TAR-DT: A Trusted and Attack-Resilient Mechanism for Distributed DNN Training in Agentic Edge Intelligence ^†

Abstract

As deep neural networks continue to scale and enable emerging applications such as agentic AI systems, training increasingly relies on distributed paradigms across heterogeneous edge devices. However, this shift introduces significant security challenges, particularly model poisoning attacks, which are largely underexplored in model-parallel settings. To address these challenges, we propose a trusted and attack-resilient mechanism for distributed DNN training that supports both data and model parallelism. The mechanism leverages a blockchain-enabled infrastructure to ensure the tamper-resistant and auditable execution of security-critical operations. It introduces a Loss-aware Credit Evaluation mechanism to assess agent reliability based on group-level training dynamics and a Shuffling-based Isolation Mechanism to progressively cluster and isolate malicious agents across training epochs. In addition, Byzantine-tolerant aggregation (BTA) is employed to further mitigate adversarial influence during model aggregation. Extensive experiments demonstrate that the proposed mechanism achieves superior robustness and efficiency compared with state-of-the-art methods under diverse poisoning attack scenarios.

1. Introduction

The emergence of large-scale deep neural networks (DNNs) has significantly accelerated the development of artificial intelligence across domains such as large language models (LLMs), multimodal systems, and autonomous AI agents. Contemporary foundation models, exemplified by transformer-based large language models and diffusion-based generative architectures, scale traditional DNN designs to unprecedented depths, widths, and parameter counts [1].

While the rapid expansion of model scale has delivered remarkable performance gains, it also imposes substantial pressure on computation, memory, energy consumption, and communication bandwidth. Under stringent constraints on latency, cost, bandwidth, and data locality, relying solely on centralized datacenters for training and updating large-scale DNNs is becoming increasingly impractical. Consequently, growing attention has shifted toward distributed DNN training [2,3,4,5,6,7,8]. This shift is further reinforced by emerging agentic edge intelligence [9,10], in which edge nodes evolve into autonomous agents with sensing, reasoning, decision-making, and collaboration capabilities. Through continual interaction with local environments and peer agents, these distributed agents provide a natural foundation for collaborative learning. In such systems, heterogeneous edge agents, including connected vehicles, embodied terminals, unmanned aerial vehicles, and satellites, jointly participate in the training process. To accommodate the resulting workload, distributed training is typically organized through data parallelism or model parallelism [11]. The former partitions data across agents for independent local training, whereas the latter partitions the DNN across multiple agents for pipeline-style execution. Such a hybrid parallel paradigm is particularly important for agent-centric edge intelligence, where both model scale and the heterogeneity of distributed tasks exceed the capability of any individual node.

However, the distributed nature of DNN training, particularly in edge intelligence scenarios, introduces notable security vulnerabilities, especially model poisoning attacks [12,13]. These attacks occur when malicious agents attempt to compromise the global model by transmitting manipulated model updates. To counter these threats, a variety of defense mechanisms have been proposed, predominantly focusing on Byzantine-robust methods [14,15,16,17,18]. These methods employ statistical techniques to ensure the global model’s accuracy while tolerating a certain number of malicious agents (also referred to as attackers). Other methods require specific preconditions, such as an honest server capable of training on a clean validation dataset [19]. However, these approaches primarily mitigate the impact of attackers rather than efficiently detecting malicious agents. Other defensive strategies, such as Fine-Pruning [20], are tailored to specific attack types and therefore lack generalizability. More importantly, their applicability is largely restricted to data-parallel scenarios. This limitation is particularly problematic in model-parallel setups, where a single malicious agent can significantly affect the performance of all honest agents within a group. Consequently, these conventional defense mechanisms prove inadequate in model-parallel environments, underscoring the need for more versatile and robust security solutions in distributed DNN training.

Beyond algorithmic challenges, an often-overlooked yet fundamental issue lies in the trust assumptions underlying distributed training. Most existing defenses [11] implicitly rely on a fully trusted central coordinator to evaluate losses, update reputations, identify attackers, and orchestrate aggregation. In realistic edge environments spanning multiple administrative domains, such a strong trust assumption is difficult to justify. If the coordinator itself is compromised or behaves maliciously, attacker identification results and isolation decisions can be arbitrarily manipulated, rendering even sophisticated defense algorithms ineffective. Therefore, securing distributed DNN training requires not only robust learning algorithms but also a verifiable and tamper-resistant system foundation.

To address these challenges, we propose TAR-DT, a trusted and attack-resilient mechanism for distributed DNN training in agentic edge intelligence environments. TAR-DT jointly supports data and model parallelism and introduces the Loss-aware Credit Evaluation (LACE) mechanism to assess agent trustworthiness based on group-level training dynamics. Through credit-guided shuffling and isolation, suspicious agents are progressively separated while sufficient randomness is preserved to prevent strategic evasion; Byzantine-tolerant aggregation (BTA) further mitigates residual adversarial influence. Crucially, TAR-DT embeds these security-critical processes into a permissioned blockchain, where losses, credit updates, shuffling decisions, and aggregation outcomes are executed and recorded via smart contracts, thereby making these state transitions tamper-resistant and auditable while reducing dependence on a fully trusted coordinator for security-critical decisions. Part of the algorithmic foundation of this work was presented in our previous conference paper [21], which introduced the Patronus defense framework, including loss-aware credit evaluation, shuffling-based isolation, and Byzantine-tolerant aggregation for poisoning mitigation in edge distributed DNN training. The present manuscript substantially extends that work by embedding these defense mechanisms into a blockchain-enabled trusted collaborative-agent architecture, introducing smart contract-supported execution and recording of security-critical operations, clarifying the trust boundary between the master agent and the blockchain layer, and providing additional system-level analysis for verifiable and auditable deployment.

