# DSFR-FL: Detecting Selfish Free-Riders in Federated Learning on Continuous Network Traffic

Houssem Jmal, Kandaraj Piamrat, Yusheng Ji

► To cite this version:

Houssem Jmal, Kandaraj Piamrat, Yusheng Ji. DSFR-FL: Detecting Selfish Free-Riders in Federated Learning on Continuous Network Traffic. DOICT-IndSoc 2026 - International Workshop on Fusion of Data, Operation, Information, and Communication Technology for Industry 4.0 and Society 5.0, IEEE INFOCOM 2026, May 2026, Tokyo, Japan. hal-05505576v2

HAL Id: hal-05505576

https://hal.science/hal-05505576v2

Submitted on 17 Feb 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# DSFR-FL: Detecting Selfish Free-Riders in Federated Learning on Continuous Network Traffic

Houssem Jmal†, Kandaraj Piamrat†, Yusheng Ji‡

† Nantes University, École Centrale Nantes, IMT Atlantique, CNRS, INRIA, LS2N, UMR 6004, Nantes, France

‡ National Institute of Informatics, Tokyo, Japan

**Abstract**—The digital transformation toward Industry 4.0 and Society 5.0 relies on massive deployment of Internet of Things (IoT) devices across industrial cyber-physical systems, creating unprecedented security challenges for mission-critical infrastructures. Effective Intrusion Detection Systems (IDS) are essential for protecting these distributed networks, yet centralized training raises serious privacy concerns. Federated Learning (FL) offers a promising solution by enabling collaborative model training across IoT devices without sharing raw data. However, FL remains vulnerable to selfish free-rider attacks, where clients avoid investing in local training while still benefiting from the global model, degrading overall performance. In this work, we propose DSFR-FL, a framework for detecting selfish free-riders in FL environments for IoT-based IDS on continuous network traffic data. We propose a gradient sensitivity-based detection mechanism that analyzes the geometric properties of local gradients to identify dishonest participants. Experimental results on two IDS datasets demonstrate that our method achieves up to 90% detection accuracy in non-IID settings while maintaining local dataset privacy.

***Index Terms***—Federated Learning (FL), Free-riders, Intrusion Detection System (IDS).

## I. INTRODUCTION

The digital transformation toward Industry 4.0 and Society 5.0 relies on the Internet of Things (IoT) to interconnect cyber-physical systems, industrial devices, and sensors, enabling real-time data exchange and intelligent automation across manufacturing and critical infrastructures. However, this interconnectivity expands the attack surface, making industrial IoT networks vulnerable to cyber threats that can compromise mission-critical operations. Intrusion Detection Systems (IDS) are essential for monitoring network behavior and identifying malicious activities in real time, yet centralized methods do not respect privacy requirements of industrial environments. Federated Learning (FL) emerges as a promising paradigm for privacy-preserving edge intelligence, enabling decentralized IDS by allowing edge devices to collaboratively train detection models without sharing raw data [1]. In FL, each device locally trains a model using its private data and shares only model updates with a central server, which aggregates these updates to build a global model.

However, existing research appears to overlook a fundamental challenge within the IoT FL ecosystem: the acquisition and processing of IoT real-time data. In such dynamic environments, certain clients, referred to as *free riders*, may attempt to benefit from the collaboratively trained global

model while contributing little to no meaningful updates. Unlike malicious participants aiming to disrupt training, free riders primarily seek to exploit the system's outcomes without spending resources, which may slow or hinder the convergence rate of the global model. There are two main types of free riders in the FL system: *anonymous* or *selfish* free riders [2]. The former possess neither local datasets nor computing resources, and they upload random noise to the central server. The latter do possess local datasets and computing resources, but they refuse to contribute these resources to the FL system for training purposes. For instance, [3] proposed a free-rider attack, in which adversaries craft their local model updates to avoid detection. Here, free-riders uploads carefully designed gradients that appear benign yet effectively hinder the convergence of the global model. On the other hand, [4] proposed a framework that leverages inference attacks to detect free riders by inferring information about the underlying training datasets. However, this approach may compromise the fundamental goal of FL, preserving data privacy.

Currently, there are very few studies addressing selfish free-rider attacks in FL. Thus, we introduce DSFR-FL to detect selfish free-riders in FL on continuous network traffic data. Our approach leverages the properties of clients' local gradients to identify selfish behavior. The main contributions of this paper are summarized as follows:

* We propose a selfish free-rider attack model for IoT environments in which clients replicate a limited number of samples to evade existing detection mechanisms.

