Dynamic Free-Rider Detection in Cross-Silo Federated Learning via Simulated Attack Patterns

Motoki Nakamura

cs.LGApr 6, 2026

Dynamic Free-Rider Detection in Cross-Silo Federated Learning via Simulated Attack Patterns

Authors: Motoki Nakamura

Organizations: Fujitsu Limited, Kanagawa, Japan

Abstract

Federated learning (FL) enables multiple clients to collaboratively train a global model by aggregating local updates without sharing private data. In this work, we focus on cross-silo FL, where each client typically represents an independent organization. However, cross-silo FL can face the challenge of free-riders, clients who submit fake model parameters without performing actual training to obtain the global model without contributing. Chen et al. proposed a free-rider detection method based on the weight evolving frequency (WEF) of model parameters. This detection approach is practical because it requires neither a proxy dataset nor pre-training. Nevertheless, it struggles to detect ``dynamic'' free-riders who behave honestly in early rounds and later switch to free-riding, particularly under global-model-mimicking attacks such as the delta weight attack and our newly proposed adaptive WEF-camouflage attack. In this paper, we propose a novel detection method S2-WEF that simulates the WEF patterns of potential global-model-mimicking attacks on the server side using previously broadcast global models, and identifies clients whose submitted WEF patterns resemble the simulated ones. To handle a variety of free-rider attack strategies, S2-WEF further combines this simulation-based similarity score with a deviation score computed from mutual comparisons among submitted WEFs, and separates benign and free-rider clients by two-dimensional clustering and per-score classification. This method enables dynamic detection of clients that transition into free-riders during training without proxy datasets or pre-training. We conduct extensive experiments across four datasets and five attack types, demonstrating that S2-WEF provides robust dynamic free-rider detection across diverse settings.

Figures & tables

Algorithm	STD-DAGMM [ 6 ]	FRAD [ 7 ]	ZeTFRi [ 4 ]	CFFL [ 8 ]	RFFL [ 14 ]	WEF-Defense [ 9 ]	S2-WEF (ours)
No pre-training	$\times$	$\times$	$\times$	$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$
No proxy datasets	$\checkmark$	$\checkmark$	$\times$	$\times$	$\checkmark$	$\checkmark$	$\checkmark$
Dynamic FR detection	$\checkmark$	$\checkmark$	$\checkmark$	$\times$	$\times$	$\times$	$\checkmark$

TABLE I: Comparative summary of free-rider detection methods.

Dataset	Dist.	Attack	WEF-Defense	WEF-na
MNIST	IID	RWA	$0.406\!\pm\!0.514$	$0.598\!\pm\!0.493$
		SPA	$0.306\!\pm\!0.419$	$0.927\!\pm\!0.091$
		DWA	$0.198\!\pm\!0.271$	$0.198\!\pm\!0.271$
		ADWA	$0.198\!\pm\!0.271$	$0.927\!\pm\!0.081$
	Non-IID	RWA	$0.194\!\pm\!0.435$	$0.196\!\pm\!0.269$
		SPA	$0.166\!\pm\!0.365$	$0.990\!\pm\!0.005$

TABLE II: Detection F1-score of WEF-Defense against existing dynamic free-rider attacks.

Dataset	Dist.	WEF-Defense	WEF-na
MNIST	IID	$0.198\!\pm\!0.271$	$0.198\!\pm\!0.271$
MNIST	Non-IID	$0.197\!\pm\!0.270$	$0.194\!\pm\!0.266$
Adult	IID	$0.198\!\pm\!0.271$	$0.198\!\pm\!0.271$
Adult	Non-IID	$0.395\!\pm\!0.221$	$0.396\!\pm\!0.221$
CIFAR-10	IID	$0.554\!\pm\!0.130$	$0.698\!\pm\!0.272$
CIFAR-10	Non-IID	$0.198\!\pm\!0.271$	$0.099\!\pm\!0.221$

TABLE III: Detection F1-score of WEF-Defense against the novel dynamic free-rider attack.

Dataset	Samples	Dimensions	Classes	Model	Learning rate	Momentum	Global rounds	Batch size
MNIST	70,000	$28\times 28$	10	LeNet	0.005	0.0001	50	32
Adult	23,374	14	2	MLP	0.0001	0.0001	50	32
CIFAR-10	60,000	$32\times 32$	10	ResNet	0.01	0.9	80	32
CIFAR-100	60,000	$32\times 32$	100	ResNet	0.01	0.9	100	32

TABLE IV: Dataset and hyperparameter settings.

