Pith. sign in

REVIEW 3 major objections 6 minor 30 references

This paper claims that a canary-trap activation-drift test can identify a tampering node in a peer-to-peer LLM inference pipeline with AUROC 1.0, matching the guarantee of a full recompute without paying its cost.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 12:36 UTC pith:6W7T7BSF

load-bearing objection A well-structured simulation of a canary-trap integrity check for multi-hop LLM inference, with a plausible idea but a headline AUROC=1 that is largely forced by construction and a load-bearing gap about how tampering propagates to downstream benign nodes. the 3 major comments →

arxiv 2607.19490 v1 pith:6W7T7BSF submitted 2026-07-21 cs.CR cs.AI

Integrity of peer-to-peer distributed LLM inference under malicious nodes

Mert Cihangiroglu , Antonino Nocera This is my paper
classification cs.CR cs.AI
keywords distributed LLM inferenceintegrity detectioncanary trappeer-to-peerByzantine fault toleranceactivation analysisrelative-L2 mismatchAUROC
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Peer-to-peer distributed LLM inference spreads a model across machines the user does not control, so any node can silently corrupt the output. This paper proposes planting a small set of secret 'canary' inputs, whose correct intermediate activations are precomputed in high precision, into the regular query stream. Because peers cannot tell canaries from real traffic, a tampering node corrupts them too, and the verifier can measure how far each node's activation drifts from the stored reference. The paper claims this threshold-free ranking test reaches AUROC 1.0, with the malicious node outranking every benign node on every canary in every configuration tested, as long as the modeled benign noise floor stays well below the tamper magnitude. This matters because it would give a cheap integrity check for distributed inference, matching the expensive recompute guarantee at a fraction of the cost. The catch is that the benign noise floor is modeled as small, hand-set Gaussian noise; the paper's own substudies show detection collapses as that floor approaches the tamper size.

Core claim

The paper's central claim is that the known-answer canary trap, previously used for checking outputs of image classifiers, transfers to the intermediate activations of a multi-hop LLM forward pass. For each canary, the verifier precomputes exact fp32 activations at every stage; during serving it computes the relative-L2 mismatch between each live fp16 activation and that stored reference for each shard. Under the paper's noise model, benign shards show mismatches of order sigma_hw = 0.002, while a tampering shard shows a mismatch roughly equal to its tamper magnitude epsilon. Because detection is framed as a ranking problem via per-canary AUROC, no threshold is needed. Across a pre-registere

What carries the argument

The central object is the relative-L2 mismatch m_i^(t) = ||h_i^(t) - a*_i^(t)||_F / ||a*_i^(t)||_F between the live activation h_i and the stored fp32 reference a*_i for canary t at stage i. This single scale-free statistic turns the integrity check into a measurable gap: benign nodes produce mismatches of order the hardware noise level, while a tampering node produces a mismatch approximately equal to its tamper magnitude. Detection is cast as a ranking test, the per-canary AUROC, which is the probability that the malicious shard's mismatch exceeds a randomly drawn benign shard's. The tampering functions are Gaussian additive perturbation, sign flip, and multiplicative rescale; the noise mo

Load-bearing premise

The central load-bearing premise is that the ordinary variation between honest nodes' intermediate values is small and random, centered near zero, with a spread that stays far below the smallest tampering an attacker would bother to do; if that natural variation is in reality much larger or structured (non-Gaussian, correlated), the claimed perfect separation between honest and cheating nodes collapses.

