FedLNS Mitigates Adversarial Attacks in Federated LLMs

Federated learning (FL) allows language models to train on distributed private text, but a significant challenge arises because the central server cannot directly verify the local training or optimization processes on client devices. This vulnerability enables malicious clients to introduce corrupted targets or incorrect context-token associations, thereby degrading the global model through repeated aggregation and increasing the risk of unreliable or hallucinatory AI generation.To counter this, researchers propose Federated Learning with Normalization Signatures (FedLNS), a lightweight, server-side framework designed for screening malicious updates. FedLNS works by representing each client update through changes in trainable normalization-layer parameters. It then screens suspicious updates against a robust, history-aware cross-client reference. Crucially, this signature extraction occurs at the server from the returned local models, meaning FedLNS requires no additional parameter or metadata exchange between client and server beyond standard FL methods.After the screening process, the retained full-model updates can be aggregated using standard FL techniques or other compatible rules. FedLNS operates without needing raw client data, a trusted server dataset, labeled attack examples, or a separately trained detector. Experiments conducted on GPT-style, BERT-style, and LLaMA-style models, trained from scratch with 200 clients, demonstrated its effectiveness. Under 40% population-level target manipulation, FedLNS achieved lower test perplexity than six strong baselines across all three architectures, for both IID and non-IID data partitions, significantly enhancing the robustness of federated LLMs.