PaperlayerView exact revision on arXiv

Source-linked AI summary

Free-rider Attacks on Model Aggregation in Federated Learning

Yann Fraboni, Richard Vidal, Marco Lorenzi

arXiv:2006.11901v5cs.LGstat.ML

TL;DR

Free-rider attacks threaten federated learning by allowing clients to obtain the aggregated model without contributing data, especially where models and datasets are highly valuable. The paper provides a theoretical and experimental analysis for model-averaging schemes, combining a basic no-update attack with stochastic disguising strategies. Both theory and experiments demonstrate convergence of these attacks, while the authors identify the need for improved detection and note that their analysis relies on assumptions about client-parameter evolution.

  • Problem

    Free-rider attacks can obtain valuable federated models without contributing data, while existing defenses and prior analyses provide limited protection or theoretical guarantees for common model-averaging schemes.

  • Method

    The paper formalizes free-riding as a stochastic process for model-averaging schemes such as FedAvg and FedProx, analyzing plain global-parameter returns and stochastic perturbations that mimic fair-client updates.

  • Results

    Theoretical developments and experiments demonstrate convergence of both plain and disguised free-rider attacks, including scenarios with iid and non-iid data.

  • Takeaways & Limitations

    Free-rider detection requires more than outlier-based defenses, including inspection of client distributions and improved server-side modeling of parameter heterogeneity.

  • Takeaways & Limitations

    The analysis relies on hypotheses concerning the evolution of clients’ parameters during federated learning.

Abstract

from arXiv · show

Free-rider attacks against federated learning consist in dissimulating participation to the federated learning process with the goal of obtaining the final aggregated model without actually contributing with any data. This kind of attacks is critical in sensitive applications of federated learning, where data is scarce and the model has high commercial value. We introduce here the first theoretical and experimental analysis of free-rider attacks on federated learning schemes based on iterative parameters aggregation, such as FedAvg or FedProx, and provide formal guarantees for these attacks to converge to the aggregated models of the fair participants. We first show that a straightforward implementation of this attack can be simply achieved by not updating the local parameters during the iterative federated optimization. As this attack can be detected by adopting simple countermeasures at the server level, we subsequently study more complex disguising schemes based on stochastic updates of the free-rider parameters. We demonstrate the proposed strategies on a number of experimental scenarios, in both iid and non-iid settings. We conclude by providing recommendations to avoid free-rider attacks in real world applications of federated learning, especially in sensitive domains where security of data and models is critical.

1 Introduction

Federated learning enables joint model training without sharing client data, but its aggregated models can expose valuable intellectual property and sensitive information. This paper develops and evaluates free-rider attacks that obtain the fair participants’ model without contributing data, including disguising strategies designed to evade detection.

  • Federated learning lets clients jointly train a global model without sharing their respective data.
  • Exclusive datasets make aggregated models commercially or intellectually valuable, motivating providers to restrict direct model sharing.
  • Free-riders disguise participation to obtain the fair participants’ aggregated model without contributing training data, creating risks of intellectual-property loss and privacy breaches.
  • Existing defenses based on outlier detection are generally unsuitable because free-riding is designed to remain undetected without perturbing federated learning.
  • The paper develops a theoretical framework for free-rider attacks on model-averaging schemes such as FedAvg and FedProx, deriving conditions that guarantee convergence to the fair clients’ model.
  • A basic attack returns the received global parameters at every iteration, while more complex attacks use stochastic parameter perturbations to disguise the contribution.

2 Methods

The paper models FedAvg and FedProx as stochastic parameter-aggregation processes, then analyzes plain and disguised free-rider updates. It proves that both attack types can converge to the fair clients’ aggregated model, while perturbations and declared free-rider samples affect variance and detectability.

