AntidoteML

Inspiration

Everyone trying to make AI models safer looks at the model. We wanted to look at how it's trained. In distributed and federated learning, many machines train one shared model without pooling their data. Hospitals do it, banks do it, and your phone does it every day. The catch is that the coordinator averages everyone's updates and trusts all of them equally. We kept coming back to one question: what happens when one of those machines is lying? We found that a single compromised machine can hide a backdoor in the shared model that normal testing never sees, and almost no hackathon project defends the training process itself. So we built the defense.

What it does

AntidoteML is a security layer for distributed ML training. Ten machines train one traffic-sign classifier together. One of them is compromised: it stamps a small yellow square on some of its images, relabels them "speed limit 80," and sends its poisoned update along with everyone else's. The shared model quietly learns a hidden rule: yellow square means speed limit 80. The model still scores 94% on normal images, so nothing looks wrong, but put a sticker on a stop sign and it reads it as a speed limit.

AntidoteML scores every update before it reaches the model. It blocks the poisoned ones, identifies exactly which machine sent them, explains why in plain English, and ejects it. The same detector also catches a faulty GPU that sends garbage, no attacker required.

The result, measured over 40 rounds:

| Run | Clean accuracy | Attack success | | No attack | 0.943 | 0.011 | | Attack, defense OFF | 0.939 | 0.996 | | Attack, defense ON | 0.942 | 0.012 |

With no defense, the backdoored model loses only 0.4 points of accuracy while being hijacked 99.6% of the time. Clean accuracy alone would never catch it. With AntidoteML on, the run is statistically identical to one with no attacker at all, and the guilty machine is named and removed.

How we built it

Every machine's update is one flat vector of 629,291 numbers. Picture it as an arrow with a length and a direction. Honest machines train on similar data, so their arrows come out about the same length, pointing about the same way. The attacker's arrow is longer and points elsewhere.

Each round, before averaging, we compute two things for every update: how large it is compared to the group, and how well it agrees with the group's direction. We turn those into robust z-scores measured against the median of the group, not the average, so one machine sending a giant update can't drag the reference toward itself and hide. A machine that scores too high gets flagged. Three flags in five rounds and it's ejected for good. Anything that slips past is still blunted by a trimmed-mean aggregator. The whole system is built in PyTorch on the GTSRB traffic-sign dataset, with a coordinator, worker pool, and full run logging.

Critically, the defense never sees who the attacker is. It receives