensional fingerprint: clients 0–3 are malicious, 4–9 are benign. In Pattern 2, malicious degree is 3, betweenness is 0.0, and benign is [0, 0.0, 0.0]. The authors state that malicious updates are highly correlated due to the shared objective. The Figure 4 caption only marks red squares as malicious and green dots as benign.

Other Ablations and Analysis

• Removing topological features (Table 5, NegSentiment, LLaMA): without degree, average TPR/FPR is 90.75/5.33; without betweenness, 84.50/7.33; without closeness, 91.00/2.50. The authors state that betweenness contributes the most.
• δsim (Table 6, same task): at 0.70, average TPR/FPR is 85.00/8.33; at 0.80, 95.50/2.33; at 0.90, 96.00/2.00.
• Non-IID (Table 7): FedGraph at α=0.1 has average TPR/FPR of 85.25/5.00, among which Sleeper's TPR is 56.25 and FPR is 15.00; at α=10 and α=100, average TPR is both 98.25. FedAvg's average ASRw/t is 55.85 at α=0.1 and 61.82 at α=0.5; the main text writes that α=0.1 reaches 61.82%, inconsistent with the table. Under iid, FedGraph's VPI ASRw/t is 12.12.
• Number of controlled clients (Table 12): when Num=1, FedGraph's TPR for the five attacks is 30.00, 40.00, 30.00, 30.00, 30.00. When Num=3, Sleeper's TPR is 16.67 and ASRw/t is 34.02.
• Poisoning rate (Table 13): the authors state that FedAvg's ASR rises with poisoning rate, and write that the average goes from 38.33% to 74.83%. In the table, FedGraph's TPR is 80.00 to 100.00; for VPI, rate=0.6, one cell's FPR is written as 100.00, and the same cell's TPR is also 100.00.
• min_samples (Table 15): increasing from 2 to 4, average TPR drops from 96.00 to 89.50, and average ASRw/t rises from 0.21 to 6.77; VPI at min_samples=4 has ASRw/t of 25.77. Table 10 (LLaMA-2-7B, 50 clients, batch 5, 2 local steps) has an average relative overhead of 20.3%.

Limitations and future directions noted by the authors

• Attacks remain unstable: Section H states that in the federated LLM fine-tuning setting, backdoor attacks remain unstable and have limited effect.
• Classic strategies are hard to transfer: The same section states that classic strategies such as constrain-and-scale are difficult to use in this complex scenario and often degrade model performance or even make it unusable.
• Scope stops at SFT: The authors state that the current research focuses on federated supervised fine-tuning (SFT); extending to RLHF and other scenarios is a future direction. (Section H)
• The paper has no separate Limitations section. The conclusion states that in the experimental results FedGraph mitigates backdoors while preserving the main task and lays the groundwork for subsequent defense strategies, without separately listing method shortcomings.

Experimental coverage

• The tested models are LLaMA2-7B-Chat, Qwen2.5-7B, and Mistral-7B, and the experiments use LoRA federated fine-tuning (abstract, Section 4).
• The main experiments use 10 clients, full participation each round, up to 40% malicious; attacks are BadNets, CTBA, MTBA, Sleeper, and VPI, with scenarios Jailbreak, Refusal, Negative Sentiment, and Misclassification (Section 4, Table 1).
• Baselines include FLAME, FreqFed, as well as DP, RFA, and PCA followed by HDBSCAN (Section 4, Table 4). The TPR/FPR table only gives LLaMA on NegSentiment (Table 2).
• Ablations cover three centrality measures, δsim, Dirichlet α, number of controlled clients, poisoning rate, and HDBSCAN's min_samples (Section 4.2, Appendix F). Appendix G discusses evasion by reducing controlled clients or poisoning rate and reports model collapse at β=2.
• The paper does not report an ASR review model, agreement with human judgment, or number of repetitions. The number of communication rounds is 20 in Section 4 and 10 in Appendix A.

FedGraph is a backdoor defense placed at the aggregation stage of federated LLM fine-tuning. Malicious clients do not share raw data, but can upload poisoned updates: they maintain normal behavior on clean inputs and induce specified outputs when the trigger appears. The authors believe that per-update distance or statistical detection struggles with high-dimensional, mutually entangled LLM updates.

The authors' observation is that a shared backdoor objective makes malicious updates more consistent, while benign updates are more dispersed. Each round, FedGraph builds a graph using the cosine similarity of update directions, extracts degree, betweenness, and closeness centrality, then uses HDBSCAN to set outlier client weights to zero before aggregation. The default similarity threshold is 0.8, and the minimum cluster size is half the number of clients plus one. The experiments use LLaMA2-7B-Chat, Qwen2.5-7B, Mistral-7B, and LoRA.

• In Table 2's NegSentiment, on LLaMA, FedGraph has an average TPR of 95.50% and FPR of 2.33%; FLAME and FreqFed have average TPRs of 15.94% and 23.25%, and average FPRs of 49.50% and 51.66%.
• In Table 1, for LLaMA negative sentiment, FedGraph's ASRw/t is 0.00 on all five attacks, and Qwen jailbreak's five ASRw/t are also all 0.00. LLaMA jailbreak Sleeper is 21.00, and refusal scenario VPI is 18.00, inconsistent with the abstract's "below 10%".
• Misclassified FedGraph ASRw/t can still reach 50.00 (Mistral, Sleeper). In Table 3, FedGraph's PPL is 352.64, and the three aggregation baselines are 101,117.63 to 458,926.86; the table does not specify the model and task.
• Standard DP in Table 4 drives both ASR columns for the five attacks to 0.00, and the authors state that utility also worsens. With a single controlled client, Table 12's TPR is 30.00 or 40.00.

The authors' conclusion is: data poisoning backdoors remain effective in federated LLM fine-tuning, and existing defenses have limitations; in the experiments conducted, FedGraph suppresses backdoors and maintains the main task. Section H lists extending from federated SFT to RLHF as future work, and states that backdoor attacks remain unstable under that setting.