PaperlayerView exact revision on arXiv

Source-linked AI summary

Thermo-FL: Thermal-Aware Robust Federated Fine-Tuning of Large Language Models for Edge AI

Shiva Shrestha, Kazi Shaharair Sharif, Zongxing Xie, Jiajing Huang, Anhao Xiang, Honghui Xu

arXiv:2608.21172v1cs.LGcs.DC

TL;DR

Edge federated LLM fine-tuning must handle thermal workload constraints and adversarial sparse updates together. Thermo-FL uses temperature-controlled LoRA training and transmission with TERRA aggregation, improving adversarial robustness while preserving competitive utility across emulator and physical evaluations. The authors conclude that hardware behavior, sparse communication, and aggregation robustness should be treated as coupled design requirements.

  • Problem

    Existing edge federated LLM methods rarely treat hardware constraints and adversarial robustness as coupled requirements, despite thermal delays and corrupted updates affecting the same training process.

  • Method

    Thermo-FL regulates active LoRA layers and sparse transmission using device temperature, while TERRA filters and aggregates dynamically sparse updates with directional validation and adaptive clipping.

  • Results

    Thermo-FL improved robustness under adversarial sparse aggregation, achieved the strongest BoolQ accuracy across clean and attack settings, and remained competitive on GSM8K.

  • Takeaways & Limitations

    The results support jointly designing thermal control, sparse communication, and robust aggregation for secure edge LLM adaptation.

  • Takeaways & Limitations

    The physical testbed used only two Jetson Orin Nano clients and one laptop server, while mixed attacks were evaluated only in the emulator.

Abstract

from arXiv · show

Federated fine-tuning enables large language models to adapt on edge devices without centralizing private data, but practical deployments must address hardware instability and adversarial update corruption together. Thermally constrained clients may throttle, slow local training, or delay synchronous aggregation, while Byzantine clients and communication-layer adversaries can corrupt the updates used to form the global model. To address these challenges, we present Thermo-FL, a thermal-aware federated LoRA fine-tuning framework that uses device temperature as an active control signal for local adapter training and sparse update transmission. On the client side, Thermo-FL adjusts the active LoRA-layer fraction and transmitted update density as devices heat or cool, reducing workload under thermal stress. On the server side, Thermo-FL introduces TERRA, a robust aggregation pipeline for dynamically sparse LoRA updates that combines norm filtering, mask-aware directional validation, adaptive active-coordinate clipping, and mask-aware aggregation. We evaluate Thermo-FL using both a large-scale emulator and a Jetson-based physical testbed. In the emulator, Thermo-FL improves robustness under adversarial sparse aggregation and achieves the strongest BoolQ accuracy across clean and attack settings while remaining competitive on GSM8K. In the physical prototype, Thermo-FL stabilizes device temperature, reduces compressed upload size through bitmap sparse encoding, and preserves GSM8K utility under sign-flip/scale and MITM perturbations. These results show that secure edge LLM adaptation should jointly consider hardware behavior, workload regulation, sparse communication, and aggregation robustness.

I. INTRODUCTION

Edge federated LLM fine-tuning must jointly address constrained, thermally unstable hardware and adversarially corrupted updates. Thermo-FL couples temperature-driven client workload regulation with robust server aggregation for sparse LoRA updates.

  • Motivation: Edge devices complicate federated LLM adaptation through limited power, cooling, and runtime stability, while exposed deployments increase adversarial risk.Thermal effects can delay training and participation, whereas malicious or corrupted updates threaten aggregation.
  • Research gap: Existing approaches typically treat parameter efficiency, hardware conditions, and aggregation robustness as separate design problems.PEFT reduces trainable parameters and robust aggregation filters updates, but the methods are generally developed independently.
  • Thermo-FL: Thermo-FL uses device temperature to regulate local LoRA adaptation and sparse update transmission, reducing client workload under thermal stress.The framework increases participation when temperatures remain in safer ranges.
  • TERRA: TERRA combines magnitude filtering, directional validation, adaptive clipping, and robust aggregation to mitigate corrupted sparse updates.The design targets updates affected by Byzantine clients or communication-layer perturbations.
  • Federated LoRA: The system builds on federated optimization with private client datasets, local LoRA updates, and server redistribution of aggregated global parameters.LoRA keeps the pretrained backbone fixed while clients train adapter parameters instead of the full model.
  • System challenge: Thermal throttling can delay synchronous rounds because aggregation waits for required client updates to arrive.The resulting synchronization bottleneck couples throughput to the slowest or most constrained participating clients.