In summary, TAR-DT transforms poisoning defense into a verifiable, decentralized, and system-level security framework for edge-distributed DNN training. The main contributions of this work are summarized as follows:

• We propose TAR-DT, a blockchain-enabled distributed DNN training framework that seamlessly integrates data and model parallelism with verifiable poisoning defenses, ensuring both efficiency and security in heterogeneous edge environments.
• We design the Loss-aware Credit Evaluation and Shuffling-based Isolation Mechanism, enabling effective identification and isolation of malicious agents, particularly in model-parallel training scenarios.
• We leverage smart contracts and Byzantine-tolerant aggregation to provide tamper-resistant and auditable security-critical state transitions, thereby reducing the reliance on a fully trusted coordinator for loss recording, credit updating, grouping decisions, and aggregation commitments.
• Extensive experiments demonstrate that TAR-DT significantly outperforms state-of-the-art methods under diverse poisoning attack settings while maintaining practical training efficiency.

The rest of this paper is organized as follows. Section 1 introduces the preliminaries and reviews related work. Section 2 presents the system model, attack model, and blockchain-based reputation mechanism of TAR-DT. Section 3 describes the proposed attack-resilient agent management and model aggregation, including loss-aware credit evaluation, shuffling-based isolation, Byzantine-tolerant aggregation, and theoretical analysis. Section 4 provides the experimental setup and evaluation results. Section 5 concludes the paper.

2. Preliminaries and Related Work

2.1. Distributed Machine Learning

2.1.1. Data and Model Parallelism

Growing computational and memory demands make distributed training a promising approach for training DNN models. In data parallelism, the parameter server partitions the dataset and distributes the resulting subsets among a set of agents. Federated learning is a representative data-parallel paradigm [22,23,24]. During each training task, every agent retrieves the initial model from the server and trains it on the corresponding local data. The server collects the local results from all agents and aggregates them to obtain an updated global model. This process is repeated iteratively. However, data parallelism requires each device to store and train the complete model, which is impractical for large neural networks. In contrast, model parallelism originates from the structure of the neural network. It assigns the computations of different neural network layers, including forward and backward propagation, to separate agents. Google proposed GPipe [7], and Microsoft subsequently introduced PipeDream [8].

2.1.2. Edge Distributed DNN Training

To improve the efficiency of DNN training in edge environments, existing studies have extended the aforementioned distributed training methods to edge networks [25,26]. Qu et al. [27] proposed Partial Synchronization Parallelism (PSP) for model-parallel training. By concurrently transmitting and aggregating both the model and its gradient at intermediate relay nodes, this methodology effectively diminishes network bandwidth consumption. PipeEdge [28] improved the efficiency of data- and model-parallel training among edge servers through a blockchain-based incentive mechanism. However, those works have primarily focused on enhancing the training speed, overlooking the security issues in edge computing scenarios. More specifically, they have neglected the trustworthiness of computational devices.

2.2. Model Poisoning Attack

2.2.1. Attack Method

Model poisoning attacks refer to introducing adversarial alterations directly into a global model, aiming to manipulate or degrade its performance. This often occurs during the model training phase. Model poisoning attacks involve deliberately modifying a machine learning model’s internal parameters to undermine its integrity and functionality. Model poisoning attacks are generally categorized as untargeted or targeted attacks. In untargeted model poisoning [13], attackers manipulate the parameters of the model without a specific target. Their main objective is to degrade the accuracy of the global model across all inputs. In contrast, a targeted model poisoning attack [29] aims to reduce accuracy on designated test inputs and therefore requires a deeper understanding of the model architecture.

2.2.2. Defense Method

Defenses against model poisoning attacks in distributed DNN training primarily rely on Byzantine fault tolerance. These methods assume that most participants are reliable and use this majority to mitigate malicious behavior, thereby preserving the accuracy of the final model. Other schemes are tailored to specific attacks. For example, Fine-Pruning [20] integrates pruning with fine-tuning and can substantially reduce the success rate of backdoor attacks under certain conditions. However, these solutions are less effective in model-parallel settings because an attacker’s behavior can influence downstream agents during forward computation and upstream agents during gradient backpropagation. Consequently, the computational results of the entire group are affected, making it difficult to identify individual attackers accurately. Recent work, such as [30], has attempted to address model parallelism, but this approach requires a pretraining phase with reliable agents to establish a reference benchmark.

2.3. Blockchain for Incentives and Trust in Distributed Systems

Recent studies have shown that blockchain can provide a practical trust foundation for distributed learning systems by replacing opaque centralized coordination with auditable transactions, decentralized consensus, and smart contract-based execution. In blockchain-based distributed learning, model updates, contribution records, reputation scores, and reward allocation can be recorded on-chain, which helps mitigate single points of failure, malicious manipulation, and unfair incentive distribution [31,32,33,34].

Incentive mechanisms are a major research direction. Tang et al. designed a blockchain-empowered incentive mechanism for cross-silo federated learning, where smart contracts are used to evaluate organizational contributions and distribute rewards in a transparent manner [31]. Ying et al. proposed BIT-FL, which combines blockchain, sharded consensus, randomized incentives, and privacy-preserving perturbation to improve the efficiency and security of federated learning [32]. More recently, Tang et al. formulated blockchain-based federated learning as a two-tier Stackelberg game among the model owner, miners, and training terminals, enabling dynamic pricing and reward strategies under decentralized market conditions [35]. These works demonstrate that blockchain can effectively motivate rational participants and reduce dependence on a trusted server.