* We analyze the characteristics of local gradients to determine whether changes after local training are driven by genuine shifts in local data distribution, and use this insight to effectively detect selfish free riders under non-IID settings, without sharing any statistical information about the local datasets.

* Our experimental results show that selfish free riders can significantly degrade the convergence rate of the global model. Moreover, our proposed detection method successfully identifies such clients with an accuracy of up to 90%.

The remainder of this paper is organized as follows. Section II presents a review of the related literature on free-rider detection in FL. In Section III, we formulate the threat model and define the FL objective. Section IV describes our proposed
detection mechanism in detail. Section V reports and discusses the experimental results. Finally, Section VI concludes the paper and outlines possible directions for future work.

## II. RELATED WORK

Free-rider attacks are a critical problem in distributed systems, in particular in FL where their presence hinders the convergence of the global model. To this end, many heuristic methods have been proposed to detect and mitigate the two main types of free-riders, i.e., anonymous and selfish free-riders, focusing on clients behavior and contribution.

In the context of anonymous free-riders, [5] proposed a Zero Trust-based Free Rider Detection framework (ZeTFRi), which focuses on identifying clients that upload emulated model updates as a form of free-riding. These clients generate deceptive updates by adding random noise to the global model using Advanced Delta Weights and Additive Noising attacks. ZeTFRi employs a Deep Autoencoding Gaussian Mixture Model (DAGMM) to compute an energy score from local models and their quality, classifying clients as benign or free riders based on a threshold derived from the mean energy score. In addition, [2] proposed a free-rider attack detection (FRAD) mechanism by combining DAGMM with contribution and reputation, where free-riders also upload fake model weights to the server. The latter incorporates reputation relationships between devices by modeling each client's contribution based on computing resources, communication cost, and data quality. By leveraging the PageRank algorithm, FRAD captures how devices influence each other's perceived reliability. To detect free-rider clients, they combine historical contributions with reputation scores as input to the DAGMM.

Moreover, [6] developed RFFL, a framework that focuses on achieving collaborative fairness and adversarial robustness via a reputation mechanism, in particular, for clients who upload random updates. To ensure reliability, only clients whose reputation scores, calculated using the cosine similarity between local and global model gradients, exceed a predefined threshold are allowed to participate. While effective against random updates, [7] showed that RFFL remains vulnerable to selfish free-riders, where clients submit controlled Gaussian noise or train on public data to gain model benefits without real contribution. Furthermore, [8] proposed FACT, a framework addressing truthfulness in FL. It penalizes free riders using a contract-theoretic approach to ensure clients use their locally optimal data, encourages honest participation through a competitive environment, and incentivizes contribution by offering improved global model performance.

On the other hand, very few works focus on selfish free-riders. In particular, [9] models free riders in wireless networks as clients who avoid FL updates to reduce computation and transmission costs. Each client seeks to maximize its utility, defined as the difference between global model accuracy and participation cost. These conflicting interests are framed as a non-cooperative free-rider game, where Nash equilibrium strategies determine client behavior in FL. Furthermore, [10] proposed a client selection method to mitigate free-riders by

filtering out clients who use only a small portion of their local data. This is done by quantifying the similarity between local and global models using fuzzy logic-based functions, framed as a multi-armed bandit (MAB) problem and solved with Thompson Sampling, under the assumption that all clients use the same amount of data.

To the best of our knowledge, we are the first to address selfish free riders in IoT environments with continuous network traffic data, where clients use only a minimal set of samples and avoid acquiring additional data to conserve energy or limit data sharing.

## III. SYSTEM MODEL

In this section, we introduce the fundamental concepts of FL and the associated free-riders threat model, and we outline the primary objectives of our study.