B. Threat Model

The threat model covers integrity risks from adversarial clients and communication-layer perturbations alongside thermal and sparse-update conditions. Thermo-FL uses temperature-controlled client participation and server-side processing to manage these coupled effects.

  • Threat Model: Edge federated fine-tuning faces integrity threats from unreliable links, physically exposed hardware, adversarial participants, and update corruption in transit.The paper focuses on threats to optimization stability, convergence, and downstream utility.
  • Threat Model: Byzantine clients may deviate arbitrarily from the learning objective while still participating through the communication protocol.They submit poisoned updates rather than the updates produced by the intended local training process.
  • Attack classes: The evaluation considers sign-flip attacks and mixed poisoning operators including noise injection, scaling, masking, model replacement, and ALIE-like perturbations.These operators span directional inversion, stochastic corruption, and other update transformations.
  • Assumptions: The assumptions include an honest-but-curious server, distinct client identities, bounded participant hardware properties, and truthful hardware temperature readings.Cryptographic transport protection and authentication are treated as outside the aggregation-layer defense.
  • Control loop: Thermo-FL maps measured temperature to active LoRA-layer and transmission-coordinate fractions, then sends sparse updates for server processing.The server decodes sparse payloads, applies TERRA, and updates the global LoRA parameters.

B. Client-Side Thermal-Adaptive Training and Sparse Transmission

Thermo-FL uses temperature as a client-side control signal for both LoRA training intensity and sparse transmission density. Cooler clients retain more computation and coordinates, while thermally stressed clients reduce both workloads.

  • Thermal-adaptive LoRA training: Each client measures temperature and uses it to determine the fraction of LoRA layers updated during local fine-tuning.The pretrained backbone remains frozen while the temperature-derived mask restricts adapter-layer optimization.
  • Thermal-adaptive LoRA training: Below Tlow, all LoRA layers are trained; intermediate and high thermal regions update only the last κmid or κcrit fraction.This discrete policy reduces local computation while avoiding frequent changes in the trainable layer set.
  • Sparse transmission: The keep ratio ρ(t)_k determines the fraction of post-training update coordinates retained for upload, distinct from the layer-freezing mask used during optimization.The transmission mask operates over update coordinates after local fine-tuning.
  • Sparse transmission: As temperature increases, the retained update fraction decreases; cooler clients transmit denser updates and stressed clients transmit fewer coordinates.The policy bounds the keep ratio between ρmin and ρmax.
  • Sparse transmission: Bitmap encoding preserves sparse coordinate support while serialized retained values are compressed with zlib to reduce uploaded payload size.The server decodes sparse update-mask pairs before robust aggregation.

C. Server-Side Robust Aggregation (TERRA)

TERRA is a robust aggregation pipeline for dynamically sparse LoRA updates. It screens updates by magnitude and direction, clips active coordinates, and aggregates only transmitted coordinates.

  • TERRA decodes sparse LoRA payloads while retaining each update's binary support mask for later filtering and aggregation.
  • Robust norm filtering: Norm filtering removes updates with unusually large magnitudes using round-adaptive statistics rather than a fixed global cutoff.The filter is designed to address scaling and model-replacement attacks.
  • Mask-aware directional validation: Mask-aware directional validation compares each sparse update with the recent global trajectory only on coordinates that client transmitted.This avoids treating untransmitted coordinates as explicit zeros.
  • Adaptive active-coordinate clipping: Adaptive clipping bounds active-coordinate magnitudes using a quantile computed from retained sparse updates.Because clipping uses active coordinates only, it preserves sparse support and avoids mixing missing coordinates with uploaded values.
  • Mask-aware aggregation: Mask-aware aggregation normalizes each coordinate over clients that transmitted it, then applies the aggregate update to the global LoRA parameters.The pipeline updates its reference direction for the next round using momentum.

D. Robustness Analysis

The robustness analysis frames TERRA as a sequence of complementary constraints on adversarial sparse updates. These constraints limit excessive magnitude, harmful direction, coordinate-level influence, and sparse-support distortion without guaranteeing removal of every malicious update.