Dataset	Dist.	Attack	STD-DAGMM	WEF-na	S2-WEF
MNIST	IID	RWA	$0.588\!\pm\!0.537$	$0.980\!\pm\!0.000$	$0.978\!\pm\!0.011$
		SPA	$0.371\!\pm\!0.432$	$0.980\!\pm\!0.000$	$0.978\!\pm\!0.011$
		DWA	$0.222\!\pm\!0.185$	$0.298\!\pm\!0.420$	$0.978\!\pm\!0.011$
		ADWA	$0.338\!\pm\!0.392$	$0.978\!\pm\!0.004$	$0.978\!\pm\!0.011$
		AWCA	$0.352\!\pm\!0.302$	$0.196\!\pm\!0.438$	$0.978\!\pm\!0.011$
	Non-IID	RWA	$0.976\!\pm\!0.015$	$0.976\!\pm\!0.009$	$0.992\!\pm\!0.009$

TABLE V: F1-score comparison on MNIST and Adult.

Dataset	Dist.	Attack	STD-DAGMM	WEF-na	S2-WEF
CIFAR-10	IID	RWA	$0.788\!\pm\!0.414$	$0.985\!\pm\!0.003$	$0.986\!\pm\!0.007$
		SPA	$0.766\!\pm\!0.428$	$0.985\!\pm\!0.003$	$0.986\!\pm\!0.007$
		DWA	$0.738\!\pm\!0.415$	$0.985\!\pm\!0.003$	$0.986\!\pm\!0.007$
		ADWA	$0.467\!\pm\!0.381$	$0.985\!\pm\!0.003$	$0.986\!\pm\!0.007$
		AWCA	$0.738\!\pm\!0.415$	$0.985\!\pm\!0.003$	$0.986\!\pm\!0.007$
	Non-IID	RWA	$0.957\!\pm\!0.052$	$0.984\!\pm\!0.006$	$0.984\!\pm\!0.015$

TABLE VI: F1-score comparison on CIFAR-10 and CIFAR-100.

Dataset	Attack	Variant	Precision	Recall	FPR
Adult	AWCA	$Dev$ only	$0.000\!\pm\!0.000$	$0.000\!\pm\!0.000$	$0.154\!\pm\!0.063$
		$\gamma$ only (cos)	$0.660\!\pm\!0.422$	$0.242\!\pm\!0.429$	$0.022\!\pm\!0.047$
		$\gamma$ only (cos/ $\ell_{2}$ )	$0.757\!\pm\!0.210$	$0.996\!\pm\!0.009$	$0.043\!\pm\!0.044$
		Clustering only	$0.873\!\pm\!0.099$	$0.954\!\pm\!0.102$	$0.015\!\pm\!0.012$
		Full pipeline	$0.888\!\pm\!0.110$	$0.954\!\pm\!0.102$	$0.013\!\pm\!0.013$
	SPA	$Dev$ only	$0.960\!\pm\!0.000$	$1.000\!\pm\!0.000$	$0.004\!\pm\!0.000$

TABLE VII: Ablation results of S2-WEF.

Dataset	Clustering only	Full pipeline
Adult	$0.176\!\pm\!0.128$	$0.088\!\pm\!0.050$
CIFAR-10	$0.178\!\pm\!0.036$	$0.097\!\pm\!0.016$

TABLE VIII: False-positive rate without free riders.

			$\gamma$ only			Full pipeline
Dataset	FR	$k$	Precision	Recall	F1	Precision	Recall	F1
Adult	10%	1	0.399	1.000	0.567	0.913	1.000	0.953
		2	0.481	1.000	0.649	0.913	1.000	0.953
		3	0.556	1.000	0.713	0.913	1.000	0.953
		4	0.694	0.993	0.805	0.913	1.000	0.953
		5	0.777	0.993	0.865	0.913	1.000	0.953

TABLE IX: Sensitivity of the

\gamma

-threshold parameter

k

Dataset	FR ratio	Precision	Recall	F1
Adult	10%	0.913	1.000	0.953
	20%	0.976	1.000	0.988
	30%	0.971	1.000	0.985
	40%	0.982	0.972	0.977
CIFAR-10	10%	0.964	1.000	0.981
	20%	0.979	1.000	0.989

TABLE X: Detection performance under different free-rider ratios.

Dataset	Clients	FRs	FR ratio	Precision	Recall	F1
CIFAR-10	5	1	20%	0.959	1.000	0.979
	10	1	10%	0.964	1.000	0.981
	20	2	10%	0.983	1.000	0.992
	50	5	10%	0.994	1.000	0.997
CIFAR-100	5	1	20%	0.987	1.000	0.994
	10	1	10%	0.971	1.000	0.985

TABLE XI: Detection performance with different numbers of clients.

