Safe-FCL: Continual Risk Awareness and Fine-Grained Safety Aggregation for Federated Continual Learning of LLMs

1 Introduction

• Federated fine-tuning lets LLMs learn collaboratively from distributed client data without centralizing raw training data, but malicious updates may compromise global-model safety.The introduction frames Safe-FCL as a defense for this setting.Source: §1 · pp. 1–2
• Malicious update patterns may evolve as tasks progress, so defenses must address current threats while maintaining long-term effectiveness across sequential tasks.Continual adaptation may also cause forgetting of previously learned risks.Source: §1 · pp. 1–2
• Existing defenses do not explicitly address evolving malicious update patterns across sequential tasks, and client-level risk weighting lacks targeted control over suspicious updates across model modules.Fixed detectors may miss emerging threats, while continual adaptation can forget previously learned risks.Source: §1 · pp. 1–2
• Safe-FCL is designed to mitigate long-term safety challenges from evolving malicious updates by combining cross-task risk awareness with safety-aware aggregation.The framework targets federated continual learning of LLMs.Source: §1 · p. 2
• CRA learns emerging malicious update patterns across tasks and uses historical protective subspaces to mitigate forgetting of previously learned risks.FGSA combines client-level risk assessments with historical module-level deviations to regulate aggregation contributions through risk-aware gating.Source: §1 · p. 2
• Safe-FCL improves global-model Rule and MD-Judge scores by 0.41% and 0.64%, respectively, and average risk recognition accuracy by 2.01%.The evaluation spans sequential safety tasks and an unseen OOD task.Source: §1 · p. 2

2.1 Federated Continual Learning

• Federated continual learning methods address heterogeneity and update conflicts through knowledge transfer, distillation, feature anchoring, gradient correction, and multi-expert collaboration.Recent LLM work explores federated continual instruction tuning and conflict-aware layer selection, while long-term safety against evolving malicious updates remains insufficiently explored.Source: §2.1 · p. 2

2.2 Safety Defenses for Federated LLMs

• Federated-learning defenses include robust aggregation, trust-based weighting, anomaly filtering, and layer-adaptive filtering; Safe-FedLLM uses LoRA features for risk-aware aggregation.These approaches address malicious client updates in federated learning and federated LLM fine-tuning.Source: §2.2 · p. 2
• Adapting to emerging threats while retaining historical risk recognition remains a key challenge as task distributions and malicious update patterns evolve.This is the long-term safety challenge identified for federated LLM defenses.Source: §2.2 · p. 3

3.1 Problem Setup and Framework Overview

• The server aggregates updates from participating clients across sequential, potentially heterogeneous tasks without access to raw client data or true malicious identities.Its safety decisions therefore rely on observable model updates.Source: §3.1 · p. 3

3.2 Continual Risk Awareness

• CRA learns emerging malicious-update patterns while using historical protective subspaces to constrain detector changes and mitigate forgetting of previously learned risks.It extracts risk features from cumulative changes in selected LoRA parameters and builds protection bases from historical detector input features.Source: §3.2 · p. 3
• CRA scores update features across T local batches, converts the suspicious-update proportion into a client safety score, and supplies that signal to later aggregation decisions.Higher safety scores indicate lower detected risk; the detector remains fixed during the corresponding federated training rounds.Source: §3.2 · p. 4

3.3 Fine-Grained Safety Aggregation

• FGSA combines CRA-derived client safety with module-level deviations from historical behavior to regulate each module’s aggregation contribution.It compares update magnitude and direction with historical module behavior, and gates more strongly when detected client risk and substantial deviation coincide.Source: §3.3 · pp. 4–5
• FGSA updates historical module statistics using eligible observations with high safety scores, small deviations, and limited gating suppression; it can skip aggregation when average client safety falls below a threshold.The statistics are inherited across tasks to provide references for later deviation assessment.Source: §3.3 · pp. 4–5

4.1 Experimental Setup

• The setup uses five safety-related tasks, 5,000 training samples per task, and two protocols for sequential learning and unseen-domain evaluation.Protocol 1 evaluates learned tasks after each stage; Protocol 2 fixes detector parameters while global-model fine-tuning and FGSA statistics updates continue on the unseen task.Source: §4.1 · pp. 5–6

