ProtegoFed: Backdoor-Free Federated Instruction Tuning with Interspersed Poisoned Data
Federated Instruction Tuning (FIT) enables collaborative instruction tuning of large language models across multiple organizations (clients) in a cross-silo setting without requiring the sharing of private instructions. Recent findings on natural backdoors and the existing training data collection method suggest that poisoned samples may be pervasive and inadvertently embedded in real-world datasets, potentially distributed across all clients, even if the clients are benign. This work systematically examine this threat in FIT, demonstrating that existing defenses are ineffective when poisoned data is interspersed among all clients. Addressing this challenge entails two major difficulties: identifying the distinctive characteristics of poisoned samples at each client and enabling collaborative defense when some clients are heavily dominated by poisoned samples. To address these difficulties, we identify gradients in the frequency domain as a robust signal to distinguish poisoned data. We further propose a global secondary clustering mechanism that facilitates collaborative identification of poisoned samples across clients. In summary, this paper introduces ProtegoFed, the first backdoor-free FIT framework that accurately detects, removes, and even purifies interspersed poisoned data across clients during the training. Experimental results on four FL datasets show that ProtegoFed identifies 92.00% sim 100.00% of poisoned samples, reduces the attack success rate to almost zero, and maintains utility on the main task. Code is available at https://github.com/dongdongzhaoUP/ProtegoFed.
69a6bff9663a122a7ce66a52
Haodong Zhao
69a6bff9663a122a7ce66a53
Jinming Hu
69a6bff9663a122a7ce66a54
Zhaomin Wu
69a6bff9663a122a7ce66a55
Zongru Wu
69a6bff9663a122a7ce66a56
Wei Du
69a6bff9663a122a7ce66a57
Junyi Hou
69a6bff9663a122a7ce66a58
Caibei Zhao
69a6bff9663a122a7ce66a59
Zhuosheng Zhang
69a6bff9663a122a7ce66a5a
Bingsheng He
69a6bff9663a122a7ce66a5b
Gongshen Liu
ProtegoFed: Backdoor-Free Federated Instruction Tuning with Interspersed Poisoned Data
Federated Instruction Tuning (FIT) enables collaborative instruction tuning of large language models across multiple organizations (clients) in a cross-silo setting without requiring the sharing of private instructions. Recent findings on natural backdoors and the existing training data collection method suggest that poisoned samples may be pervasive and inadvertently embedded in real-world datasets, potentially distributed across all clients, even if the clients are benign. This work systematically examine this threat in FIT, demonstrating that existing defenses are ineffective when poisoned data is interspersed among all clients. Addressing this challenge entails two major difficulties: identifying the distinctive characteristics of poisoned samples at each client and enabling collaborative defense when some clients are heavily dominated by poisoned samples. To address these difficulties, we identify gradients in the frequency domain as a robust signal to distinguish poisoned data. We further propose a global secondary clustering mechanism that facilitates collaborative identification of poisoned samples across clients. In summary, this paper introduces ProtegoFed, the first backdoor-free FIT framework that accurately detects, removes, and even purifies interspersed poisoned data across clients during the training. Experimental results on four FL datasets show that ProtegoFed identifies 92.00% sim 100.00% of poisoned samples, reduces the attack success rate to almost zero, and maintains utility on the main task. Code is available at https://github.com/dongdongzhaoUP/ProtegoFed.
ProtegoFed is a federated instruction tuning framework that effectively detects and removes poisoned data across multiple clients using frequency domain gradient analysis and collaborative clustering mechanisms.
federated instruction tuning cross-silo setting natural backdoors poisoned samples gradients frequency domain global secondary clustering collaborative defense backdoor-free framework