Another line of work focuses on reputation and verifiability. An et al. proposed FREB, a federated reputation evaluation blockchain that selects reliable FL participants based on reputation records while using blockchain to ensure transparent task execution [34]. Chen et al. proposed LiteChain, a lightweight blockchain architecture for verifiable and scalable federated learning in massive edge networks, reducing blockchain overhead while preserving auditability [33]. Ying et al. further introduced IMFLKD, which combines smart contract-based contribution evaluation with a multi-dimensional dynamic reputation model for decentralized knowledge distillation-based federated learning [36]. These studies confirm that blockchain is suitable for maintaining long-term trust records and verifying learning-related operations in distributed environments.

3. TAR-DT

3.1. System Model

Figure 1 illustrates the overall architecture of TAR-DT in a blockchain-enabled agentic edge intelligence environment. The system consists of a master agent, a set of heterogeneous edge agents, and a permissioned blockchain that serves as a verifiable coordination and execution layer. The master agent is responsible for task orchestration and model scheduling, while the blockchain provides tamper-resistant execution and recording of security-critical operations. Agent registration, task publication, and incentive management are handled through the blockchain following standard procedures consistent with our prior work [37].

When a computing task arises, the master agent publishes the task description and reward information on the blockchain and selects N edge agents based on the computing capabilities and reputations of the registered edge devices. The master agent then partitions the N selected edge agents into several groups to collaboratively train a global model $\mathcal{M}$. The model $\mathcal{M}$ consists of L sequential layers, where each layer $L_i$ contains a set of parameters $W_i$ and a forward computation function $F_i$.

To accelerate training, data parallelism is employed across groups, while model parallelism is employed within each group. The master agent divides the entire dataset D into $G\times Q$ portions to support data-parallel training across G groups. Each group performs Q training iterations, which constitute one epoch. Concurrently, the master agent divides $\mathcal{M}$ into K cells, where each cell k consists of successive neural network layers from i to j, denoted by ${\mathbb{L}}_k=\{L_i,L_{i+1},\dots ,L_j\}$. Each cell is then assigned to an agent for model-parallel training. The model partitioning method follows [38] and satisfies $N=G\times K$, ensuring that the number of selected agents equals the total number of model cells across all groups. For cell k, the parameter set is ${\mathbb{W}}_k=\{W_i,W_{i+1},\dots ,W_j\}$, and the composite forward function is ${\mathbb{F}}_k=F_i\circ F_{i+1}\circ \dots \circ F_j$, with the output denoted by $a_k={\mathbb{F}}_k\left(a_{k-1}\right)$. The gradient is $gra{d}_k=\nabla loss(D,{\mathbb{W}}_k)$. Furthermore, let ${\mathcal{G}}^t$ denote the set of all groups in time slot t, where each time slot corresponds to one epoch. TAR-DT then proceeds as follows:

• The master agent uploads the initial model parameters to the blockchain, groups the available agents, and assigns one cell to each agent. Following the deployment-oriented perspective in [39], we explicitly identify the entities involved in model transmission and verification. Each agent retrieves the corresponding model parameters according to the information recorded on the blockchain. For large models, the parameter data can be stored and transmitted through IPFS, while only the corresponding CIDs and cryptographic digests are recorded on-chain for integrity verification.
• The training process begins. Each group of K agents collaboratively trains a group model denoted by ${\mathcal{M}}_g$. The loss sequence of group g is ${\mathcal{L}}_g={\{l_1,l_2,...,l_Q\}}_g$, where $l_q$ denotes the loss value in the q-th iteration.
• Upon completing one epoch, ${\mathcal{L}}_g$ and ${\mathcal{M}}_g$ are packaged into a transaction and uploaded to the blockchain.
• The master agent retrieves the loss records $\{{\mathcal{L}}_1,{\mathcal{L}}_2,...,{\mathcal{L}}_G\}$ from the blockchain and invokes the Loss-aware Credit Evaluation (LACE) smart contract to evaluate the performance of each group and update the agents’ credits (Section 4.1).
• Subsequently, the BTA smart contract aggregates the group models ${\mathcal{M}}_g$ to obtain the updated global model (Section 4.3).
• Simultaneously, the master agent invokes the Shuffling-based Isolation Mechanism (SBIM) smart contract to regroup the agents for the next training epoch (Section 4.2).
  These six steps are repeated until training is complete.

3.2. Attack Model

An attacker can launch a model poisoning attack against $\mathcal{M}$ by compromising a computational agent. Because each agent is responsible for a fixed model cell, the attacker knows the learning rate, the initial parameters of the assigned cell, the output $a_{k-1}$ of the preceding cell, and the gradient $gra{d}_{k+1}$ received from the subsequent cell during backpropagation. Unlike in conventional settings, however, the attacker controls only the output and gradient of a specific model cell, limiting the attack surface to $a_k$ and $gra{d}_k$. This constraint distinguishes the considered setting from conventional model poisoning scenarios, for which model-parallel attacks remain underexplored.

We next analyze model poisoning attacks based on the two attack categories introduced above. For untargeted poisoning attacks, the attacker aims to slow down the model’s convergence rate and decrease its accuracy. This objective can be achieved by tampering with the output value or gradient. Three representative attack methods are considered: (1) introducing a perturbation [40]; (2) reversing the gradient update [13]; and (3) randomizing the output value. With respect to targeted poisoning attacks, as previously mentioned, the vast majority of such attacks involve data manipulation, and update manipulation methods require perfect knowledge of the entire DNN model. Since the attacker in model parallelism only has access to specific cell input data and backpropagation gradient information, executing a targeted poisoning attack becomes virtually infeasible. Thus, our attack model focuses solely on untargeted poisoning attacks.