### A. Federated Learning Model

Consider an IoT network with $I$ end devices and a central server. These end devices are responsible for data collection and model training. Specifically, device $i$ holds a local dataset denoted by $\mathcal{D}_i^{(t)}$ at FL round $t$. Over the course of FL, these datasets are expected to evolve as new data is collected, resulting in dynamic local datasets. Consequently, after $T$ FL rounds, each client updates his local dataset with new samples, i.e., $\Pr[\mathcal{D}_i^{(nT)} \neq \mathcal{D}_i^{(n'T)}] \approx 1$ where $n, n' \in \mathbb{N}$. Besides, end devices leverage their private datasets $\mathcal{D}_i^{(t)}$ to collaboratively train the global model distributed by the server, employing the stochastic gradient descent (SGD) algorithm. Let $\theta^{(t)}$ denote the global model parameters at round $t$, and let $\ell(x, y; \theta^{(t)})$ be the loss incurred by the model on data sample $(x, y)$. The empirical loss over the local dataset $\mathcal{D}_i^{(t)}$ is defined as:

$$ \mathcal{L}_i(\theta^{(t)}) = \frac{1}{|\mathcal{D}_i^{(t)}|} \sum_{(x,y) \in \mathcal{D}_i^{(t)}} \ell(x, y; \theta^{(t)}). \quad (1) $$

The objective of FL is to find global model parameters $\theta^{(t)}$ that minimize the weighted average of the local losses across all participating clients. This can be formulated as follows:

$$ \min_{\theta^{(t)}} \sum_{i=1}^{N} p_i^{(t)} \mathcal{L}_i(\theta^{(t)}), \quad (2) $$

where $p_i^{(t)} = \frac{|\mathcal{D}_i^{(t)}|}{\sum_{j=1}^{N} |\mathcal{D}_j^{(t)}|}$ is the aggregation weight of client $i$.

### B. Threat Model

Here we present the selfish free-riders threat model in FL settings with evolving local datasets.

**Threat Actors.** We consider a free-rider threat model, in which a subset of FL clients $I_{fr}$ acts selfishly with the intent of exploiting the collaborative training process. These clients aim to benefit from the data contributions of honest participants $I_h$ to the global model, while contributing minimal effort themselves. Specifically, they reuse a fixed set of legitimate samples without updating their local datasets over
<figure><img src="image_2.png" /><figcaption>Fig. 1: DSFR-FL Workflow.</figcaption></figure>

time, thereby avoiding the energy costs associated with data acquisition and processing.

**Actors' Capabilities.** In our FL setting, clients are expected to update their local datasets with new and diverse data samples every T global rounds. However, free-rider clients deviate from this behavior by either using only a small, static subset of their actual data or replicating existing samples to simulate an evolving dataset and to save energy. We note that these clients do not perform data poisoning. The central server only receives local models from all clients and do not ask for any statistical information about clients' local datasets.

**Attacker Objective.** The primary goal of free riders is to reduce the effort of dataset maintenance and minimize the amount of data shared during local training. They also aim to benefit from the improved performance of the global model while contributing only a small fraction of their actual data.

**Our Objective.** We aim to detect the set of free-riders $I_{fr}$ based solely on their local model updates. This helps the central server to take appropriate actions, such as issuing warnings or enforcing bans, and select the best clients.

## IV. PROPOSED SOLUTION: DSFR-FL

In this section, we describe the FL process, detailing how clients update their local datasets with new samples and perform local model training (IV-A). We also elaborate the detection mechanism on the server side to identify free-rider clients based on their gradients evolution (IV-B). We illustrate in Figure 1 the different operations for all actors. Throughout the FL process, all participating clients acquire new data and update their training sets (a-Data Acquisition), unlike free-riders who make no effort to contribute additional data. Each client trains a local model using its private dataset and transmits the model parameters to the central server (b-Local Training). The server tracks and aggregates client gradients, then distributes the aggregated results back to the clients (c- Aggregation). It also analyzes the stored gradients to assess their sensitivity to global model updates (d-Investigation).

Finally, this sensitivity matrix is used to detect free riders at the end of the FL process (e-Free-riders Detection).