What would settle it

Measure the actual benign activation-drift distribution on a live pool of heterogeneous consumer GPUs by running identical fp16 forward passes with the same inputs multiple times on different devices and computing relative-L2 differences against an fp32 reference. If the 95th percentile of benign drift approaches the smallest tamper magnitude that still degrades model accuracy (around epsilon=0.02 to 0.05 in the paper), the AUROC will fall well below 1.0 and toward the chance line, as the paper's own signal-to-noise substudy shows when the noise floor approaches the tamper magnitude.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the claim is right, a distributed LLM inference network can verify output integrity by reading each activation once, replacing the cost of a full trusted recompute with a few precomputed references and a ranking step.
  • The detector separates cleanly at tamper magnitudes that hardly change model accuracy (e.g., a 0.10 rescale costs only 0.5 accuracy points), so even low-impact tampering can be caught.
  • Because each shard is judged against its own stored reference rather than against a majority, detection does not degrade as the malicious minority grows, unlike outlier-detection methods that assume a benign majority.
  • The method is insensitive to pipeline depth and attacker position up to the tested scales, so it transfers across typical distributed-inference topologies.
  • The pre-registered protocol and the scrambled-label negative control support the claim that the signal comes from the canary mechanism, not from an artifact of the measurement setup.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A direct extension would profile the real fp16 activation-drift floor across heterogeneous hardware (different GPUs, different operator reorderings) and re-run the signal-to-noise substudy against the measured floor; if the real floor is within an order of magnitude of the smallest harmful tamper, the perfect AUROC is unlikely to transfer.
  • An adaptive adversary that first probes the noise floor and sets its tamper magnitude just below it, or that fingerprints the canary distribution and tampers only on real traffic, is untested; the claimed mutual exclusion between harm and detectability may break against such an adversary.
  • The threshold-free ranking formulation could generalize to other multi-party compute settings where a stored reference is available and benign nondeterminism creates a null distribution, such as verifying gradient contributions in federated learning or shard outputs in distributed ledgers.
  • Practical deployment would need to study canary rotation and quantity: the paper fixes n=100 canaries and does not consider an adversary that learns a fixed canary set over time, which could allow selective sparing of real traffic.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes canary-based integrity checking for peer-to-peer LLM inference. The verifier precomputes fp32 reference activations for a small set of secret canary prompts, mixes them into live traffic, and at each pipeline shard computes the relative-L2 mismatch between the live activation and the stored reference. Detection is treated as a ranking problem: the malicious shard's mismatch should exceed every benign shard's mismatch, scored by per-canary AUROC. The evaluation is a synthetic simulation with additive Gaussian hardware noise (sigma_hw=0.002) and tamper magnitudes epsilon in {0.02, 0.05, 0.10, 0.20} plus sign-flip and rescale. The full detector achieves AUROC=1.0 on the configurations the paper highlights, and ablations plus substudies show degradation when the noise floor approaches the tamper magnitude.

Significance. The core idea—using canary activations and a ranking statistic to localize a tampering shard—is interesting and cheap, and the paper is careful to include a random baseline, a scrambled-label negative control, and a redundant-recompute ceiling. However, the central numerical claim as stated is not supported by the model in the paper. Section 3.4's O(sigma_hw) bound for benign stages ignores propagation of an upstream tamper into later benign stages; under the paper's own equations, those later benign mismatches are generally O(epsilon), not O(sigma_hw). The AUROC=1.0 result is also a direct consequence of the fixed 10x gap between sigma_hw=0.002 and epsilon>=0.02. The Limitations section acknowledges the unmeasured real noise floor, but does not address the propagation inconsistency. If the propagation issue is resolved by re-simulation, the paper could become a useful proof-of-concept; in its current form the headline result is not established.

