  Free-rider attacks against federated learning consist in dissimulating
participation to the federated learning process with the goal of obtaining the
final aggregated model without actually contributing with any data. This kind
of attacks is critical in sensitive applications of federated learning, where
data is scarce and the model has high commercial value. We introduce here the
first theoretical and experimental analysis of free-rider attacks on federated
learning schemes based on iterative parameters aggregation, such as FedAvg or
FedProx, and provide formal guarantees for these attacks to converge to the
aggregated models of the fair participants. We first show that a
straightforward implementation of this attack can be simply achieved by not
updating the local parameters during the iterative federated optimization. As
this attack can be detected by adopting simple countermeasures at the server
level, we subsequently study more complex disguising schemes based on
stochastic updates of the free-rider parameters. We demonstrate the proposed
strategies on a number of experimental scenarios, in both iid and non-iid
settings. We conclude by providing recommendations to avoid free-rider attacks
in real world applications of federated learning, especially in sensitive
domains where security of data and models is critical.