3.3. Reputation Mechanism Based on Blockchain

In edge distributed computing environments, effective trust mechanisms are essential for maintaining the integrity and efficiency of collaborative computation. Given the heterogeneous reliability of nodes in such networks, the system must reliably assess and establish trust among participants.

To address this issue, we deploy a blockchain across these nodes. It provides an immutable ledger for recording critical data, including computational records and credit histories. This storage approach ensures transparency and verifiability throughout the process, thereby enhancing the integrity and trustworthiness of the entire edge-distributed system. Moreover, key processes, such as credit updating and attacker clustering, are implemented through smart contracts. This integration ensures that all critical operations are conducted consistently and accurately, in line with the predefined rules, thereby enhancing the efficiency and reliability of the system. The specific procedures are described in the following section.

It should be noted that although the permissioned blockchain provides transparency and verifiability, accessible loss records, agent identities, and credit histories may still disclose sensitive information or enable inference attacks. TAR-DT limits such exposure through role-based ledger access and off-chain storage of model parameters, while only necessary metadata, CIDs, and cryptographic digests are recorded on-chain. Nevertheless, authorized participants may still infer information from accessible records; integrating stronger privacy-preserving techniques, such as pseudonymization, encryption, differential privacy, or secure computation, remains future work.

4. Attack-Resilient Agent Management and Model Aggregation

4.1. Loss-Aware Credit Evaluation

4.1.1. Preliminary Experiment

Few studies have examined the strategies adopted by malicious agents in model-parallel training and their effects on model loss. Therefore, we conduct preliminary experiments using the three representative attack strategies described in the previous section. The resulting loss values are shown in Figure 2.

The results show that the model loss can still converge during training under poisoning attacks. Nevertheless, convergence alone does not indicate that the resulting model is reliable. Two key observations can be made: (1) Compared with the clean model, the poisoned model exhibits a higher mean loss after convergence. (2) The poisoned model also exhibits a larger loss variance, indicating greater instability during training. These observations characterize the loss behavior under malicious interference and motivate the development of stronger defenses against such attacks. Accordingly, we propose Loss-aware Credit Evaluation, which comprises two phases: Group Grading and Credit Update.

4.1.2. Group Grading

After one training epoch, group g produces the loss sequence ${\mathcal{L}}_g$ for its group model ${\mathcal{M}}_g$. We then score each group based on the loss values of all groups.

We design a group scoring mechanism based on Kernel Density Estimation (KDE) [41]. KDE approximates the probability distribution of a variable from a finite set of samples using a specified kernel and bandwidth. For group g, the continuous KDE of a loss value l is written as

$${\widehat{f}}_g\left(l\right)={\displaystyle \frac{1}{Q}}{\displaystyle \sum _{i=1}^Q}{\kappa }_{h_g}(l-l_i).$$

(1)

We retain the Gaussian kernel in the continuous formulation. Specifically, ${\kappa }_{h_g}\left(x\right)={\displaystyle \frac{1}{\sqrt{2\pi }{h}_g}}$$\exp \left(-{\displaystyle \frac{x^2}{2h_g^2}}\right)$. The bandwidth is determined adaptively as

$$h_g=\max \left\{\rho \left(\max \left({\mathcal{L}}_g\right)-\min \left({\mathcal{L}}_g\right)\right),{ϵ}_h\right\}.$$

Here, the relative factor $\rho =0.01$ is fixed, and ${ϵ}_h={10}^{-12}$ prevents a zero bandwidth when all observed loss values are identical.

For computationally efficient sample-domain evaluation, we evaluate the same Gaussian KDE at each observed loss $l_i$ rather than constructing an additional dense numerical grid:

$$d_g\left(l_i\right)\triangleq {\widehat{f}}_g\left(l_i\right)={\displaystyle \frac{1}{Q\sqrt{2\pi }{h}_g}}{\displaystyle \sum _{j=1}^Q}\exp \left(-{\displaystyle \frac{{(l_i-l_j)}^2}{2h_g^2}}\right),i=1,\dots ,Q.$$

(2)

This sample-domain evaluation is the continuous Gaussian KDE in Equation (1) evaluated at the observed loss samples. We select $l_g^{*}=\arg {\max }_{l_i\in {\mathcal{L}}_g}{d}_g\left(l_i\right)$ as the representative loss. If the estimated density is multimodal, the global maximum is used; tied global maxima are resolved deterministically according to their first occurrence in the loss sequence.

Inspired by the Full Width at Half-Maximum (FWHM) principle [42], we define the discrete half-maximum support width as

$$w_g={\displaystyle \sum _{i=1}^Q}\mathbb{I}\left(d_g\left(l_i\right)\ge {\displaystyle \frac{1}{2}}{d}_g\left(l_g^{*}\right)\right).$$

(3)

Unlike the conventional continuous FWHM measured directly along the loss axis, $w_g$ counts the observed loss samples located in the half-maximum density region and therefore characterizes the sample-domain spread of the high-density loss region. A group with both a large representative loss $l_g^{*}$ and a large support width $w_g$ is more likely to have been affected by malicious behavior.

Let $z_g=l_g^{*}{w}_g$ denote the raw group indicator. At epoch t, it is normalized across the G groups as

$${\mathrm{Norm}}_t\left(z_g\right)=\left\{\begin{array}{cc}(1-\delta ){\displaystyle \frac{z_g-z_{\min }^t}{z_{\max }^t-z_{\min }^t}},\hfill & z_{\max }^t-z_{\min }^t>ϵ,\hfill \\ {\displaystyle \frac{1-\delta }{2}},\hfill & z_{\max }^t-z_{\min }^t\le ϵ,\hfill \end{array}\right.$$

(4)

where $z_{\min }^t={\min }_{g\in {\mathcal{G}}^t}{z}_g$, $z_{\max }^t={\max }_{g\in {\mathcal{G}}^t}{z}_g$, $ϵ={10}^{-12}$, and $\delta ={10}^{-12}$ is a fixed lower-bound safeguard. The normalized group score is then

$$S_g=1-{\mathrm{Norm}}_t\left(z_g\right).$$

(5)

Consequently, $S_g\in [\delta ,1]$, preventing zero-valued group scores.