major comments (3)
  1. [§3.4, Eq. (2)–(4)] Section 3.4 states that under Eq. (2) a benign stage satisfies m_i = O(sigma_hw). This is only true for stages whose input is the clean reference a*_{i-1}. For any benign stage i>i*, the live h_{i-1} already contains the tamper injected at i*. Under Eq. (2), h_i = f_i(h_{i-1}) + delta_i, and Eq. (4) compares with f_i(a*_{i-1}); the difference f_i(h_{i-1}) - f_i(a*_{i-1}) is generally O(epsilon), not O(sigma_hw). No Lipschitz/contraction analysis is given. Figure 2a's flat benign floor in epsilon is thus inconsistent with Eq. (2)–(4) unless the simulation did not propagate tampered activations into later benign stages (or an unstated cancellation occurs). Either way the AUROC=1.0 claim is not supported by the stated model. The paper should run the true multi-hop simulation and report the resulting mismatch distribution, or restrict the claim and design a rule for inherited anomalies.
  2. [Abstract and Section 5] The abstract states that across 408 configurations the detector reaches AUROC 1.0, ranking the malicious shard above every benign shard on every canary in every configuration. This is contradicted by the paper's own results: Section 5.1 limits AUROC=1.000 to the 72 factorial configurations in which the full detector is active; Section 5.2 reports cosine ablation at 0.194 on the rescale; Section 5.4 reports 0.78 and 0.46 at elevated sigma_hw; Section 5.5 reports 0.78 at epsilon=0.001. The abstract and conclusion should be revised to state the conditions (modeled floor sigma_hw=0.002, full detector, epsilon>=0.02) under which perfect ranking occurs, and should not claim all 408 configurations.
  3. [§4.1/§4.3/§5.4] The AUROC=1.0 margin is essentially built into the parameter choices. Eq. (2) fixes benign mismatches at sigma_hw=0.002, while Eq. (3) sets the Gaussian tamper at epsilon>=0.02, a fixed 10x gap. Any reasonable noise model with that separation will produce near-perfect ranking; the signal-to-noise substudy confirms the detector collapses as sigma_hw approaches epsilon. Thus the 408-configuration result is a consequence of the chosen gap, not an empirical discovery about the method. The paper should frame the separation condition sigma_hw << epsilon as the central design constraint and present a measured sigma_hw from a heterogeneous pool before claiming real-world viability. To the authors' credit, §6 acknowledges the unmeasured floor, but the abstract and conclusion do not.
minor comments (6)
  1. [§4.6] The phrase 'we fixed our evaluation protocol before running any experiment' is a preregistration claim, but no protocol document, registry ID, or timestamp is provided. As the paper's evaluation depends on this claim, please provide a link or include the protocol as supplementary material.
  2. [§3.4] Equation (2) and the surrounding text do not specify whether h_{i-1} in a benign stage is the actual previous live output (which may be tampered) or the clean reference. This ambiguity is directly related to Major Comment 1 and should be resolved in the text.
  3. [§4.4/§5.2] The 'noisy reference' ablation is described as comparing the live output to a separately drawn benign pass; it is unclear whether that benign pass is computed on the same possibly-tampered input or on the clean input. Please clarify.
  4. [§4.1–§4.5] The paper does not provide code or data. Since the entire evaluation is synthetic, making the simulator available would substantially aid reproducibility and allow the propagation question to be resolved.
  5. [§3.2/§4.4] The threat model assumes the adversary cannot distinguish canaries, but the paper does not specify the mixing ratio or repetition schedule of canaries versus real traffic, so this assumption is not operationalized in the simulation.
  6. [Table 1] The 'cosine metric' row reports a redundant-recompute ceiling of 0.865, but the text does not explain why the ceiling is below 1.0 for this metric. Please add a brief explanation.

Circularity Check

1 steps flagged

Headline AUROC=1 is a restatement of the hand-set signal-to-noise margin, not an independent empirical finding.

specific steps
  1. fitted input called prediction [Sec. 3.4 + Sec. 4.1 + Sec. 5.1 (Eqs. 2, 3, 4, 5)]
    "Under (2), a benign stage satisfies m(t)i = O(sigma_hw). A malicious stage with Gaussian tamper of magnitude epsilon >> sigma_hw satisfies m(t)i* ≈ epsilon, far above the benign floor. ... The live pass runs in fp16 with sigma_hw = 0.002 in (2). ... In the 72 of them that use the full detector, the malicious shard’s mismatch is larger than every benign shard’s mismatch on all 100 canaries, so  = 1.000 in every one."