4.2 Safety Performance in Federated Continual Learning

• Safe-FCL achieves the highest average Rule and MD-Judge scores across learned tasks compared with the evaluated methods.The evaluation follows the same task order and federated training settings for all methods.Source: Table 2 · p. 6, §4.2 · p. 7

4.3 Continual Risk Recognition Performance

• Safe-FCL has the highest Average Accuracy across learning stages, improving final AA by 2.01 and New ACC by 7.11 percentage points over the current SOTA method.On the OOD task, it reaches 96.60% accuracy, 4.93 percentage points above the strongest baseline.Source: §4.3 · pp. 7–8, Table 3 · p. 7

4.4 OOD Generalization of Global-Model Safety

• On the unseen task, Safe-FCL outperforms current SOTA methods by 2.33% in Rule and 0.47% in MD-Judge.CRA assesses clients without additional detector training; FGSA selectively suppresses suspicious module updates and updates historical statistics using eligible observations.Source: Figure 3 · p. 7, §4.4 · p. 8

4.5 Ablation Study

• Compared with the variant without CRA, full Safe-FCL raises final Rule by 0.70 and MD-Judge by 0.29 percentage points.Table 4 reports safety scores for Tasks 1–4 and OOD with the detector fixed; FGSA has noticeable improvements after the third task, but its final-stage effects are not uniformly positive across metrics.Source: Table 4 · p. 7, §4.5 · p. 8
• Against the variant without CRA, Safe-FCL improves final AA by 2.12 and reduces AF by 1.51 percentage points; New ACC and OOD Task ACC also improve.The paper attributes reduced interference with historical risk knowledge to CRA and distinguishes its stable-recognition role from FGSA’s selective control of federated updates.Source: Table 3 · p. 7, §4.5 · p. 8

• Safe-FCL integrates CRA, which preserves historical risk knowledge while adapting to emerging threats, with FGSA’s module-level safety control.Source: §5 · p. 8
• Safe-FCL improves global-model Rule by 0.41% and MD-Judge by 0.64% compared with state-of-the-art methods.Source: §5 · p. 8
• Safe-FCL increases average risk-recognition accuracy by 2.01% and OOD accuracy by 4.93%.Source: §5 · p. 8

• The evaluation covers text-based federated continual learning under controlled malicious-client settings; multimodal and more complex adversarial scenarios remain unexplored.Source: Limitations · p. 9
• Effectiveness against adaptive attacks and coordinated malicious clients has not been evaluated.Source: Limitations · p. 9
• More clients and tasks may increase evaluation-branch optimization, detector adaptation, and historical feature-retention costs in computation and storage.Source: Limitations · p. 9

A.1 Source Datasets

• The data snapshot contains 49,765 QA pairs selected from 34 upstream repositories, grouped into 29 entries for presentation.Source: §A.1 · p. 12

A.2 Selection and Task Construction

• The dataset spans five safety domains and four partitions, with retained samples allocated to LLM training, validation, testing, and auxiliary trajectory collection.The counts are 25,000, 3,570, 7,145, and 14,050, respectively; they reflect retained samples rather than original source-dataset sizes.Source: §A.2 · p. 12
• Safety domains are assigned after grouping related question families, and types A and B form the benign training pool while type C forms the malicious pool.In the controlled threat setting, malicious-client identities label detector training examples but are not given to the server during aggregation; CRA’s update-space observations use distinct benign and malicious LoRA trajectories, while aggregation relies on predicted risks.Source: §A.2 · p. 12, §B.1 · p. 12