  • Federated learning through model aggregation: FedAvg and FedProx: FedAvg sends the global model to clients, aggregates their locally optimized parameters by sample-weighted averaging, and FedProx adds an L2 penalty toward the global model.FedProx therefore retains the aggregation structure while regularizing local deviations from the reference model.
  • Formalizing free-rider attacks: The analysis partitions clients into fair participants and free-riders, with free-riders declaring a total sample size MK while contributing no genuine local data updates.The formalization requires at least one fair client and treats free-riders as malicious clients pretending to participate.
  • SGD perturbation of fair-client models: SGD updates are modeled as Gaussian perturbations, allowing disguised free-riders to mimic the stochastic structure of fair-client updates.The stochastic-gradient formulation motivates additive perturbations that resemble the noise observed between optimization rounds.
  • Plain free-riding: Plain free-riding returns the received global parameters unchanged, and its aggregation process converges in expectation to the fair clients’ aggregated model.The strategy is analytically tractable but the server can easily detect the unchanged-parameter behavior.
  • Disguised free-riding: Disguised free-riding preserves convergence in expectation to the fair clients’ model but increases variance through perturbations injected at every iteration.For multiple disguised free-riders, the asymptotic expectation remains unchanged under constant perturbation factors, while variance behavior depends on the attack configuration.
  • FedProx extension: For FedProx, the same asymptotic convergence behavior holds, while stronger regularization reduces the noise parameter and asymptotic variances.The asymptotic variance remains strictly increasing with the total number of free-rider samples, but regularization can reduce it.

3 Experiments

The experiments evaluate plain and disguised free-rider attacks across diverse federated-learning datasets, models, aggregation schemes, and iid or non-iid settings. Free-riders generally preserve final-model performance, while large free-rider participation can substantially slow convergence.

  • Experimental setup: The experiments benchmark free-rider attacks across MNIST, CIFAR-10, and Shakespeare using varied model architectures and iid or non-iid settings.The study uses logistic regression for MNIST, a convolutional model for CIFAR-10, and an LSTM for Shakespeare.
  • Experimental setup: The evaluation trains federated models with FedAvg and FedProx, varying local epochs and measuring testing accuracy and training loss.The resulting figures report the effects of free-rider perturbations on final model performance.
  • Attack evaluation: Disguised free-riders return parameters with stochastic perturbations designed to resemble the updates observed between consecutive optimization rounds.The Shakespeare example compares fair clients, a plain free-rider, and disguised free-riders under different noise levels.
  • Attack evaluation: The number of free-riders does not appear to change final-model performance, but it greatly decreases convergence speed.The experiments increase the free-riders from 5 to 45 while retaining 5 fair clients.
  • Attack evaluation: With free-riders up to 50% of total sample size, loss convergence is slightly slower but remains achievable within the predefined iteration budget.At 90%, convergence to the optimum becomes extremely slow and is not achieved within a reasonable number of iterations.
  • Attack evaluation: Free-rider updates produce smaller loss peaks because they regress the update toward the previous global model.The paper attributes the effect to a regularization-like action of free-riders, while noting that peaks are also common with vanilla SGD.
  • Experimental scope: Analogous experimental results are reported for the remaining datasets, training parameters, and FedProx aggregation in Appendix C.

4 Conclusion and discussion

The paper concludes that both plain and stochastically disguised free-rider attacks can converge to the fair participants’ aggregated model. It argues that existing outlier-based defenses are ineffective against updates designed to resemble the global model, while identifying distribution inspection and improved client-heterogeneity modeling as directions for detection.

  • Conclusion: The theoretical framework shows that returning the global model at every iteration can produce a successful plain free-rider attack.
  • Conclusion: Stochastic parameter perturbations provide more sophisticated disguising techniques, whose convergence is supported by theoretical developments and experiments.
  • Implications: Outlier-based defenses would fail to detect free-rider updates designed to be equivalent to the global federated model.
  • Implications: The authors recommend routine inspection of client distributions and better modeling of incoming-client parameter heterogeneity for server-level detection.
  • Limitations and future work: The theoretical setup relies on hypotheses about client-parameter evolution that may need modification for more complex variability and aggregation schemes.

A.1 Proof of Theorem 1

The proof derives the global-model expressions for fair federated learning and plain free-riding, then compares them across iterations. An induction argument establishes the stated relationship between the two optimization processes.

  • Inductive argument: The proof uses induction to establish the relationship between the global-model sequences across server iterations.
  • Model construction: The fair-client global model is obtained from the local-parameter evolution and the server aggregation process.
  • Model construction: The plain-free-rider global model is expressed separately using the same aggregation framework with free-rider updates.
  • Comparison: Subtracting the fair and free-rider expressions yields the difference used to prove the convergence relationship.
  • Inductive argument: The proof applies the derived relation recursively from the initial iteration to subsequent server iterations.

A.2 Proof of Theorem 2

The proof analyzes the expected value and variance of the free-rider process using Gaussian-noise and independence assumptions. It establishes that the asymptotic variance increases with the data volume declared by free-riders and that a key residual term vanishes asymptotically.