  • Magnitude-bounded update influence: Round-adaptive norm filtering rejects retained updates whose norms exceed a bound derived from the median norm and median absolute deviation.This limits high-energy scaling or model-replacement updates before aggregation.
  • Directionally inconsistent updates: Mask-aware directional validation rejects updates that fail alignment with the recent accepted trajectory on their transmitted support.The analysis specifically connects low or negative alignment with sign-flipping or poisoning behavior.
  • Coordinate-level bounded influence: Adaptive active-coordinate clipping bounds the coordinate-level contribution of updates that pass the first two filters.It limits concentrated perturbations but does not certify that retained updates are honest.
  • Scope of the robustness guarantee: The analysis bounds retained adversarial influence but explicitly does not claim that every malicious update is removed.The bound depends on the clipping threshold and adversarial active aggregation weight for each coordinate.
  • Sparse-support manipulation: Mask-aware aggregation prevents missing sparse coordinates from being interpreted as explicit zeros, reducing support-manipulation distortion.Each coordinate is normalized only over clients that actually transmit it.

V. EVALUATION

The evaluation uses complementary emulator and physical-testbed environments to assess Thermo-FL under large-scale federated, sparse-communication, thermal, and adversarial conditions.

  • Thermo-FL is evaluated in both a large-scale emulator and a physical testbed to cover controlled scalability and real-device behavior.The emulator targets many clients and attack settings, while the testbed examines the end-to-end pipeline under real-world limits.
  • Table I reports final exact-match accuracy at global round 25 for Qwen2.5-0.5B, with higher accuracy preferred.

A. Large-Scale Emulator

The large-scale emulator enables repeatable evaluation of Thermo-FL across client scale, non-IID data, sparse LoRA communication, malicious updates, and temperature-aware client control.

  • The emulator supports controlled analysis of larger client populations, non-IID data, sparse LoRA communication, malicious updates, and temperature-aware client control.These conditions are difficult to reproduce physically at large scale.

1) Experimental Setup:

Thermo-FL was evaluated in a large-scale emulator and a two-client Jetson physical testbed spanning clean, sparse, and adversarial settings. Results show strongest BoolQ performance, competitive GSM8K utility, complementary TERRA stages, and prototype thermal benefits.

  • Emulator Setup: Qwen2.5-0.5B was evaluated on GSM8K and BoolQ using dense or top-k sparse LoRA aggregation under clean, sign-flip, and mixed attacks.The emulator reported final exact-match accuracy at global round 25.
  • Emulator Results: 72.32% was Thermo-FL’s BoolQ accuracy in the clean setting, with 71.16% under sign-flip attacks and 72.11% under mixed attacks.Thermo-FL achieved the strongest BoolQ performance across all three settings.
  • Emulator Results: 33.74% was Thermo-FL’s GSM8K accuracy in the clean setting, compared with 31.09% under sign-flip attacks and 31.67% under mixed attacks.Thermo-FL was competitive but not uniformly best on GSM8K, while improving over sparse FedAvg under both adversarial settings.
  • Sparse Aggregation: Top-k sparsification preserved enough update signal for downstream adaptation, although heterogeneous sparse supports made naive aggregation more fragile under attack.This motivated combining sparse transmission with mask-aware filtering and aggregation.
  • TERRA Ablation: Mask-aware aggregation alone collapsed to 2.35% under mixed GSM8K attack, whereas the full TERRA pipeline combined filtering, directional validation, clipping, and mask-aware aggregation.The stages respectively address high-magnitude, misaligned, and coordinate-concentrated adversarial updates.
  • Physical Testbed: The two-client physical testbed validated end-to-end hardware behavior, thermal regulation, compressed payload construction, and representative attack response rather than large-scale robustness.The prototype used Qwen2.5-0.5B with LoRA under 8-bit quantization on GSM8K.

2) Results and Analysis:

Thermo-FL couples temperature-aware client control with robust sparse-update aggregation for physical edge LLM fine-tuning. On the Jetson testbed, it stabilized hardware behavior, reduced practical communication cost, and preserved task utility under representative attacks, although physical validation remained small and attack coverage limited.

