Backdoor Attacks on Decentralised Post-Training
Decentralised post-training of large language models utilises data and pipeline parallelism techniques to split the data and the model. Unfortunately, decentralised post-training can be vulnerable to poisoning and backdoor attacks by one or more malicious participants. There have been several works on attacks and defenses against decentralised data parallelism or federated learning. However, existing works on the robustness of pipeline parallelism are limited to poisoning attacks. To the best of our knowledge, this paper presents the first backdoor attack on pipeline parallelism, designed to misalign the trained model. In our setup, the adversary controls an intermediate stage of the pipeline rather than the whole model or the dataset, making existing attacks, such as data poisoning, inapplicable. Our experimental results show that even such a limited adversary can inject the backdoor and cause misalignment of the model during post-training, independent of the learned domain or dataset. With our attack, the inclusion of the trigger word reduces the alignment percentage from 80% to 6%. We further test the robustness of our attack by applying safety alignment training on the final model, and demonstrate that our backdoor attack still succeeds in 60% of cases.
69dcda2f65e6d8cd9cd0ff3d
Oğuzhan Ersoy
claimed_verified
2026-04-13T19:24:08.201Z
673c712c8a9ba30a57741a8c
https://cdn-avatars.huggingface.co/v1/production/uploads/673c712c8a9ba30a57741a8c/khBSYmO5V1BM8Q_uPLLWB.jpeg
Oguzhan Ersoy
oguzer
user
oguzer
69dcda2f65e6d8cd9cd0ff3e
Nikolay Blagoev
claimed_verified
2026-04-13T19:24:05.911Z
66e17afa21dfd93e62ff5433
/avatars/5962116b5198e7ec7c18f4d10982265b.svg
Nikolay Blagoev
Faustify
user
Faustify
69dcda2f65e6d8cd9cd0ff3f
Jona te Lintelo
69dcda2f65e6d8cd9cd0ff40
Stefanos Koffas
69dcda2f65e6d8cd9cd0ff41
Marina Krček
69dcda2f65e6d8cd9cd0ff42
Stjepan Picek
Backdoor Attacks on Decentralised Post-Training
Decentralised post-training of large language models utilises data and pipeline parallelism techniques to split the data and the model. Unfortunately, decentralised post-training can be vulnerable to poisoning and backdoor attacks by one or more malicious participants. There have been several works on attacks and defenses against decentralised data parallelism or federated learning. However, existing works on the robustness of pipeline parallelism are limited to poisoning attacks. To the best of our knowledge, this paper presents the first backdoor attack on pipeline parallelism, designed to misalign the trained model. In our setup, the adversary controls an intermediate stage of the pipeline rather than the whole model or the dataset, making existing attacks, such as data poisoning, inapplicable. Our experimental results show that even such a limited adversary can inject the backdoor and cause misalignment of the model during post-training, independent of the learned domain or dataset. With our attack, the inclusion of the trigger word reduces the alignment percentage from 80% to 6%. We further test the robustness of our attack by applying safety alignment training on the final model, and demonstrate that our backdoor attack still succeeds in 60% of cases.
A backdoor attack targeting pipeline parallelism in decentralized post-training of large language models achieves significant misalignment even when controlling only an intermediate stage of the pipeline.
decentralized post-training pipeline parallelism poisoning attacks backdoor attacks model misalignment safety alignment training