We apply one-dimensional K-means [43] with two clusters, K-means++ initialization, 10 independent initializations, a maximum of 300 iterations, a convergence tolerance of ${10}^{-4}$, and a fixed random seed of 0. Applying K-means to $z_g$ or $S_g$ produces the same cluster membership because the min-max normalization and complementation constitute an affine transformation. The cluster with the larger mean $z_g$, equivalently the smaller mean $S_g$, is labeled as the poor-performing group (PG) cluster, while the other cluster is labeled as the well-performing group (WG) cluster. Therefore, ${\mathcal{G}}_w^t\cup {\mathcal{G}}_p^t={\mathcal{G}}^t$ and ${\mathcal{G}}_w^t\cap {\mathcal{G}}_p^t=⌀$.

4.1.3. Credit Update

Let $c_n$ denote the credit of agent n, and let $g_n^t$ represent the group containing agent n at epoch t. For each agent n, the credit is updated as follows.

$$c_n^t=c_n^{t-1}+{\eta }_n^t·S_{g_n^t}·\Phi ,$$

(6)

where $\Phi$ is a fixed parameter that controls the update magnitude. The coefficient ${\eta }_n^t$ represents the reward or penalty applied to agent n at epoch t and is defined as

$${\eta }_n^t=\left\{\begin{array}{cc}-1,\hfill & \mathrm{if}{g}_n^t\in {\mathcal{G}}_p^t\mathrm{and}{g}_n^{t-1}\in {\mathcal{G}}_p^{t-1}\hfill \\ -0.5,\hfill & \mathrm{if}{g}_n^t\in {\mathcal{G}}_p^t\mathrm{and}{g}_n^{t-1}\in {\mathcal{G}}_w^{t-1}\hfill \\ 0.5,\hfill & \mathrm{if}{g}_n^t\in {\mathcal{G}}_w^t\mathrm{and}{g}_n^{t-1}\in {\mathcal{G}}_p^{t-1}\hfill \\ 1,\hfill & \mathrm{if}{g}_n^t\in {\mathcal{G}}_w^t\mathrm{and}{g}_n^{t-1}\in {\mathcal{G}}_w^{t-1}.\hfill \end{array}\right.$$

(7)

In this way, for a given group score, agents that remain in WGs receive larger credit increases than those newly assigned to WGs. Conversely, agents that remain in PGs experience larger credit reductions than those newly assigned to PGs. This design improves the efficiency of potential-attacker detection. The complete Loss-aware Credit Evaluation procedure is summarized in Algorithm 1.

Algorithm 1 Loss-Aware Credit Evaluation (LACE).

Input: the group set ${\mathcal{G}}^t$; the loss vectors ${\mathcal{L}}_g,\forall g\in {\mathcal{G}}^t$; and the credits from the previous time slot, $c_n^{t-1},\forall n\in \mathcal{N}$.

Output: the credit $c_n^t$, the set of PGs ${\mathcal{G}}_p^t$, and the set of WGs ${\mathcal{G}}_w^t$.

1: #Group Grading#

2: for all g in ${\mathcal{G}}^t$ do

3:    Determine $h_g$ and evaluate $d_g\left(l_i\right)$ at all observed loss samples using Equations (1) and (2);

4:    Select $l_g^{*}$ and compute the half-maximum support size $w_g$ using Equation (3);

5:    Compute $z_g=l_g^{*}{w}_g$ and the group score $S_g$ using Equation (5);

6: end for

7: Classify the groups into WGs and PGs using K-means.

8: #Credit Update#

9: for all agents n do

10:    Update the credit $c_n^t$ using Equation (6).

11: end for

4.2. Shuffling-Based Isolation Mechanism

The Shuffling-based Isolation Mechanism (SBIM) aims to progressively concentrate potentially malicious agents into fewer groups, thereby reducing their exposure to honest agents and limiting their influence on training. Because malicious identities are not directly observable, SBIM uses LACE-derived credits as indirect trust indicators and performs credit-guided stochastic regrouping; it is therefore a heuristic mechanism without a global optimality guarantee.

To achieve this objective, SBIM re-organizes agents across epochs based on their trustworthiness. Specifically, agents with lower credit scores are more likely to be grouped together, while highly trusted agents maintain relatively stable group assignments. This design reduces the exposure of honest agents to adversarial ones and accelerates the isolation of attackers.

To formalize the grouping process, each selection is performed according to a credit-aware probability interval, which determines the order in which agents are assigned to groups. The selection process must satisfy three key properties: (i) stochasticity, to prevent adversarial predictability; (ii) verifiability, to ensure that the random selection results cannot be forged; and (iii) credit correlation, such that higher-credit agents are more likely to be selected earlier.

To satisfy these requirements, SBIM adopts a blockchain hash-based randomization mechanism. After the credit scores are updated at epoch t, the master agent derives a public seed from the latest block hash, task identifier, epoch index, and current timestamp, i.e., $seed$$=HASH(has{h}_{block}\Vert taskID\Vert t\Vert timestamp)$. Since these inputs are either recorded on-chain or publicly known, the seed cannot be arbitrarily chosen by the master agent and can be recomputed by other participants. For the r-th selection in epoch t, a pseudo-random value is generated as follows:

$$u_r={\displaystyle \frac{HASH(seed\Vert r)}{2^{hashlen}}}\in [0,1),$$

(8)

where $hashlen$ denotes the bit-length of the hash output. Thus, $u_r$ can be independently reproduced and verified by all participants.