### A. Client Side

1) **Local Data Acquisition:** Here, we introduce an efficient data acquisition strategy based on pairwise similarity. Honest clients $I_h$ continuously generate new data samples over time, derived from their network traffic, which are temporarily stored in a dedicated auxiliary database $Aux_i$. This ensures that new data is preserved for potential future usage in the training process, while keeping the primary training dataset consistent during each FL round. After each T global rounds, each client updates their training dataset $D_i^{(t-1)}$ by incorporating new, non-redundant samples from $Aux_i$. To ensure that only distinct data are retained, each candidate sample $\tilde{x}_j \in Aux_i$ is compared against the existing training dataset $D_i^{(t-1)}$ using cosine pairwise similarity. A new sample is added to the training set only if its maximum similarity with any existing training sample falls below a pre-defined similarity threshold $\tau$, where $\forall \tilde{x}_j \in Aux_i$:

$$ \max_{x \in D_i^{(t-1)}} \cos(\tilde{x}_j, x) < \tau, \text{ then } D_i^{(t)} \leftarrow D_i^{(t-1)} \cup \{\tilde{x}_j\} \quad (3) $$

Once the filtering and update process is complete, the auxiliary database is cleaned to maintain efficient storage usage. This cyclical process enables clients to gradually enrich their training data while preventing unnecessary storage overhead.

In contrast to honest clients, free-rider clients $I_{fr}$ do not engage in genuine data collection. Instead, they mimic legitimate behavior by duplicating their existing dataset after every T rounds. Specifically, rather than acquiring new data samples, a free-rider client $i$ simply performs: $D_i^{(t)} \leftarrow D_i^{(t-1)} \cup D_i^{(t-1)}$.

2) **Local Training:** At the beginning of each FL round t, all participating clients initiate local training using their private dataset $D_i^{(t)}$ and the global model $\theta^{(t-1)}$. During the j-th local epoch, each client $i$ updates its model parameters via the mini-batch SGD algorithm defined as follows:

$$ w_i \leftarrow \theta^{(t-1)} - \eta \nabla f^j(\xi_i; \theta^{(t-1)}), \quad (4) $$
where $\theta^{(t-1)}$ denotes the global model downloaded at the end of round $t-1$, $\nabla f^j(\xi_i; \theta^{(t-1)})$ is the gradient computed using a randomly sampled mini-batch $\xi_i$ from the local dataset $D_i^{(t)}$, and $\eta$ is the learning rate. After each local epoch, the client updates its record of the minimal observed local loss, $f_i^{\min} = \min(f_i^{\min}, f_i^j)$, and compares it with the current loss $f_i^j$. All clients continuously update their local models until reaching their convergence state, defined as:

$$|f_i^j - f_i^{\min}| \le \epsilon, \quad \epsilon > 0, \qquad (5)$$

which indicates that the local model is considered converged with the stabilization of the local loss [11].

## B. Server Side

1) Gradient Investigation: After completing local training at round $t$, each client $i$ uploads its updated local model $w_i^{(t)}$ to the server along with its aggregation weight. The server then aggregates all received models to compute the new global model $\theta^{(t)}$, which is subsequently distributed to all clients. Besides, the server maintains an estimate of each client's gradient in each round, which is calculated as follows:

$$w_i^{(t)} \approx \theta^{(t-1)} - \eta g_i^{(t)} \rightarrow g_i^{(t)} \approx \frac{\theta^{(t-1)} - w_i^{(t)}}{\eta} \qquad (6)$$

where $g_i^{(t)} = \nabla_{\theta} f(\theta^{(t-1)}, D_i^{(t)})$ is the gradient for client $i$ at round $t$. To identify free-riders, we analyze the geometric properties of each client's gradient vector over time. Specifically, every $K$ global rounds, the server examines the most recent $K$ gradients. To understand the evolution of gradient updates, we begin with a first-order Taylor approximation of the client's gradient at round $t$:

$$g_i^{(t)} \approx g_i^{(t-1)} + \nabla_{\theta}^2 f(\theta^{(t-1)}, D_i^{(t)}) \cdot (\theta^{(t)} - \theta^{(t-1)}), \qquad (7)$$

This relation shows that when the local dataset $D_i^{(t)}$ remains unchanged, variations in the client's gradients mainly result from updates to the global model $\theta$. Hence, we propose a sensitivity metric with respect to changes in $\theta^{(t)}$ as follows:

$$\text{Sensitivity}_i^{(t)} = \frac{1 - \cos(g_i^{(t)}, g_i^{(t-1)})}{\|\Delta\theta_t\|_2} \qquad (8)$$

