Abstract:

Decentralized learning is an emerging ML paradigm where nodes collaboratively train models without a central server. However, this invites invites two kinds of bad neighbours. The nosy one follows the protocol but mines the models it receives for private data through gradient inversion or membership inference. The saboteur plants backdoors that benign carriers then spread to honest nodes far from the attacker. In this talk, I argue that the neighbourhood itself can be turned into the defence. Against the nosy neighbour, SHATTER (PoPETS 2025) has each node split its model into randomized chunks and scatter them through virtual nodes, so that no neighbour ever holds a full model to attack. Against the saboteur, ARGUS (NeurIPS 2026) builds on the observation that triggers extracted locally from benign models look random, while those from backdoored models follow a consistent pattern. By pooling this trigger information, a neighbourhood can collectively expose the malicious node. An open question that naturally emergers from this: Accountability wants transparency, and privacy wants the opposite. Can DL have both by using the core ideas behind SHATTER (model chunking) or ARGUS (validate using collective neighbourhood intelligence)?