To incorporate credit awareness, cryptographic sortition methods, such as VRF-based sampling, can map verifiable randomness to a discrete priority value, for example, through a binomial distribution [44]. Because this work focuses on the attack-resilient grouping framework rather than the design of a new sortition primitive, SBIM uses roulette-wheel selection. Let ${\mathbb{U}}_r$ denote the set of unassigned agents before the r-th selection. The selection probability of agent $i\in {\mathbb{U}}_r$ is defined as follows:

$$P_i^r={\displaystyle \frac{c_i}{{\sum }_{j\in {\mathbb{U}}_r}{c}_j}}.$$

(9)

Then, each agent is assigned a probability interval ${\mathcal{I}}_i^r$ in $[0,1)$ according to the cumulative selection probability:

$${\mathcal{I}}_i^r=\left[\sum _{k<i,k\in {\mathbb{U}}_r}{P}_k^r,\sum _{k\le i,k\in {\mathbb{U}}_r}{P}_k^r\right).$$

(10)

If $u_r\in {\mathcal{I}}_i^r$, agent i is selected and removed from ${\mathbb{U}}_r$. The selection probabilities are then recalculated over the remaining unassigned agents. Selected agents are grouped sequentially, with every K agents forming one group.

This construction ensures that each agent’s selection probability is proportional to its credit, while the randomness is derived from the blockchain state and can be verified by all participants. Over successive epochs, the mechanism gradually clusters low-credit, potentially malicious agents into a small number of groups, thereby reducing their impact on the global model while preserving fairness and unpredictability. The complete procedure is summarized in Algorithm 2.

Algorithm 2 Shuffling-based Isolation Mechanism (SBIM).

Input: agent groups ${\mathcal{G}}_p^t$ and ${\mathcal{G}}_w^t$, group size K, latest block hash $has{h}_{block}$, task identifier $taskID$, epoch index t, timestamp

Output: Updated grouping ${\mathcal{G}}^{t+1}$

1: Seed Initialization (Master Agent)

2: $seed\leftarrow HASH(has{h}_{block}\Vert taskID\Vert t\Vert timestamp)$

3: Roulette-wheel Selection

4: Initialize $\mathbb{U}\leftarrow \{i\mid i\in G,G\in {\mathcal{G}}_p^t\}$, $Groups\leftarrow \varnothing$, $CG\leftarrow \varnothing$, and $r\leftarrow 0$

5: while$\mathbb{U}$ is not empty do

6:    $r\leftarrow r+1$

7:    $u_r\leftarrow HASH(seed\Vert r)/2^{hashlen}$

8:    $C_r\leftarrow {\sum }_{j\in \mathbb{U}}{c}_j$

9:    for each agent $i\in \mathbb{U}$ do

10:      Compute $P_i^r\leftarrow c_i/C_r$

11:      Assign the cumulative interval ${\mathcal{I}}_i^r$ according to Equation (10)

12:    end for

13:    Select agent i satisfying $u_r\in {\mathcal{I}}_i^r$

14:    Add agent i to $CG$ and remove it from $\mathbb{U}$

15:    if $\left|CG\right|=K$ then

16:      Add $CG$ to $Groups$ and reset $CG\leftarrow \varnothing$

17:    end if

18: end while

19: Verification (Blockchain Smart Contract)

20: Verify each selection round using $seed$, generated $u_r$, credit values, and cumulative intervals

21: Store the verified grouping result on-chain

22: Final Output

23: ${\mathcal{G}}^{t+1}\leftarrow Groups\cup {\mathcal{G}}_w^t$

24: return  ${\mathcal{G}}^{t+1}$

4.3. Byzantine-Tolerant Aggregation (BTA)

To maintain the accuracy of the global model during the detection phase, we employ Byzantine-tolerant aggregation (BTA). BTA can be executed in parallel with shuffling. After receiving the updated parameters from all groups, the master agent discards the models from PGs and aggregates only the models from WGs. The master agent computes a score-weighted average of these models to obtain an updated global model. The aggregation is formulated as follows:

$${\mathcal{M}}^{t+1}={\displaystyle \sum _{g=1}^G}wt\left(S_g\right)·{\mathcal{M}}_g^t,$$

(11)

where $wt\left(S_g\right)$ denotes the weight of group g, i.e., $wt\left(S_g\right)={\displaystyle \frac{S_g}{{\sum }_{j\in {\mathcal{G}}_w^t}{S}_j}}$.

4.4. Theoretical Analysis

We next analyze the computational complexity and efficiency of the proposed algorithms.

4.4.1. Complexity and Overhead Analysis

Let N denote the total number of agents, G the number of groups, K the number of agents in each group, and Q the number of loss samples generated by each group within one epoch. For equally sized groups, $N=GK$. In the following analysis, Q is retained as a separate workload parameter, and no relationship such as $N=KQ$ is assumed.

For LACE in Algorithm 1, evaluating the KDE-based density values of the Q loss samples requires $\mathcal{O}\left(Q^2\right)$ operations for each group and $\mathcal{O}\left(G{Q}^2\right)$ operations for all groups. When the K-means configuration is fixed, clustering the G group scores requires $\mathcal{O}\left(G\right)$ operations, while updating the credits of all agents requires $\mathcal{O}\left(N\right)$ operations. Therefore, the per-epoch complexity of LACE is $\mathcal{O}(G{Q}^2+G+N)$.