where $\cos(g_i^{(t)}, g_i^{(t-1)})$ denotes the cosine similarity between the current and previous gradients of client $i$, capturing the alignment of its local updates. The term $\Delta\theta_t = \theta^{(t)} - \theta^{(t-1)}$ represents the change in the global model between two consecutive rounds, thereby normalizing the sensitivity with respect to the magnitude of the global update. A high sensitivity indicates that a client's gradient direction changes significantly in response to small updates in the global model, behavior typically associated with free riders. To track each client's long-term sensitivity, we record a single value every $K$ FL rounds, representing the maximum sensitivity observed within that interval. Specifically, for each client $i$, we maintain a sensitivity history vector $s_i$ that stores these periodic maximum values. At the end of each $K$-round interval, we compute:

$$\text{MaxSensitivity}_i^{(t)} = \max_{t' \in [t-K+1, t]} \text{Sensitivity}_i^{(t')}. \qquad (9)$$

and append this value to the sensitivity record vector:

$$s_i \leftarrow \text{Append}(s_i, \text{MaxSensitivity}_i^{(t)}), \forall i \in I. \qquad (10)$$

2) Free-Rider Detection: To classify clients as honest or free riders, we use Dynamic Time Warping (DTW) to measure the temporal similarity between their sensitivity trajectories. To assess how atypical a client's behavior is, we compute the average DTW distance between client $i$ and all other clients:

$$\bar{d}_i = \frac{1}{N-1} \sum_{\substack{j=1 \\ j \neq i}}^{N} \text{DTW}(s_i, s_j), \qquad (11)$$

Finally, to identify free-riders, we analyze the distribution of the average DTW scores $\bar{d}_i$ across all clients. Honest clients, who typically share similar variability in their sensitivity sequences, will tend to have DTW scores clustered near the mean. In contrast, free-riders' sensitivity sequences deviate significantly from this norm. To classify clients, we define a statistical threshold based on the empirical rule:

$$\text{Threshold} = \mu_{\text{DTW}} + \lambda \cdot \sigma_{\text{DTW}}, \qquad (12)$$

where $\mu_{\text{DTW}}$ and $\sigma_{\text{DTW}}$ are the mean and standard deviation of all DTW distances, and $\lambda$ is a tunable hyperparameter. A client is flagged as a free-rider if its average DTW distance to other clients exceeds this threshold.

# V. RESULTS AND ANALYSIS

## A. Experimental Settings

1) Datasets: To evaluate our approach, we use two benchmark IDS datasets. IoTID20 [12] contains flow-based and general features specifically designed for wireless environments, facilitating the detection of anomalous behavior in IoT networks. It comprises 625,783 instances, of which 93.60% correspond to anomalous activity. The dataset is randomly split into 80% for training and 20% for testing. The second dataset, IoMT-TrafficData [13], captures real-world network traffic from Internet of Medical Things (IoMT) devices. Its training set contains 439,307 samples, with 48.78% labeled as attacks, while the test set includes 146,436 samples, maintaining the same attack-to-benign ratio of 48.78%.

2) Baselines: We compare our detection mechanism against two baseline methods, mentioned previously:

* RFFL [6] utilizes a reputation system to iteratively calculate participants' contributions and reward participants accordingly based on model drift.

* MAB [10] a MABs-based candidate client selection method to intelligently determine clients willing to train the local model.

3) Simulation Settings: Table I summarizes the main parameters used in this study. To simulate the data acquisition phase, datasets are distributed heterogeneously among clients according to a Dirichlet distribution ($Dir(\alpha)$). Each client then randomly partitions its training set into $\frac{FL_{rounds}}{T}$ segments. During the FL process, clients incrementally expand their local datasets by adding new segments following our
<figure><img src="image_3.png" /><figcaption>Fig. 2: Impact of Free Riders on Accuracy Evolution Across 100 Clients</figcaption></figure>

proposed approach. In contrast, free riders use only a single segment throughout the entire process, duplicating their data after each *T* FL rounds. All reported results represent the average of five runs, with free riders randomly selected in each trial. For the intrusion detection task, we employ a multi-layer perceptron (MLP) consisting of three hidden layers. We set $\lambda = 1$ to better separate honest and selfish clients.

