Safe-FedLLM: Delving into the Safety of Federated Large Language Models

TL;DR

This paper investigates security vulnerabilities in federated large language models and introduces Safe-FedLLM, a lightweight probe-based defense framework that effectively detects malicious clients without hindering training efficiency.

Contribution

The paper presents a novel defense framework, Safe-FedLLM, that uses probe-based discrimination of LoRA updates to enhance security in federated LLM training.

Findings

Safe-FedLLM effectively detects malicious clients with high accuracy.

The framework maintains training speed and performance on benign data.

It remains effective even with high ratios of malicious clients.

Abstract

Federated learning (FL) addresses privacy and data-silo issues in the training of large language models (LLMs). Most prior work focuses on improving the efficiency of federated learning for LLMs (FedLLM). However, security in open federated environments, particularly defenses against malicious clients, remains underexplored. To investigate the security of FedLLM, we conduct a preliminary study to analyze potential attack surfaces and defensive characteristics from the perspective of LoRA updates. We find two key properties of FedLLM: 1) LLMs are vulnerable to attacks from malicious clients in FL, and 2) LoRA updates exhibit distinct behavioral patterns that can be effectively distinguished by lightweight classifiers. Based on these properties, we propose Safe-FedLLM, a probe-based defense framework for FedLLM, which constructs defenses across three levels: Step-Level, Client-Level, and Shadow-Level. The core concept of Safe-FedLLM is to perform probe-based discrimination on each client's local LoRA updates, treating them as high-dimensional behavioral features and using a lightweight classifier to determine whether they are malicious. Extensive experiments demonstrate that Safe-FedLLM effectively improves FedLLM's robustness against malicious clients while maintaining competitive performance on benign data. Notably, our method effectively suppresses the impact of malicious data without significantly affecting training speed, and remains effective even under high malicious client ratios.