For SBIM, let $N_p^t=K\left|{\mathcal{G}}_p^t\right|$ denote the number of agents regrouped at epoch t, where $0\le N_p^t\le N$. In the straightforward roulette-wheel implementation, constructing the probability intervals for the remaining agents over all selection rounds requires $\mathcal{O}\left({\left(N_p^t\right)}^2\right)$ operations. The smart contract verification recomputes the same hash-derived selections and probability intervals and therefore has the same order of complexity. Thus, both SBIM generation and verification are upper-bounded by $\mathcal{O}\left(N^2\right)$ in the worst case.

Let $B_{\mathcal{M}}$ denote the model size. Because model parameters and updates are transmitted and stored off-chain, while only their references, loss records, credit values, and grouping metadata are processed or recorded on-chain, the per-epoch communication cost is $\mathcal{O}(G{B}_{\mathcal{M}}+GQ+N)$. The off-chain model storage cost is $\mathcal{O}\left(G{B}_{\mathcal{M}}\right)$, while the on-chain storage growth is $\mathcal{O}(GQ+N)$ per epoch. Finally, when Q, K, and the K-means configuration are fixed, LACE scales linearly with N. Therefore, the combined defense-related computation has a worst-case upper bound of $\mathcal{O}\left(N^2\right)$, dominated by SBIM when all agents are regrouped.

4.4.2. Qualitative Analysis of Poisoning-Group Concentration

Let M denote the number of malicious agents and $G_t^{\mathrm{poi}}$ the number of groups containing at least one malicious agent at epoch t. For $G=N/K$ groups of size K, the feasible range of this metric is

$$⌈{\displaystyle \frac{M}{K}}⌉\le G_t^{\mathrm{poi}}\le \min (M,G),$$

(12)

where the lower bound represents the ideal concentration of malicious agents. Under uniformly random grouping, the probability that a particular group contains no malicious agent is $\left({\displaystyle \genfrac{}{}{0pt}{}{N-K}{M}}\right)/\left({\displaystyle \genfrac{}{}{0pt}{}{N}{M}}\right)$; hence, the expected number of poisoning groups is

$$\mathbb{E}\left[G_{\mathrm{rand}}^{\mathrm{poi}}\right]=G\left(1-{\displaystyle \frac{\left(\genfrac{}{}{0pt}{}{N-K}{M}\right)}{\left(\genfrac{}{}{0pt}{}{N}{M}\right)}}\right).$$

(13)

Equations (12) and (13) provide ideal and credit-independent references for evaluating the concentration effect. Suppose that LACE produces informative credits, such that agents persistently associated with malicious behavior tend to have lower credits. For a higher-credit agent h and a lower-credit agent l, credit-proportional sampling gives $\mathrm{Pr}\left(h\mathrm{is}\mathrm{selected}\mathrm{before}l\right)=c_h/(c_h+c_l)>1/2$. Higher-credit agents therefore tend to occupy earlier positions, while lower-credit agents accumulate toward the later positions; partitioning this sequence into consecutive blocks of size K consequently increases the likelihood that low-credit agents are grouped together. Once high-credit-dominated groups are classified as WGs and retained, the remaining PG pool becomes relatively enriched in low-credit agents and is reshuffled again, reinforcing their concentration across epochs. This iterative filtering creates a directional tendency for $G_t^{\mathrm{poi}}$ to move toward its lower bound, although imperfect credits and stochastic selection preclude monotonic or globally optimal convergence.

5. Experiments

We implement TAR-DT using Python 3.10 and PyTorch Distributed [45]. In this section, we first introduce the experimental setup and then evaluate the convergence and reliability of TAR-DT.

5.1. Experimental Setup

5.1.1. Datasets

In the experiments, we train Informer [46] and dual-LSTM [47] on the ETTh₁, ETTm₁ [48], and ECL [49] datasets. Informer is a prediction model based on an encoder–decoder architecture and contains 11,330,055 parameters, while dual-LSTM contains 4,233,735 parameters. ETTh₁ and ETTm₁ contain two years of electricity-transformer temperature records from two cities in China; ETTh₁ provides hourly readings, whereas ETTm₁ provides readings at 15-min intervals. ECL contains two years of hourly electricity consumption records from 321 clients in the United States.

5.1.2. Testbed

The experiments are conducted over a local area network (LAN). The agents consist of 15 Raspberry Pi devices (4v Cortex-A72 and 4 GB DDR4 RAM) and 15 virtual machines (4v CPU and 8 GB RAM) hosted on different computer systems. A Dell PowerEdge R730 server (3.2 GHz × 8 and 64 GB RAM) serves as the master agent. Communication between the edge agents and the master agent is provided through wired fiber-optic connections and wireless Wi-Fi. The experimental prototype adopts this IPFS-assisted implementation, in which model parameters are transmitted off-chain while their CIDs, cryptographic digests, and metadata are recorded on the blockchain.

5.1.3. Parameter Settings

Unless otherwise specified, the system contains 30 agents, of which 6 are malicious, corresponding to 20% of all agents. The number of groups is 6 ($G=6$), and each group contains 5 agents ($K=5$). The malicious agents launch attacks by introducing random perturbations that follow a Gaussian distribution. The default DNN model is Informer, and the default dataset is ETTm₁. To reduce training time and energy consumption, we use the latest one-year data in ETTm₁, i.e., half of the complete dataset. The initial credit of each agent is set to 50. The main experimental parameters are summarized in

Table 1. Experimental parameters of TAR-DT.

Symbol/Parameter	Value
Total number of agents N	30
Number of malicious agents	6
Number of groups G	6
Initial credit	50
Default training model	Informer
Default training dataset	ETTm1

.