<table><caption>TABLE I: Experimental Values</caption><thead><tr><td>Parameter</td><td>Value</td></tr></thead><tbody><tr><td>FL rounds</td><td>50</td></tr><tr><td>Num clients</td><td>50, 100, 200</td></tr><tr><td>Free-riders ratio</td><td>0%, 10%, 20%</td></tr><tr><td>Convergence precision &epsilon;</td><td>0.01</td></tr><tr><td>Learning rate &eta;</td><td>0.001</td></tr><tr><td>Batch size</td><td>24</td></tr><tr><td>Similarity threshold &tau;</td><td>0.9</td></tr><tr><td>Non-IID data distribution</td><td>Dir(1)</td></tr><tr><td>Local data update period T</td><td>2, 4, 8</td></tr><tr><td>Investigation period K</td><td>3</td></tr><tr><td>Empirical rule parameter &lambda;</td><td>1</td></tr></tbody></table>

## B. Detection Results and Analysis

1) **Free-riders Impact:** We first investigate the general impact of free riders on FL and their relation to the local dataset update period, *T*. Figure 2 illustrates the accuracy evolution of 100 clients on both datasets under varying values of *T*. Our initial observation concerns the effect of free riders on convergence speed. As the number of free riders increases, the global model struggles to achieve optimal performance. This degradation can be attributed to two main factors. First, free riders conceal their data, causing the global model to be trained on fewer samples from the overall client distribution. Second, since free riders duplicate their samples to mimic honest clients, the aggregation weights $p_i$, which are directly linked to dataset size, become biased, potentially leading to a skewed global model. Moreover, we observe a degradation in both performance and convergence speed as *T* increases. Since local datasets are updated every *T* FL rounds, a larger *T* makes

the local datasets appear to change less frequently throughout the training process. As a result, the global model may exhibit instability after each update, particularly in the presence of free riders. To mitigate this issue, it is preferable for clients to update their local datasets more frequently, thereby acquiring additional data and enabling the model to converge faster. More dynamic local datasets also make it easier to distinguish the behavior of honest clients from that of free riders. For this reason, we fix *T* = 2 for the remaining experiments.

2) **Detection Rate Comparison:** We compare in Table II our method's detection performance against the baselines using standard metrics: True Positives (TP) and True Negatives (TN) represent correctly identified free riders and honest clients, respectively, while False Positives (FP) and False Negatives (FN) represent honest clients misclassified as free riders and normal clients misclassified as free riders, respectively. First, we observe that our approach significantly outperforms the baseline models, achieving much higher detection rates (TP & TN) and lower FN and FP counts across both datasets and for varying numbers of participating clients. In addition, while some honest clients remain static and do not acquire additional data over time due to the non-IID setting, our method maintains consistency by leveraging the DTW algorithm to detect temporal irregularities in client updates and analyzing the geometric properties of the estimate of local gradients. Unlike existing works that assume adversarial behaviors like free-riding, we evaluate our method without free-riders to reflect realistic conditions. DSFR-FL minimally flags honest clients as free-riders, while RFFL and MAB catastrophically misclassify many honest clients. Moreover, selfish free-rider clients can successfully evade RFFL and MAB, both of which fail to capture this simple selfish behavior. These methods rely on measuring deviations of local models from the global model, however, in non-IID settings, even honest clients may exhibit significant deviations, resulting in false detections.