Dataset	Setting	Accuracy (%)
Adult	No attack, no defense	$62.637\!\pm\!7.027$
	No attack, S2-WEF	$62.269\!\pm\!7.688$
	10% attackers, S2-WEF	$63.730\!\pm\!7.265$
CIFAR-10	No attack, no defense	$90.294\!\pm\!0.603$
	No attack, S2-WEF	$90.068\!\pm\!0.550$
	10% attackers, S2-WEF	$89.734\!\pm\!0.401$

TABLE XII: Global-model main-task accuracy under different attack and defense settings.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 943 papers

Sep 22, 2026

When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense

Federated Learning enables decentralized model training by exchanging model updates--rather than raw data--with a central parameter server (PS). While most of the existing defenses primarily assume static or independently acting adversaries, we reveal a new class of dynamically adaptive attacks that systematically bypass such protections. We propose Fed-ADR, a holistic attack framework in which a malicious orchestrator server (OS) dynamically coordinates a heterogeneous set of adversarial clients, including both targeted and untargeted attackers. Through real-time coordination by the OS, malicious clients strategically adapt their gradient updates to evade defenses deployed by the PS, while either severely degrading global model performance or steering training toward adversarial objectives.To mitigate this threat, we offer a detection mechanism that estimates each client's true gradient from historical updates, enabling real-time detection of coordinated malicious behavior without additional overhead. We further introduce an in-situ recovery mechanism that restores global model performance without restarting training, preserving convergence and minimizing recovery time. Comprehensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 benchmark datasets demonstrate that Fed-ADR's attack scheme can reduce global accuracy from over 90% to below 10%, bypassing several state-of-the-art defenses. When our detection and recovery modules are employed, they identify malicious clients and restore accuracy to over 90% within a few rounds, at a substantially lower cost than retraining from scratch--achieving a reduction of at least 20x in computational overhead.

Mohamed Shaaban, Ahmed Abdelnaby, Mohamed Elmahallawy

School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

Federated Learning Byzantine-Robust Federated Learning

Ask PDF

Oct 9, 2026

WaSA: Wavelet Scattering Autoencoders for Unsupervised Offline Detection of Malicious Clients in Federated Learning

Federated Learning (FL) enables collaborative model training without exposing raw data, yet remains vulnerable to malicious clients injecting poisoned datasets. Existing defenses are typically reactive (operating during training) or supervised (requiring prior knowledge of attack types) - assumptions that rarely hold in open-ended IoT deployments. We propose WaSA, a fully unsupervised, offline framework for malicious client detection. Before training, each client transmits a single, privacy-preserving spectral summary of its data to the server. A denoising autoencoder, trained solely on clean auxiliary data, scores clients based on their deviation from the learned benign manifold, identifying corruptions regardless of the attack type. WaSA requires no attack labels, generalizes to unseen anomalies, and introduces a Boltzmann sampling strategy for client selection that smoothly interpolates between hard exclusion and standard aggregation. Experiments on MNIST, CIFAR-10, and CIFAR-100 under diverse attack scenarios (up to 90 % malicious clients) demonstrate consistent improvements over supervised baselines and robust aggregation methods, with negligible communication overhead. Code is available at https://github.com/alelicciardi99/wavelet_autoencoders_malicious.

Alessandro Licciardi

Department of Mathematical Sciences, Politecnico di Torino, Turin, IT · National Institute of Nuclear Physics (INFN), Sezione di Torino, Turin, IT

Wavelet Scattering Transforms Byzantine-Robust Federated Learning Unsupervised Anomaly Detection

Ask PDF

Feb 25, 2026

Private and Robust Contribution Evaluation in Federated Learning

Cross-silo federated learning allows multiple organizations to collaboratively train machine learning models without sharing raw data, but client updates can still leak sensitive information through inference attacks. Secure aggregation protects privacy by hiding individual updates, yet it complicates contribution evaluation, which is critical for fair rewards and detecting low-quality or malicious participants. Existing marginal-contribution methods, such as the Shapley value, are incompatible with secure aggregation, and practical alternatives, such as Leave-One-Out, are crude and rely on self-evaluation. We introduce two marginal-difference contribution scores compatible with secure aggregation. Fair-Private satisfies standard fairness axioms, while Everybody-Else eliminates self-evaluation and provides resistance to manipulation, addressing a largely overlooked vulnerability. We provide theoretical guarantees for fairness, privacy, robustness, and computational efficiency, and evaluate our methods on multiple medical image datasets and CIFAR10 in cross-silo settings. Our scores consistently outperform existing baselines, better approximate Shapley-induced client rankings, and improve downstream model performance as well as misbehavior detection. These results demonstrate that fairness, privacy, robustness, and practical utility can be achieved jointly in federated contribution evaluation, offering a principled solution for real-world cross-silo deployments.

Delio Jaramillo Velez, Gergely Biczok, Alexandre Graell i Amat +2

University of La Laguna Tenerife, Spain · HUN-REN Hungarian Research Network Budapest, Hungary · Chalmers University Gotheburg, Sweden +2

Federated Learning Privacy-Preserving ML Privacy-Preserving Federated Learning Algorithmic Fairness

Ask PDF

Abstract

Federated Learning

Explore similar work

When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense

WaSA: Wavelet Scattering Autoencoders for Unsupervised Offline Detection of Malicious Clients in Federated Learning

Private and Robust Contribution Evaluation in Federated Learning