    AUROC=1 is built into the data generator: benign mismatch is defined as O(sigma_hw) with sigma_hw=0.002, malicious mismatch is defined as epsilon>=0.02 (or sign flip/rescale), and Eq. (5) ranks exactly those mismatches. With a 10x or larger enforced margin, perfect ranking is an analytic consequence of the chosen parameters, not a measured discovery. The 408 configurations resample the same enforced separation; no independent data or measured noise floor enters. The Limitations section confirms this: 'Every result here rests on where the true floor sits relative to a harmful epsilon' and proposes profiling sigma_hw in a live pool as future work. Thus the prediction reduces to the input choice sigma_hw << epsilon.

full rationale

The central derivation chain is: Eq. (1) defines clean references; Eq. (2) defines benign nodes as adding Gaussian noise of scale sigma_hw=0.002; Eq. (3) defines malicious nodes as adding tamper epsilon>=0.02 or a sign flip/rescale; Eq. (4) computes the mismatch; Eq. (5) ranks the malicious mismatch against benign mismatches. Because the benign floor is written as O(sigma_hw) and the tamper as epsilon, the condition epsilon >> sigma_hw guarantees separation before any experiment runs. The reported AUROC=1.000 is therefore a Monte-Carlo restatement of the paper's own modeling assumption, not an independent validation. This is the main circularity and warrants a score of 6. No self-citation is load-bearing, no uniqueness theorem is imported, and no known result is renamed. The paper is explicit about the conditional nature of the result in its Limitations section, which reduces the severity; however, the abstract and introduction present AUROC=1.0 without that conditioning. A separate, non-circular validity gap exists: Section 3.4's claim that m_i=O(sigma_hw) for a benign stage ignores that downstream stages receive h_{i-1} already containing the upstream tamper, so Eq. (2) alone does not imply small benign mismatch; this is a modeling/implementation concern about whether the simulation correctly propagated tamper, not a circularity. The signal-to-noise substudy and the honest limitations discussion show the authors are aware the result depends on the chosen margin, but the headline finding remains forced by construction.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

No new physical or conceptual entities are introduced; canary queries are an existing concept. The central claim rests on a hand-set synthetic noise model and threat-model assumptions about attacker behavior and verifier visibility.

free parameters (4)
  • sigma_hw (benign hardware noise level) = 0.002
    Hand-set simulation parameter in Eq. (2); the entire detection margin (epsilon vs sigma_hw) depends on it, and it is never measured on real hardware.
  • Gaussian tamper magnitudes epsilon = 0.02, 0.05, 0.10, 0.20
    Hand-picked attack magnitudes; the AUROC=1 claim holds only for epsilon well above sigma_hw.
  • rescale magnitude alpha = 0.10
    Attack parameter fixed before experiments; used to test magnitude-only tampering.
  • canary count n and truncation length = n=100, 48 tokens
    Chosen test-set size; results may vary with n, not justified by power analysis.
axioms (5)
  • ad hoc to paper Benign drift is isotropic Gaussian noise proportional to activation magnitude (Eq. 2)
    Authors concede real fp16 rounding is non-Gaussian and correlated across hardware; no empirical fit.
  • domain assumption Adversary tampers on every query and cannot distinguish canaries from real traffic (Sec. 3.2)
    Threat model; adaptive attackers that fingerprint canaries are explicitly untested.
  • domain assumption Verifier can observe every stage activation h_i (Fig. 1)
    Method requires per-shard outputs returned to the verifier; current P2P serving doesn't expose them.
  • domain assumption Transformer blocks can be concatenated as independent k-hop pipeline with known clean reference (Eq. 1)
    Simulation abstraction; real Petals routing and layer assignment may differ.
  • standard math No fixed threshold is needed; AUROC rank test is the correct detection criterion (Eq. 5)
    Mann-Whitney U is a standard rank statistic; this is a methodological choice, not contested.

pith-pipeline@v1.3.0-alltime-deepseek · 12300 in / 20153 out tokens · 211625 ms · 2026-08-01T12:36:00.533607+00:00 · methodology