B.2 Evaluation Metrics

• Average Accuracy tracks risk-detector classification accuracy on task Tj after adapting to Tk for j ≤ k; Average Forgetting retains signed changes from protocol reference accuracy, with positive values indicating degradation.Negative Average Forgetting values indicate improvement relative to the reference.Source: §B.2 · p. 12
• New ACC averages accuracy immediately after each new task; OOD Task ACC uses a detector frozen after the final stage, while OOD global-model safety is measured after federated fine-tuning.Global-model Rule and MD-Judge scores are averaged across learned tasks at each stage.Source: §B.2 · p. 12
• The task domains use 5,000 training, 714 validation, and 1,429 test examples each, with a 7:3 benign-to-harmful ratio; the data snapshot contains 49,765 QA pairs from 34 repositories.The repositories span five domains and four partitions.Source: Table 6 · p. 13, Table 5 · p. 13

C Supplementary Results and Analysis

• The supplementary experiments evaluate detailed per-task ablations under the primary task order and safety, component ablations, risk recognition, and OOD generalization under an alternative order.The alternative sequence places digital security first and physical, public, and material safety fourth, with discrimination and interpersonal harm held out.Source: C Supplementary Results and Analysis · p. 13

C.1 Per-Task Ablation Analysis of CRA and FGSA

• After Task 4, Safe-FCL beats the variant without CRA by 2.80% in Rule and 1.40% in MD-Judge on previously learned Task 3, while FGSA gains vary by task.FGSA improves Task 3 by 1.86% in Rule and 0.70% in MD-Judge, but its Task 4 Rule score is lower than the variant without FGSA.Source: §C.1 · p. 14

C.2 Safety Performance under an Alternative Task Sequence

• 88.11% Rule and 91.43% MD-Judge after continual learning exceed current SOTA by 2.38% and 1.04%; on new Task 4, margins are 6.52% and 1.16%.Safe-FCL also attains the highest average Rule scores across all four learning stages and best or tied-best MD-Judge scores at each stage.Source: §C.2 · p. 14

C.3 Component Ablation under the Alternative Task Sequence

• After Task 4, removing CRA lowers average Rule and MD-Judge by 1.92% and 1.16%; on previously learned Task 1, the gaps are 2.33% and 1.17%.FGSA improves average Rule and MD-Judge after Task 3 by 0.38% and 0.70%, with gains on new Task 3 of 2.33% and 1.17%.Source: §C.3 · p. 14
• FGSA's gains are task-dependent: its average-score improvements after Task 3 do not imply uniform gains across individual tasks.The reported Task 3 gains are larger on the newly introduced task than in the stage average.Source: §C.3 · p. 14
• On OOD safety evaluation, Safe-FCL scores 93.94% Rule and 98.14% MD-Judge, exceeding the variant without FGSA by 5.60% on both metrics.The authors note that these results indicate benefits from combining continual risk awareness with module-level safety regulation, particularly for an unseen domain.Source: §C.3 · p. 14

C.4 Continual Risk Recognition under an Alternative Task Sequence

• After Task 4, Safe-FCL achieves 99.64% AA and −0.01% AF, improving AA by 8.05% and reducing AF by 10.56% versus current SOTA methods.It also exceeds the variant without CRA by 0.28% in final-stage AA and reduces AF by 0.28%.Source: §C.4 · p. 14
• On the held-out OOD task, Safe-FCL achieves 95.87% detection accuracy, exceeding current SOTA methods by 1.47% and the variant without CRA by 5.94%.The detector is frozen during OOD evaluation, so it receives no additional detector adaptation.Source: §C.4 · p. 14

C.5 OOD Global-Model Safety under an Alternative Task Sequence

• Table 9 covers global-model safety ablations under the alternative task sequence, including OOD evaluation.Table 8 reports global-model Rule and MD-Judge results under that sequence.Source: Table 8 · p. 15, Table 9 · p. 16
• 93.94% Rule and 98.14% MD-Judge on the held-out OOD task match the best Rule score among baselines and improve MD-Judge by 0.24 percentage points over Safe-FedLLM-Shadow.The corresponding gains over Safe-FedLLM-Step are 2.33 and 2.34 percentage points.Source: Figure 4 · p. 14, §C.5 · p. 16
• The reported primary- and alternative-sequence findings support strong global-model safety under both evaluated task orders during adaptation to the held-out domain.Figure 4 reports OOD generalization with Rule and MD-Judge values expressed as percentages.Source: Figure 4 · p. 14, §C.5 · p. 16