3) **Non-IID Sensitivity:** We evaluate the robustness of our method under different non-IID settings. Table III presents
<table><caption>TABLE II: Detection rate comparison on the IoTMT and IoTID20 datasets with $T = 2$ (DSFR-FL/RFFL/MAB).</caption><thead><tr><th rowspan="2">Num Clients</th><th colspan="4">No Free-Riders</th><th colspan="4">10% Free-Riders</th><th colspan="4">20% Free-Riders</th></tr><tr><th>TP</th><th>TN</th><th>FP</th><th>FN</th><th>TP</th><th>TN</th><th>FP</th><th>FN</th><th>TP</th><th>TN</th><th>FP</th><th>FN</th></tr></thead><tbody><tr><td>50, (IoMT)</td><td>NaN</td><td><b>48</b>/35/40</td><td><b>2</b>/15/10</td><td>NaN</td><td><b>3</b>/4/1</td><td><b>43</b>/29/42</td><td><b>2</b>/16/3</td><td><b>2</b>/1/4</td><td><b>6</b>/3/5</td><td><b>39</b>/28/36</td><td><b>1</b>/12/4</td><td><b>4</b>/7/5</td></tr><tr><td>100, (IoMT)</td><td>NaN</td><td><b>94</b>/70/84</td><td><b>6</b>/30/16</td><td>NaN</td><td><b>9</b>/2/4</td><td><b>87</b>/65/58</td><td><b>3</b>/25/32</td><td><b>1</b>/8/6</td><td><b>15</b>/5/10</td><td><b>80</b>/60/55</td><td><b>0</b>/20/25</td><td><b>5</b>/15/10</td></tr><tr><td>200, (IoMT)</td><td>NaN</td><td><b>190</b>/155/160</td><td><b>10</b>/45/40</td><td>NaN</td><td><b>18</b>/8/3</td><td><b>176</b>/130/125</td><td><b>4</b>/50/55</td><td><b>2</b>/12/17</td><td><b>30</b>/20/11</td><td><b>159</b>/120/112</td><td><b>1</b>/40/48</td><td><b>10</b>/20/29</td></tr><tr><td>50, (IoTID20)</td><td>NaN</td><td><b>49</b>/34/42</td><td><b>1</b>/16/8</td><td>NaN</td><td><b>3</b>/3/1</td><td><b>45</b>/30/39</td><td><b>0</b>/15/6</td><td><b>2</b>/2/4</td><td><b>6</b>/2/4</td><td><b>40</b>/29/36</td><td><b>0</b>/11/4</td><td><b>4</b>/8/6</td></tr><tr><td>100, (IoTID20)</td><td>NaN</td><td><b>95</b>/68/85</td><td><b>5</b>/42/15</td><td>NaN</td><td><b>8</b>/2/5</td><td><b>90</b>/62/57</td><td><b>0</b>/28/33</td><td><b>2</b>/8/5</td><td><b>16</b>/3/7</td><td><b>80</b>/62/58</td><td><b>0</b>/18/22</td><td><b>4</b>/17/13</td></tr><tr><td>200, (IoTID20)</td><td>NaN</td><td><b>189</b>/149/158</td><td><b>11</b>/51/42</td><td>NaN</td><td><b>19</b>/6/3</td><td><b>173</b>/122/119</td><td><b>7</b>/58/61</td><td><b>1</b>/14/17</td><td><b>28</b>/15/8</td><td><b>150</b>/114/105</td><td><b>10</b>/46/55</td><td><b>12</b>/25/32</td></tr></tbody></table>

<table><caption>TABLE III: Detection Sensitivity to Non-IID degree and number of clients (50/100/200) for IoTID20 dataset.</caption><thead><tr><th></th><th></th><th>TP</th><th>TN</th><th>FP</th><th>FN</th></tr></thead><tbody><tr><td rowspan="3">10% free-riders</td><td>α = 0.2</td><td>3/7/18</td><td>42/88/170</td><td>3/2/10</td><td>2/3/2</td></tr><tr><td>α = 0.5</td><td>3/8/19</td><td>44/89/171</td><td>1/1/9</td><td>2/2/1</td></tr><tr><td>α = 2</td><td>4/8/19</td><td>45/90/175</td><td>0/0/5</td><td>1/2/1</td></tr><tr><td rowspan="3">20% free-riders</td><td>α = 0.2</td><td>5/14/27</td><td>38/78/146</td><td>2/2/14</td><td>5/6/13</td></tr><tr><td>α = 0.5</td><td>6/15/28</td><td>39/80/148</td><td>1/0/12</td><td>4/5/12</td></tr><tr><td>α = 2</td><td>7/16/30</td><td>40/80/156</td><td>0/0/4</td><td>3/4/10</td></tr></tbody></table>

the detection performance of our method across varying $\alpha$ values and client numbers. Overall, DSFR-FL demonstrates robustness to these parameters, maintaining largely consistent detection rates. The method achieves optimal performance under IID settings ($\alpha = 2$). In non-IID scenarios, we observe a marginal decline in performance, particularly in false negatives. At $\alpha = 0.2$, where clients exhibit highly heterogeneous sample distributions and dataset sizes, and certain clients may be unable to contribute additional samples due to data scarcity, despite behaving honestly. Figure 3 presents data acquisition statistics for 50 clients, clearly illustrating this phenomenon. This scenario mirrors real-world conditions where clients may not acquire additional data due to inactivity or resource constraints. Although such clients may resemble free-riders, our approach successfully detects and acknowledges their minimal yet legitimate contributions, thereby ensuring fair evaluation of client participation without penalizing honest participants.