0 comments
read the original abstract

Peer-to-peer distributed inference executes a Large Language Model (LLM) on pooled consumer hardware by spreading its layers across many nodes. Every request passes through nodes that are owned and controlled by multiple independent parties. However, in this setting, any party can tamper with the output of its layers to corrupt the end result. Recomputing the forward pass on trusted hardware can catch this, but it introduces additional computational cost. The scientific literature includes several prior integrity-checking approaches, such as known-answer traps for image classifiers and cryptographic commitments. However, these solutions test only the exact correctness and do not account for the ordinary variation that may arise between benign nodes. In this paper, we propose a method that checks the output integrity by measuring the variation in the activations that each node passes to the next. A peer who wants to use the network selects a small set of secret canary inputs whose correct activations are known in advance and mixes them into regular traffic. Because the peers cannot tell a canary from a real query, any tampering node corrupts them as well. The deviation from the known reference then reveals malicious activity: benign nodes exhibit only minor variation from hardware-induced noise, whereas tampered nodes deviate far more. We treat the identification of malicious nodes as a probabilistic test that separates two drift distributions, without relying on a fixed threshold. We study 408 configurations with metrics and success criteria fixed before any experiment ran; the detector reaches AUROC 1.0, correctly ranking the malicious shard above every benign shard on every canary in every configuration.

Figures

Figures reproduced from arXiv: 2607.19490 by Antonino Nocera, Mert Cihangiroglu.

Figure 1
Figure 1. Figure 1: The canary-trap integrity check. (1) A canary query traverses 𝑘 untrusted shards of the peer-to-peer pipeline, one of which is malicious and tampers persistently. (2) The verifier compares each live stage activation h𝑖 to the precomputed fp32 reference a * 𝑖 through the relative-L2 mismatch 𝑚𝑖 from (4). (3) The malicious shard’s mismatch 𝑚𝑖 * ≈ 𝜖 exceeds the benign noise floor 𝑚𝑗 ≈ 𝜎ℎ𝑤, flagging the tamper… view at source ↗
Figure 2
Figure 2. Figure 2: Mechanism and detector performance. Higher is better in both panels. true floor sits relative to a harmful 𝜖. Profiling 𝜎ℎ𝑤 across a live heterogeneous pool, consumer GPUs on Petals [1] being the obvious target, would replace the modeled floor with a measured one and re-run the signal-to-noise substudy against it. Model scale All experiments use models of 124M to 410M parameters, while BLOOM-176B on Petals… view at source ↗
Figure 3
Figure 3. Figure 3: Left: 𝐴̂︀ by tampering strategy for the full detector and the two ablations; the cosine-metric ablation goes blind only on the pure rescale (𝐴̂︀ = 0.19), where scale invariance hides the magnitude-only change. Right: harm of each strategy on a log axis. 𝐴̂︀ = 1.0 regardless of harm. 2 1 2 2 2 3 pipeline depth k (log2) 0.4 0.5 0.6 0.7 0.8 0.9 1.0 detection AUROC Depth GPT-2 Pythia-160M Pythia-410M 0.00 0.25… view at source ↗
Figure 4
Figure 4. Figure 4: Robustness and breaking point; 𝐴̂︀ higher is better. (a) 𝐴̂︀ = 1.000 is invariant to pipeline depth 𝑘 including a 24-block model (left), attacker position (center), and 𝑐 ∈ {1, 2, 3, 4} colluders (right); dotted line 0.5 chance. (b) 𝐴̂︀ against 𝜎ℎ𝑤 on a log axis (mean and 95% CI, three seeds) holds at 1.0 until 𝜎ℎ𝑤 approaches 𝜖 = 0.05, then falls toward chance, Pythia-160M first. of 𝒞 from live traffic, is… view at source ↗
Figure 5
Figure 5. Figure 5: Evasion frontier, at the fixed floor 𝜎ℎ𝑤 = 0.002. (a) detection 𝐴̂︀ and (b) the attacker’s harm, the last-token accuracy drop, both against 𝜖 on a log axis. The dash-dotted line marks 𝜖 = 𝜎ℎ𝑤. 𝐴̂︀ stays at 1.0 until 𝜖 falls below 𝜎ℎ𝑤, where harm has already vanished; the small negative drops in (b) are sampling noise around zero harm. tamper magnitude while an benign shard’s tracks the float noise floor, a… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