5.1.4. Baselines

• V-DT (vanilla distributed DNN training): A fundamental distributed DNN training architecture, encompassing both data parallelism and model parallelism. A detailed description can be found in [28]. V-DT randomly selects agents for computation tasks and does not include a defense mechanism against potential attacks.
• Multi-Krum [16]: An enhancement of the classic Byzantine-robust algorithm Krum. Its core principle is that gradients among benign agents are relatively similar, whereas gradients generated by malicious agents are significantly different. Through iterative computation, potential malicious gradients are filtered out, thereby improving the robustness of distributed learning.
• FLDetector [50]: Attacks are detected by examining the consistency of model updates. Specifically, the master agent predicts subsequent model updates based on historical updates. If an update deviates significantly from the prediction, the corresponding agent is regarded as malicious.

It is worth noting that research on poisoning attacks under model-parallel training remains limited, and the baselines above were originally designed mainly for data-parallel scenarios. Therefore, for comparison, we adapt their core ideas to our experimental setting.

5.2. Results and Analysis

First, we evaluate the effectiveness of the group-level malicious-agent isolation strategy by training the Informer and dual-LSTM models on the ETTh₁ and ECL datasets. The resulting loss values are shown in Figure 3. In these plots the blue solid line denotes MSE (left y-axis) and the red points denote the Number of Poisoning Groups (right y-axis). For the Informer model, TAR-DT converges within 1000 iterations on both datasets. The dual-LSTM model converges after 500 iterations on ECL, as shown in Figure 3d. In Figure 3c, however, MSE exhibits significant fluctuations. Together with the “Number of Poisoning Groups” metric, this result suggests that the intermediate K-means clustering mistakenly classifies one PG as a WG. Consequently, when this group participates in model aggregation, it introduces significant bias into the global model. As shown in Figure 3, $G_t^{\mathrm{poi}}$ decreases from three or four groups to two across the evaluated models and datasets, reaching the lower bound and remaining below the random-grouping reference; this observation provides empirical support for the concentration effect of SBIM rather than a global convergence guarantee.

To evaluate the influence of the blockchain-enabled execution layer on system performance, we measure the time required to complete five training epochs with and without blockchain. In the setting without blockchain, a centralized node is responsible for model aggregation, malicious-agent screening, and group reconfiguration. As shown in Figure 4a, after multiple trials, the average time difference between the two settings is only 35.52 s. Compared with the several-hour training process, this difference is not significant. Furthermore, Figure 4b shows that blockchain-related operations introduce limited latency: uploading and downloading data take only 0.03–0.06 s, while block confirmation takes about 1 s. Therefore, compared with the time-consuming model training process and the natural time fluctuation across epochs, the additional time introduced by blockchain operations is relatively small.

Next, we evaluate TAR-DT in three respects: network scale, malicious-agent ratio, and attack type. The comparison is performed against the three baselines introduced above.

In Figure 5a, the malicious-agent ratio varies from 10% to 30%, and we compare the performance of the four methods. The observations are as follows:

• V-DT, which lacks a defense mechanism, has difficulty converging to a reasonable value.
• TAR-DT consistently outperforms the other methods in terms of MSE. As the number of malicious agents increases, this advantage becomes more evident.
• FLDetector and Multi-Krum show suboptimal performance. The limited performance of FLDetector is primarily attributable to its reliance on consistent model updates for prediction. In practical model poisoning attacks, malicious behavior may not always lead to obvious gradient variations, which weakens its effectiveness. Multi-Krum removes potentially harmful model updates according to loss differences. Although Multi-Krum performs better than FLDetector, its lack of further malicious-agent detection leaves it inferior to TAR-DT.

We then adjust the network scale to 20, 30, 40, and 50 agents. As shown in Figure 5b, V-DT still fails to converge to a reasonable value and produces large errors. In contrast, TAR-DT adapts well as the network scale increases, and its performance improves in larger networks. This improvement stems from the aggregation mechanism: a larger set of group-level samples enables TAR-DT to distinguish PGs from WGs more effectively. Multi-Krum and FLDetector maintain relatively stable performance under different network scales. This is because they lack a shuffling strategy and their convergence depends largely on the initial distribution of malicious agents, especially when the malicious-agent ratio remains unchanged.

Finally, we evaluate the methods under different attack strategies, as shown in Figure 6. The results show that TAR-DT outperforms the other methods under all evaluated attack types. Its performance is significantly better than that of Multi-Krum and FLDetector, which achieve similar results. These results demonstrate that TAR-DT is more adaptable to diverse attack strategies.

6. Conclusions

In this paper, we consider edge-distributed DNN training as a representative scenario and investigate the security challenges posed by unreliable or malicious agents in edge computing environments. To address these challenges, we propose TAR-DT, a blockchain-enabled and attack-resilient distributed DNN training framework that integrates data and model parallelism to improve training efficiency. TAR-DT employs a malicious-agent detection and isolation strategy based on Loss-aware Credit Evaluation and the Shuffling-based Isolation Mechanism. Through iterative training and regrouping, the proposed strategy identifies and isolates malicious agents, thereby improving the security and reliability of distributed DNN training. In addition, TAR-DT uses blockchain to record and verify critical operations, such as loss submission, credit updating, grouping, and aggregation, thereby enhancing the fairness, transparency, and tamper resistance of distributed computing tasks. The experimental results demonstrate that TAR-DT improves robustness against model poisoning attacks while introducing only limited blockchain-related overhead. This work provides an effective approach to addressing security challenges in edge-distributed DNN training and offers practical guidance for the future development of trustworthy edge intelligence.