  • Thermal behavior: Across 200 communication rounds, Thermo-FL kept GPU temperature near 49-51◦C by reducing workload and update density as devices heated.The controller relaxed these constraints when the device cooled, using temperature as a feedback signal rather than telemetry alone.
  • Thermal behavior: Thermo-FL stabilized near 50◦C versus FedAvg-LoRA’s early spike near 60◦C and later operation around 54-55◦C, while reducing power and latency variation.Figure 4 further reports lower median latency and a tighter latency distribution, indicating fewer thermally induced straggler effects.
  • Communication overhead: 0.42MB was the smallest practical compressed payload among deployable sparse formats, achieved by bitmap encoding.Flat-delta reached 0.45MB, while values-only reached 0.27MB only as an ideal lower bound because support metadata was treated as free.
  • Robustness under physical attacks: Under Byzantine scaling with γ = −10 and MITM noise injection, the full Thermo-FL pipeline remained stable while configurations without TERRA became unstable or degraded.TERRA constrained corrupted updates through norm filtering, directional validation, and adaptive clipping in the small-client physical setting.
  • Downstream task utility: 21.40% GSM8K accuracy under signflip/scale and 18.65% under MITM perturbation were preserved by full Thermo-FL, whereas FedAvg-LoRA collapsed to 0.00%.In the clean setting, Thermo-FL achieved 24.64% versus FedAvg-LoRA at 23.28%; Thermo-FL without TERRA failed under both attacks.
  • Limitations: The physical testbed used two Jetson Orin Nano clients and one laptop server, while mixed attacks were simulated only in the emulator.The fixed temperature thresholds and hardware-specific κ and ρ parameters were appropriate for the prototype but may require calibration on other devices.

APPENDIX

The appendix analyzes Thermo-FL through a faithful abstraction rather than proving unconditional convergence for the exact data-dependent TERRA implementation. Its assumptions cover smoothness, stochastic gradients, thermal control, sparsification, TERRA alignment, and bounded second moments.

  • Analysis scope: The convergence analysis abstracts the implemented TERRA aggregate because accepted clients, clipping thresholds, and coordinate supports vary by round.The appendix explicitly treats the result as an optimization rationale, not unconditional convergence under arbitrary Byzantine behavior.
  • Optimization model: The weighted federated objective assigns each client k a local empirical risk Fk.At round t, selected clients compute stochastic gradients before applying temperature-driven top-k sparsification to form sparse LoRA deltas.
  • Assumptions: The assumptions require L-smoothness, unbiased stochastic gradients with bounded variance, bounded thermal-control ratios, bounded layer-freezing bias, and nontrivial top-k update energy.These conditions formalize the effects of thermal projection and sparsification in the convergence abstraction.
  • TERRA abstraction: Abstract TERRA alignment uses constants αT and εT to represent preserved descent alignment and residual bias from filtering, clipping, and surviving adversarial contamination.A separate second-moment condition uses CT and νT to capture variance-like contributions from the TERRA operator and surviving adversarial components.

C. Bounded Influence of the Implemented TERRA Stages

The implemented TERRA stages provide bounded-influence behavior that supports the appendix’s abstract alignment and moment assumptions. They limit, rather than guarantee removal of, adversarial sparse-update influence.

  • Norm filtering: Norm filtering rejects sparse-delta updates whose norm exceeds the round-adaptive threshold Bt = m(t)s +λnorm MAD(t).This targets scaling or model-replacement updates with unusually large magnitude.
  • Directional validation: Mask-aware directional validation rejects updates whose support-restricted cosine alignment with reference direction r(t) falls below τdir.Sign-flipped updates are rejected when their transmitted-support cosine score falls below the threshold.
  • Clipping and aggregation: Adaptive clipping bounds every update that survives filtering, while mask-aware aggregation bounds each retained adversarial client’s coordinate-wise contribution.The resulting bounds support the residual terms εT and νT in the abstract convergence analysis.
  • Scope: TERRA does not prove that every malicious update is removed; retained adversarial influence remains bounded by clipping and adversarial active aggregation weight.This is the implementation-level rationale for treating residual contamination as bounded rather than absent.

D. Convergence Result

Under the stated smoothness, stochastic-gradient, thermal-control, sparsification, and abstract TERRA conditions, Thermo-FL satisfies a nonconvex stationary-point bound. The resulting neighborhood reflects optimization noise, thermal adaptation, sparsification, and residual robust-aggregation effects.

  • Theorem: Under the theorem’s assumptions and stepsize condition, Thermo-FL’s iterates satisfy the stated stationary-point bound.The proof applies smoothness, the update rule, alignment and second-moment assumptions, telescoping, and a lower bound on the objective.
  • Bound interpretation: The bound’s first term decays as O(1/T), while its other terms represent stochastic-gradient variance, thermal and TERRA bias, and TERRA second-moment contributions.Together, these terms define a stationary neighborhood whose radius depends on the listed effects.
  • Scope: The theorem is conditional rather than an unconditional convergence proof for arbitrary attacks.It requires sufficient alignment with the global descent direction and a bounded aggregate second moment.
Loading 2608.21172v1…