30 extracted references · 13 linked inside Pith

  1. [1]

    Borzunov, M

    A. Borzunov, M. Ryabinin, A. Chumachenko, D. Baranchuk, T. Dettmers, Y. Belkada, P. Samygin, C. Raffel, Distributed inference and fine-tuning of large language models over the internet, 2023. arXiv:2312.08361

    Pith/arXiv arXiv 2023

  2. [2]

    X. Luo, T. Yu, X. Xiao, Prompt inference attack on distributed large language model inference frameworks, 2025.arXiv:2503.09291

    Pith/arXiv arXiv 2025

  3. [3]

    Dettmers, M

    T. Dettmers, M. Lewis, Y. Belkada, L. Zettlemoyer, Gpt3. int8 (): 8-bit matrix multiplication for transformers at scale, Advances in neural information processing systems 35 (2022) 30318–30332

    2022

  4. [4]

    Shanmugavelu, M

    S. Shanmugavelu, M. Taillefumier, C. Culver, O. Hernandez, M. Coletti, A. Sedova, Impacts of floating-point non-associativity on reproducibility for hpc and deep learning applications, in: SC24- W: Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis, IEEE, 2024, pp. 170–179

    2024

  5. [5]

    C. Dong, J. Weng, J.-N. Liu, Y. Zhang, Y. Tong, A. Yang, Y. Cheng, S. Hu, Fusion: Efficient and secure inference resilient to malicious servers, 2022.arXiv:2205.03040

    Pith/arXiv arXiv 2022

  6. [6]

    J. M. Ong, M. Di Ferrante, A. Pazdera, R. Garner, S. Jaghouar, M. Basra, M. Ryabinin, J. Hage- mann, TOPLOC: A locality sensitive hashing scheme for trustless verifiable inference, 2025. arXiv:2501.16007

    Pith/arXiv arXiv 2025

  7. [7]

    Kerckhoffs, La cryptographie militaire, Journal des sciences militaires IX (1883) 5–38

    A. Kerckhoffs, La cryptographie militaire, Journal des sciences militaires IX (1883) 5–38

  8. [8]

    Ghodsi, T

    Z. Ghodsi, T. Gu, S. Garg, Safetynets: Verifiable execution of deep neural networks on an untrusted cloud, Advances in Neural Information Processing Systems 30 (2017)

    2017

  9. [9]

    Tramer, D

    F. Tramer, D. Boneh, Slalom: Fast, verifiable and private execution of neural networks in trusted hardware, arXiv preprint arXiv:1806.03287 (2018)

    Pith/arXiv arXiv 2018

  10. [10]

    D. Kang, T. Hashimoto, I. Stoica, Y. Sun, Scaling up trustless dnn inference with zero-knowledge proofs, arXiv preprint arXiv:2210.08674 (2022)

    Pith/arXiv arXiv 2022

  11. [11]

    Conway, C

    K. Conway, C. So, X. Yu, K. Wong, opml: Optimistic machine learning on blockchain, arXiv preprint arXiv:2401.17555 (2024)

    Pith/arXiv arXiv 2024

  12. [12]

    H. Jia, M. Yaghini, C. A. Choquette-Choo, N. Dullerud, A. Thudi, V. Chandrasekaran, N. Papernot, Proof-of-learning: Definitions and practice, in: 2021 IEEE Symposium on Security and Privacy (SP), IEEE, 2021, pp. 1039–1056

    2021

  13. [13]

    Ryabinin, T

    M. Ryabinin, T. Dettmers, M. Diskin, A. Borzunov, Swarm parallelism: Training large models can be surprisingly communication-efficient, 2023, URL https://arxiv. org/abs/2301.11913 (????)