<figure><img src="image_4.png" /><figcaption>Fig. 3: Statistics for number of samples added for honest clients with $\alpha = 0.2$ and 50 clients.</figcaption></figure>

## VI. CONCLUSION

In this paper, we have investigated selfish free-rider attacks in FL for IoT environments with continuous traffic data. By studying the properties of local gradients, DSFR-FL effectively detected free riders. Experimental results showed that free riders with a small set of legitimate samples can successfully disguise themselves as honest participants, evading

detection by current baseline solutions. In future work, we aim to further enhance the detection rate and extend our approach to more advanced selfish free-rider techniques.

## ACKNOWLEDGEMENT

This work was supported by the ANR CHIST-ERA project Di4SPDS-Distributed Intelligence for Enhancing Security and Privacy of Decentralised and Distributed Systems and the JSPS KAKENHI Grant No. JP24K02937.

## REFERENCES

[1] A. Khraisat, A. Alazab, S. Singh, T. Jan, and A. Jr. Gomez, "Survey on federated learning for intrusion detection system: Concept, architectures, aggregation strategies, challenges, and future directions," *ACM Comput. Surv.*, vol. 57, no. 1, Oct. 2024. [Online]. Available: https://doi.org/10.1145/3687124

[2] B. Wang, H. Li, X. Liu, and Y. Guo, "Frad: Free-rider attacks detection mechanism for federated learning in aiot," *IEEE Internet of Things Journal*, vol. 11, no. 3, pp. 4377-4388, 2024.

[3] Z. Zhu, J. Shu, X. Zou, and X. Jia, "Advanced free-rider attacks in federated learning," 2021. [Online]. Available: https://apisemanticscholar.org/CorpusID:260341226

[4] P. G. Recasens, Ádám Horváth, A. Gutierrez-Torre, J. Torres, J. L. Berral, and B. Pejó, "Frida: Free-rider detection using privacy attacks," 2025. [Online]. Available: https://arxiv.org/abs/2410.05020

[5] S. Edirimannage, I. Khalil, C. Elvitigala, W. Daluwatta, P. Wijesekera, and A. Y. Zomaya, "Zetfri—a zero trust-based free rider detection framework for next generation federated learning networks," *IEEE Journal on Selected Areas in Communications*, vol. 43, no. 6, pp. 1938-1953, 2025.

[6] X. Xu and L. Lyu, "A reputation mechanism is all you need: Collaborative fairness and adversarial robustness in federated learning," 2021. [Online]. Available: https://arxiv.org/abs/2011.10464

[7] J. Wang, X. Chang, R. J. Rodriguez, and Y. Wang, "Assessing anonymous and selfish free-rider attacks in federated learning," in *2022 IEEE Symposium on Computers and Communications (ISCC)*, 2022, pp. 1-6.

[8] M. Bornstein, A. S. Bedi, A. Mohamed, and F. Huang, "Fact or fiction: Can truthful mechanisms eliminate federated free riding?" in *Advances in Neural Information Processing Systems*, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, Eds., vol. 37. Curran Associates, Inc., 2024, pp. 69 206-69 229.

[9] Y. E. Sagduyu, "Free-rider games for federated learning with selfish clients in nextg wireless networks," in *2022 IEEE Conference on Communications and Network Security (CNS)*, 2022, pp. 365-370.

[10] R. Lu, W. Zhang, H. He, Q. Li, X. Zhong, H. Yang, D. Wang, L. Shi, Y. Guo, and Z. Wang, "Two-stage client selection for federated learning against free-riding attack: A multiarmed bandits and auction-based approach," *IEEE Internet of Things Journal*, vol. 11, no. 20, pp. 33 773-33 787, 2024.

[11] H. Jmal, K. Piamrat, and O. Auemed, "Tune-fl: Adaptive semi-synchronous semi-decentralized federated learning," in *2025 IEEE 22nd Consumer Communications Networking Conference (CCNC)*, 2025, pp. 1-6.

[12] I. Ullah and Q. H. Mahmoud, "A scheme for generating a dataset for anomalous activity detection in iot networks," in *Advances in Artificial Intelligence*, C. Goutte and X. Zhu, Eds. Cham: Springer International Publishing, 2020, pp. 508-520.

[13] J. Areia, I. A. Bispo, L. Santos, and R. L. Costa, "Ioamt-trafficdata: A dataset for benchmarking intrusion detection in iomt," Jul. 2023. [Online]. Available: https://doi.org/10.5281/zenodo.8116338