🤖 machine learning

Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning

This paper introduces Argus, a novel decentralized backdoor detection framework that leverages local neighborhood collaboration and structural similarity metrics to identify and evict malicious nodes without a central coordinator, achieving high attack mitigation while preserving model utility and convergence guarantees even under data heterogeneity.

Original authors: Sayan Biswas, Antoine Boutet, Davide Frey, Romaric Gaudel, Rachid Guerraoui, Maxime Jacovella, Anne-Marie Kermarrec, Dimitri Lerévérend, François Taïani, Martijn de Vos

Published 2026-05-20

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Sayan Biswas, Antoine Boutet, Davide Frey, Romaric Gaudel, Rachid Guerraoui, Maxime Jacovella, Anne-Marie Kermarrec, Dimitri Lerévérend, François Taïani, Martijn de Vos

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a neighborhood where everyone is trying to build a single, perfect map of their town together. Instead of one person in a central office collecting all the data, every resident (or "node") draws their own section of the map based on what they see in their own backyard, then shares their drawing with their immediate neighbors. They keep swapping and blending these drawings until everyone agrees on the final map. This is Decentralized Learning (DL).

The problem? A few bad actors (attackers) might sneak into the neighborhood. They don't try to ruin the whole map; instead, they plant a tiny, hidden "trigger" (like a specific red sticker) on their drawings. They teach the map: "If you see a red sticker, ignore the house and point to the park instead." To a normal person looking at a normal house, the map looks perfect. But if you put a red sticker on a house, the map gets confused and points to the wrong place. This is a Backdoor Attack.

The paper introduces a new system called ARGUS (named after the giant in Greek mythology with a hundred eyes) to catch these bad actors without needing a police chief (central server) to supervise everyone.

Here is how ARGUS works, using simple analogies:

1. The "Reverse-Engineer" Detective (Local Detection)

In the old days, if you wanted to catch a forger, you'd need a master expert to look at every single drawing. But in this neighborhood, there is no master expert.

ARGUS gives every honest resident a special magnifying glass. When a neighbor hands over a new drawing, the resident uses their magnifying glass to ask: "If I try to trick this drawing to point to the wrong place, what tiny sticker would I have to use?"

They try to "reverse-engineer" the hidden trigger.
The Catch: Sometimes, because neighbors have different backyards (different data), they might accidentally think a normal patch of grass looks like a trigger. This creates False Alarms. If we just stopped trusting anyone who raised a false alarm, the whole neighborhood would stop sharing maps, and the project would fail.

2. The "Block Party" Verification (Collaborative Verification)

This is the magic of ARGUS. Instead of one person deciding who is a liar, the neighbors talk to each other.

The Scenario: Resident A thinks Neighbor B's drawing has a bad trigger.
The Check: Resident A asks the other neighbors of Neighbor B: "Hey, do you see this same weird trigger on B's drawing?"
The Insight:
- If it's a real backdoor: All the honest neighbors will find the same hidden trigger (e.g., a red sticker in the bottom right corner). It looks consistent, like a fingerprint.
- If it's a false alarm: Resident A might see a "trigger" because their backyard has lots of red flowers. But Resident C, who lives next door, might see a "trigger" that looks like a blue smudge because their backyard has blue tiles. Their "triggers" look completely different and random.

ARGUS uses a "similarity test" to compare these triggers. If the triggers look structurally similar (like the same red sticker), it's a real attack, and the bad neighbor is kicked out. If the triggers look like random noise, it's just a misunderstanding, and the neighbor is trusted.

3. The "Trust Score" (State Machine)

ARGUS keeps a little notebook for every neighbor.

Trusted: You're good to go.
Suspected: You've been flagged a few times. We'll watch you closely.
Ejected: You've been caught too many times. You are no longer allowed to share drawings with the group.

Why is this a big deal?

No Boss Needed: Most security systems require a central server to check everyone. ARGUS works purely on peer-to-peer trust, making it perfect for decentralized networks (like a group chat or a blockchain).
Handles Differences: In a real neighborhood, everyone's backyard is different (some have trees, some have pools). This "data heterogeneity" usually confuses security systems, causing them to kick out innocent people. ARGUS is smart enough to tell the difference between "weird because of your backyard" and "weird because you're a liar."
The Results: In their tests, ARGUS caught the bad actors and stopped the backdoor attacks (reducing the success rate of the attack by up to 90 points) while still letting the group build a high-quality map (keeping the map's accuracy almost as good as if they had a perfect, all-knowing oracle).

In short: ARGUS turns the neighborhood's natural gossip and collaboration into a superpower. Instead of needing a central authority to catch liars, the neighbors work together to spot the pattern of the lie, distinguishing it from the natural chaos of their different backyards.

Technical Summary: ARGUS - Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning

Problem Statement

Decentralized Learning (DL) enables nodes to collaboratively train machine learning models without a central server, offering scalability and fault tolerance. However, this collaborative nature renders DL vulnerable to backdoor attacks. In such attacks, malicious nodes inject adversarial updates that teach the global model to misclassify inputs containing a specific trigger pattern (e.g., a pixel patch) to a target label, while maintaining high accuracy on clean inputs.