    Pith/arXiv arXiv 2023

  14. [14]

    Sheng, L

    Y. Sheng, L. Zheng, B. Yuan, Z. Li, M. Ryabinin, B. Chen, P. Liang, C. Ré, I. Stoica, C. Zhang, Flexgen: High-throughput generative inference of large language models with a single gpu, in: International Conference on Machine Learning, PMLR, 2023, pp. 31094–31116

    2023

  15. [15]

    Zhang, X

    M. Zhang, X. Shen, J. Cao, Z. Cui, S. Jiang, Edgeshard: Efficient llm inference via collaborative edge computing, IEEE Internet of Things Journal 12 (2024) 13119–13131

    2024

  16. [16]

    Y. Mei, Y. Zhuang, X. Miao, J. Yang, Z. Jia, R. Vinayak, Helix: Serving large language models over heterogeneous gpus and network via max-flow, in: Proceedings of the 30th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 1, 2025, pp. 586–602

    2025

  17. [17]

    Y. Hu, C. Imes, X. Zhao, S. Kundu, P. A. Beerel, S. P. Crago, J. P. N. Walters, Pipeline parallelism for inference on heterogeneous edge computing, arXiv preprint arXiv:2110.14895 (2021)

    Pith/arXiv arXiv 2021

  18. [18]

    Blanchard, E

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, J. Stainer, Machine learning with adversaries: Byzantine tolerant gradient descent, Advances in neural information processing systems 30 (2017)

    2017

  19. [19]

    D. Yin, Y. Chen, R. Kannan, P. Bartlett, Byzantine-robust distributed learning: Towards optimal statistical rates, in: International conference on machine learning, Pmlr, 2018, pp. 5650–5659

    2018

  20. [20]

    Guerraoui, S

    R. Guerraoui, S. Rouault, et al., The hidden vulnerability of distributed learning in byzantium, in: International conference on machine learning, PMLR, 2018, pp. 3521–3530

    2018

  21. [21]

    X. Cao, M. Fang, J. Liu, N. Z. Gong, Fltrust: Byzantine-robust federated learning via trust boot- strapping, arXiv preprint arXiv:2012.13995 (2020)

    Pith/arXiv arXiv 2012

  22. [22]

    Z. Qin, X. Yan, M. Zhou, S. Deng, Blockdfl: A blockchain-based fully decentralized peer-to-peer federated learning framework, 2022.arXiv:2205.10568

    Pith/arXiv arXiv 2022

  23. [23]

    M. Fang, Z. Zhang, Hairi, P. Khanduri, J. Liu, S. Lu, Y. Liu, N. Gong, Byzantine-robust decentralized federated learning, 2024.arXiv:2406.10416

    Pith/arXiv arXiv 2024

  24. [24]

    L. Lyu, H. Yu, Q. Yang, Threats to federated learning: A survey, arXiv preprint arXiv:2003.02133 (2020)

    Pith/arXiv arXiv 2003

  25. [25]

    M. Fang, X. Cao, J. Jia, N. Gong, Local model poisoning attacks to{Byzantine-Robust} federated learning, in: 29th USENIX security symposium (USENIX Security 20), 2020, pp. 1605–1622

    2020

  26. [26]

    A. S. Rakin, Z. He, D. Fan, Bit-flip attack: Crushing neural network with progressive bit search, in: Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019, pp. 1211–1220

    2019

  27. [27]

    F. Yao, A. S. Rakin, D. Fan,{DeepHammer}: Depleting the intelligence of deep neural networks through targeted chain of bit flips, in: 29th USENIX Security Symposium (USENIX Security 20), 2020, pp. 1463–1480

    2020

  28. [28]

    Wu, S.-T

    D. Wu, S.-T. Xia, Y. Wang, Adversarial weight perturbation helps robust generalization, Advances in neural information processing systems 33 (2020) 2958–2969

    2020

  29. [29]

    Carlini, C

    N. Carlini, C. Liu, Ú. Erlingsson, J. Kos, D. Song, The secret sharer: Evaluating and testing unintended memorization in neural networks, in: 28th USENIX security symposium (USENIX security 19), 2019, pp. 267–284

    2019

  30. [30]

    Kirchenbauer, J

    J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, T. Goldstein, A watermark for large language models, in: International conference on machine learning, PMLR, 2023, pp. 17061–17084

    2023