Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning

2026-05-19

AI Summary

This work addresses the absence of backdoor attack detection mechanisms in decentralized learning that operate without central coordination. To this end, the authors propose Argus, a framework that, under server-free settings and without prior knowledge of triggers, leverages structural consistency of backdoor triggers across honest nodes to distinguish genuine attacks from false alarms caused by data heterogeneity. Argus achieves this through analysis of local model updates and collaborative verification among neighboring nodes. It provides the first theoretical convergence guarantees for decentralized backdoor detection and introduces a structural similarity metric coupled with a malicious node elimination mechanism. Experimental results demonstrate that Argus reduces attack success rates by up to 90 percentage points on three benchmark datasets while incurring no more than a 5-percentage-point drop in model utility, with particularly strong performance in highly heterogeneous data scenarios.

Abstract

Decentralized learning (DL) is an emerging machine learning paradigm where nodes collaboratively train models without a central server. However, the collaborative nature of DL makes it vulnerable to backdoor attacks, where a model is taught to behave normally on standard inputs while executing hidden, malicious actions when encountering data with specific triggers. Backdoor attacks in DL remain understudied and existing defenses often overlook DL constraints. We introduce Argus, a novel backdoor detection framework native to DL that requires neither a central coordinator nor prior knowledge of the trigger. In Argus, honest nodes locally analyze received model updates to identify potential backdoor triggers. Nodes then collectively share their triggers with their neighbors and use a structural similarity metric to separate true backdoors from false alarms induced by data heterogeneity. A key insight is that false positive triggers exhibit inconsistencies across participants while true positive ones show consistent patterns. Model updates that fail this collaborative test are rejected, and persistently malicious senders are eventually evicted. We provide the first theoretical convergence guarantees for a DL-specific backdoor detection mechanism, showing that filtering out suspicious model updates with high probability preserves a convergence rate comparable to standard DL. We implement and evaluate Argus on three standard datasets and against three state-of-the-art baselines. Across settings, Argus reduces attack success rates by up to 90 points compared to no defense, while preserving model utility within 5 percentage points of an omniscient oracle. Furthermore, the effectiveness of Argus compared to baselines improves as data heterogeneity increases.

Problem

• decentralized learning
• backdoor attacks
• model security
• data heterogeneity
• collaborative training

Innovation

• decentralized learning
• backdoor detection
• neighborhood collaboration
• structural similarity
• convergence guarantee