Decentralized training is only as trustworthy as the step where many independent workers' contributions get merged into one model. On QBC, that step is the DiLoCo outer optimizer: each worker trains locally, submits a sparse, post-quantum-signed pseudo-gradient, and the aggregator folds those submissions into the shared weights behind a held-out improvement gate. If that merge step can be skewed by one bad participant, the whole "trained by strangers, finalized on-chain" premise is weaker than it looks.
So we went looking for exactly that, on our own system, and then we fixed what we found. This post is the honest accounting of the hardening, in the same spirit as the rest of our engineering log: what is now robust, and what is still on the list.
The threat we were closing
The aggregator averages worker pseudo-gradients. A naive mean has an obvious weakness: one worker submitting an enormous update dominates the average. Worse, the optimizer keeps a momentum buffer that carries a descent direction across rounds, and a single poisoned update could push that buffer to a runaway value that quietly skews every future round, not just the one it landed in. Neither of those requires a clever exploit. They are the default failure modes of "just take the mean," and they are the first thing a motivated bad actor would reach for.
What changed
Five defenses now sit in the aggregation path, layered so that each one covers a different failure the others do not.
Per-worker gradient clipping. Before a worker's update enters the average, its magnitude is clipped to a fixed bound. A participant submitting a gigantic update no longer dominates the merged direction; its influence is capped no matter what it sends.
Norm-based outlier rejection. Clipping bounds a bad worker, but a blatant poisoner whose update is orders of magnitude larger than everyone else's should be dropped entirely, not merely trimmed in. When a round has at least three workers, the aggregator now computes the median submission magnitude and rejects any worker whose magnitude sits far above it. A minority of wild-magnitude workers is excluded before it can bias the mean at all.
A bounded, self-healing momentum buffer. The momentum buffer is now clamped to a finite range, and any non-finite value is reset. A crafted round can no longer drive it to infinity and permanently wedge the loop. Because the momentum coefficient is below one, a bounded perturbation now decays over subsequent rounds instead of compounding: the loop heals itself rather than staying poisoned.
Momentum reset on a rejected epoch. The held-out improvement gate already rolls back any epoch that makes the model worse. We extended that: when the gate rejects an epoch, the aggregator now zeroes its momentum buffer. A rejected, possibly poisoned round leaves no residue behind to tilt the rounds that follow.
A fail-closed improvement gate. If the aggregator cannot even measure the baseline held-out loss, it now refuses to apply the update rather than defaulting to "accept." Previously an unmeasurable baseline could let an arbitrary update through. Now the safe default is to reject.
Every one of these landed with unit tests, including a test that submits a poison worker alongside honest ones and asserts the aggregate follows the honest majority while the momentum buffer stays finite. The build passed, and the change is live in production: the mind rebuilt from the hardened code and the training loop resumed on the new binary, aggregating real worker submissions as before.
What this does, precisely
These changes make the aggregator robust to a minority of malicious or faulty workers. One participant, or a minority submitting garbage, can no longer poison the model or stall the loop. That is a real, testable property, and it is the property that matters most for a network where anyone can run a worker.
What it does not yet do, stated plainly
Robust aggregation has a hard mathematical limit: no averaging rule survives a majority of colluding participants. If an attacker can cheaply spin up more malicious workers than there are honest ones, statistics alone cannot save you. The real defense against that is economic, not numerical: workers must have something at stake that they lose for submitting bad work. Worker stake and slashing for decentralized training is on our roadmap, and until it ships we are not going to pretend that clipping and outlier rejection are a substitute for it. They are the right first layer. They are not the whole wall.
The same honesty applies to the data workers train on. Hardening the merge step does not by itself authenticate every input that reaches the knowledge fabric; tightening that boundary is tracked separately.
Why we publish the gaps
A project that only ever announces wins is asking you to trust its silence. We would rather tell you exactly where the current defenses stop, because the whole point of building this on a chain is that you should not have to take our word for any of it. The aggregator is stronger today than it was yesterday, in specific, checkable ways. It is not finished, and we will say so until it is.