  • Variance analysis: The proof decomposes the process into expected-value and variance components under independent Gaussian or Wiener noise assumptions.
  • Asymptotic behavior: The convergence assumption lets the expected-model difference become arbitrarily small after a sufficiently large number of iterations.
  • Asymptotic behavior: The proof bounds the residual term using geometric-sum arguments and concludes that it tends to zero.
  • Variance result: The asymptotic variance is strictly increasing with the number of data points declared by free-riders.
  • Variance result: The variance conclusion follows by comparing polynomial orders in the numerator and denominator of the derived expression.
  • Variance analysis: The argument separately accounts for differences between SGD noise variance with and without free-riders.

A.3 Proof of Theorem 3

The proof analyzes one disguised free-rider under stochastic updates by using Gaussian white-noise assumptions and independence conditions to characterize its asymptotic variance.

  • The proof models the perturbation as delta-correlated Gaussian white noise with zero mean.
  • Independent Gaussian white-noise perturbations have unit variance under the stated assumptions.
  • The perturbations are assumed independent of the fair-client noise, disguised-client noise, and global model parameters.
  • These assumptions yield an asymptotic-variance expression for one disguised free-rider.

A.4 Proof of Corollary 1

The proof extends the stochastic convergence analysis to multiple disguised free-riders by imposing independent Gaussian-noise assumptions across both iterations and free-rider indices.

  • The proof again uses induction to relate federated learning with and without free-riders.
  • For each free-rider and iteration, the perturbations are delta-correlated Gaussian white noises with zero mean.
  • The perturbations are independent across server iterations and free-rider indices, with unit variance under the stated model.
  • The perturbations are independent of the fair-client noise, disguised-client noise, and global model parameters.
  • Under these conditions, the proof derives an asymptotic-variance expression for multiple disguised free-riders.

A.5 Proof of Corollary 2

The proof preserves the convergence argument under the generalized parameterization and shows that the stochastic-gradient noise contribution associated with F vanishes asymptotically.

  • The relation established for the preceding theorems remains valid for Theorems 2 and 3 and Corollary 1 after replacing η_j with its time-dependent form.
  • The relevant noise processes retain delta-correlated Gaussian-white-noise properties and zero expected values.
  • The asymptotic-variance analysis is reduced to the earlier proof while being reexpressed to account for ρ_j(t).
  • The SGD-noise contribution linked to F converges to 0 at infinity.
  • For disguised free-riders, the perturbations remain independent Gaussian white noises with unit variance.
  • The proof concludes after applying the same reasoning used for the expected-value convergence of free-riders.

B Complete Proofs for FedProx

The FedProx proofs adapt the FedAvg convergence analysis by incorporating the regularization parameter µ, which changes both the effective update and the stochastic-noise variance.

  • FedProx generalizes FedAvg, so its free-rider convergence proof reuses the FedAvg argument with the FedProx solver.
  • The FedProx analysis derives the client update and the SGD-noise variance between two server iterations.
  • For FedAvg, setting µ = 0 recovers η′_j = η_j and δ_j = 1 − η_j, while the FedProx coefficients depend on µ.
  • The proof assumes convergence without free-riders and independent delta-correlated Gaussian white noise for FedProx.
  • The asymptotic variance strictly increases with MK.
  • The SGD-noise variance ρ′_j is inversely proportional to the regularization factor µ.
  • Increasing server regularization decreases asymptotic variance and leads to more accurate free-riding attacks.
  • For disguised free-riders, the variance is likewise inversely proportional to µ.

C Additional experimental results

This section presents additional experimental results comparing accuracy and loss across FedAvg and FedProx, using 5- and 20-epoch local-training settings in different scenarios.

  • Accuracy performances: Accuracy results are reported for FedAvg with 20 local epochs across the experimental scenarios.
  • Accuracy performances: Accuracy results are also reported for FedAvg with 5 local epochs across the experimental scenarios.
  • Accuracy performances: FedProx accuracy results are shown for both 20-epoch and 5-epoch local-training settings across the experimental scenarios.
  • Loss performances: Loss results are reported for FedAvg with 20 local epochs and 5 local epochs across the experimental scenarios.
  • Loss performances: FedProx loss results are shown with 20 local epochs and 5 local epochs across the experimental scenarios.
Loading 2006.11901v5…