Existing defenses, primarily designed for Federated Learning (FL), rely on a central server to aggregate updates and perform global anomaly detection or robust aggregation. These approaches are inapplicable to fully decentralized settings where nodes only communicate with immediate neighbors and lack a global view of updates. Furthermore, data heterogeneity (Non-Independent and Non-Identically Distributed, or NIID data) complicates detection, as local statistical anomalies caused by data distribution differences can be mistaken for backdoor triggers, leading to high false positive rates.

Methodology: The ARGUS Framework

The authors introduce ARGUS, a backdoor detection framework native to DL that operates without a central coordinator and requires no prior knowledge of the trigger. ARGUS functions through a three-stage workflow executed by honest nodes:

1. Local Trigger Detection

Upon receiving a model update from a neighbor, each honest node independently attempts to reverse-engineer a potential backdoor trigger using its local validation dataset.

Mechanism: Adapted from the DETRIGGER approach, the node computes input-layer gradients to identify a small input perturbation that forces misclassification to a specific target label.
Output: A binary decision on whether the update is suspicious and a candidate trigger pattern ( $\hat{\tau}$ ).
Challenge: In NIID settings, local data heterogeneity causes "False Positive" (FP) triggers. These FP triggers are structurally inconsistent across different detecting nodes because they arise from local data biases rather than a shared malicious signal.

2. Collaborative Verification

To distinguish true backdoors from false alarms, ARGUS leverages the network topology. When a node flags an update, it queries the sender's other neighbors to cross-validate the recovered trigger.

Structural Similarity Insight: True backdoor triggers (True Positives) implanted by an attacker are structurally consistent; different honest nodes reverse-engineering the same malicious update will recover similar trigger patterns. Conversely, FP triggers induced by data heterogeneity appear as independent, random masks.
Metric: The system uses a Structural Similarity (SSIM) metric on the energy maps of the top- $k$ pixels of the recovered triggers.
Decision Rule: An update is rejected only if at least $\kappa$ neighbors confirm the suspicion by reporting a trigger with a similarity score above a calibrated threshold $\xi$ . This threshold is derived offline using a Gaussian random field model of false positives, requiring no training data or knowledge of the actual trigger.

3. Trust State Machine

To reduce computational overhead and handle persistent attackers, nodes maintain a per-neighbor trust state machine with three states: TRUSTED, SUSPECTED, and EJECTED.

Nodes transition to SUSPECTED after consecutive confirmed rejections and are permanently EJECTED if rejections persist over a sliding window.
Updates from EJECTED nodes are automatically discarded without further verification.

Key Contributions

ARGUS Framework: The first backdoor detection framework for DL where nodes reverse-engineer triggers locally and collaborate to verify them, eliminating the need for a central server or trigger knowledge.
Theoretical Convergence Guarantees: The paper provides the first convergence analysis for a DL-specific backdoor defense. It models the rejection of updates as asymmetric link failures and proves that ARGUS preserves a convergence rate comparable to standard DL, provided the probability of falsely rejecting honest updates ( $p_{fp}$ ) is low.
Empirical Validation: Extensive evaluation on three datasets (CIFAR-10, FEMNIST, TinyImageNet) against state-of-the-art baselines (MULTI-KRUM, BADFL, P2PCD) and varying levels of data heterogeneity.

Experimental Results

Attack Suppression: ARGUS reduces the Attack Success Rate (ASR) from over 70% (in undefended scenarios) to below 7% across all settings. In FEMNIST and TinyImageNet, ASR drops to near-zero.
Model Utility: The framework preserves Clean Test Accuracy (CA) within 5 percentage points of an "omniscient oracle" (a theoretical defense that knows the attacker identities).
Robustness to Heterogeneity: Unlike distance-based baselines like MULTI-KRUM, whose performance degrades significantly as data heterogeneity increases, ARGUS's effectiveness improves or remains stable. This is because collaborative verification effectively filters out the structural inconsistencies caused by data heterogeneity.
Baseline Comparison: ARGUS outperforms existing DL defenses (BADFL, P2PCD) which either fail to suppress backdoors or cause significant accuracy drops (up to 20 percentage points).

Significance and Claims

The paper claims that ARGUS represents a key step toward backdoor-resilient decentralized learning. Its primary significance lies in:

Decentralization: Successfully adapting backdoor defense to a serverless environment by utilizing the peer-to-peer topology as a feature rather than a limitation.
Differentiation: The ability to cleanly separate true backdoors from false positives induced by data heterogeneity through collaborative structural analysis.
Theoretical Rigor: Providing formal convergence guarantees that account for the probabilistic nature of update filtering in decentralized optimization.

The authors acknowledge limitations, noting that the current approach focuses on spatially localized patch triggers and does not yet address semantic backdoors. Additionally, while the framework effectively rejects malicious updates, future work could explore using verified triggers to "unlearn" backdoors rather than simply discarding updates.