SlowGuess/NeurIPS_2023_OCR huggingface dataset:
We do not cover more complicated defense strategies for two reasons: First, our proposed mechanisms will incentivize players to be honest even without any defenses such that more advanced defense mechanisms are not necessary. Second, as defenses can be seen as a method for mean estimation, analyzing the optimality for general classes of defenses would be fundamentally challenging for  $d \geq 3$  due to Stein's Paradox (Stein, 1956), even for a single player version of our game.
4.1 Expected rewards and Nash equilibria
We now analyze the game with strategy set  $(\mathcal{A} \times \mathcal{D})$ . As the specific distribution of  $\xi^i$  does not affect the players' rewards, the attack and defense strategies are for all relevant purposes uniquely determined by the functions  $\alpha$ ,  $b$ , and  $\beta$  respectively. We abuse notation and consider  $(\alpha^i, b^i, \beta^i)$  as the strategy of player  $i$ . First we derive a formula for the MSE of a player, for a fixed strategy profile.
Theorem 4.1. Let  $\mathcal{D}$  be as described above. Then the expected mean squared error (MSE) of player  $i\in [N]$  for any strategy profile  $((\alpha^{1},b^{i},\beta^{1}),\ldots ,(\alpha^{N},b^{N},\beta^{N}))\in (\mathcal{A}\times \mathcal{D})^{N}$  is:
$$
\begin{array}{l} \mathbb {E} \left(\| \theta^ {i} - \mu \| ^ {2}\right) = \left(1 - \beta^ {i}\right) ^ {2} \left(\frac {\sigma^ {2}}{N n} + \frac {\sigma_ {\star} ^ {2}}{N} + \frac {1}{N ^ {2}} \sum_ {j \neq i} \mathbb {E} (a ^ {j} (x ^ {j}) ^ {2}) + \frac {1}{N ^ {2}} \mathbb {E} \| \sum_ {j \neq i} b ^ {j} (x ^ {j}) \| ^ {2}\right) \\ + (\beta^ {i}) ^ {2} \left(\frac {\sigma^ {2}}{n} + \sigma_ {\star} ^ {2}\right) + 2 (1 - \beta^ {i}) \beta^ {i} \left(\frac {\sigma^ {2}}{N n} + \frac {\sigma_ {\star} ^ {2}}{N}\right) \\ \end{array}
$$
This is proven in Appendix C similar to the bias-variance decomposition. This result allows us to analyze the expected rewards defined by equation (2) of the players for any strategy profile.
One can immediately see that there is no incentive for players to cooperate as long as  $\beta^i < 1$ : other players  $j$  can always increase their reward by increasing  $\mathbb{E}(a^j (x^j)^2)$  (unless it is already infinite). But for finite  $\mathbb{E}(a^j (x^j)^2)$  and  $\mathbb{E}\| \sum_{j\neq i}b^{j}(x^{j})\|^{2}$ , the optimal  $\beta^i$  can be shown to never equal one, such that equilibria are only possible "at infinity":
Corollary 4.2. The game defined by the reward in equation (2) and the set of strategies  $\mathcal{A} \times \mathcal{D}$  does not have any (pure or mixed) Nash equilibrium for which  $\mathbb{E}(\alpha^j(x^j)^2)$  and  $\mathbb{E}\|b^j(x^j)\|^2$  are finite for all players.
For details, see Appendix C. This shows that our defenses are unable to prevent maximal dishonesty by at least some players and formalizes a simple intuitive observation: as long as a player considers other players' updates at all, others are incentivized to reduce the information their updates convey about their samples. As at equilibrium at least one other player will infinitely distort the server estimate  $\bar{m}$ , no player can benefit from collaborative learning without modifications to the protocol.
5 Mechanisms for incentivizing honesty
Given the impossibility of successful learning with rational competing agents in the simple mean estimation setting, we shift our focus to modifications of the protocol that allow for honest Nash equilibria (that is, equilibria where  $\alpha^j(x_j) = b^j(x^j) = 0, \forall j$ ). To this end, we design two mechanisms that seek to penalize dishonest players proportionally to the magnitude of their manipulations (and, thus, the damage caused to other players). Note that this is complimentary to robust estimation methods (Diakonikolas et al., 2019) that can reduce but not eliminate the impact of manipulations.
The first relies on explicit side payments and requires transferable utility (that is, the existence of an outside resource  $R$  such as money, that is valued equally and on the same scale as the reward  $\mathcal{R}$  by all players). The second is a modification of the FL protocol, in which the server adds noise to the estimates it sends to players that have sent suspicious updates. Importantly, for both mechanisms, the penalties can be computed by the server without the need for knowing  $\alpha^i$ ,  $b^i$  or other additional information beyond the players' updates, and without prior knowledge of the true distribution  $\mathcal{D}$ .
5.1 Efficient solution for fully transferable utility
We first consider the case of transferable utility. In this case, we introduce a more general penalized reward for player  $i$ , which is given by
$$
\mathcal {R} _ {p} ^ {i} = \mathcal {R} ^ {i} (\theta^ {1}, \ldots , \theta^ {N}, \mu) - p ^ {i} (m ^ {1}, \ldots , m ^ {N}).
$$
Here  $p^i(m^1, \ldots, m^N)$  denotes a penalty paid by player  $i$  to the server, measured in terms of the resource  $R$  and depending on the messages that the clients sent. As players value the reward and resource equally, they optimize for  $\mathcal{R}_p^i$  instead of  $\mathcal{R}^i$ .
Inspired by peer prediction (Miller et al., 2005) we consider a penalty for player  $i$  proportional to the squared difference between that player's update and the average update sent by all players:
$$
p ^ {i} \left(m ^ {1}, \dots , m ^ {N}\right) = C \| m ^ {i} - \bar {m} \| ^ {2}, \tag {6}
$$
for some constant  $C \geq 0$ . This is a natural measure of the "suspiciousness" of the client's update. In order to prevent excessive payments for honest players, we redistribute the penalties as
$$
p ^ {\prime i} (m ^ {1}, \dots , m ^ {N}) = C \| m ^ {i} - \bar {m} \| ^ {2} - \sum_ {j \neq i} \frac {C \| m ^ {j} - \bar {m} \| ^ {2}}{N - 1}
$$
This redistribution also makes it possible to implement our mechanism in a decentrally with messages sent publically, if players are able to credibly commit to the implied payments to other players.
Theorem 5.1 establishes that this penalty can incentivize full honesty for the right choice of  $C$ :
Theorem 5.1. In the setting of Theorem 4.1 for the penalized game with rewards
$$
\mathcal {R} _ {p ^ {\prime}} ^ {i} = \frac {\sum_ {j \neq i} \| \theta^ {j} - \mu \| ^ {2}}{N - 1} - \lambda_ {i} \| \theta^ {i} - \mu \| ^ {2} - p ^ {\prime i} (m ^ {1}, \dots , m ^ {N})
$$
the strategy profile  $\alpha^{j} = b^{j} = \beta^{j} = 0$  for all  $j$  is a Nash equilibrium, whenever  $C > \frac{1}{(N - 1)^2 - 1}$  and maximizes the sum of all players' rewards among equilibria whenever  $\lambda \geq 1$  for all players.
At this equilibrium, the expected penalty  $p^i(m^1, \ldots, m^N)$  paid by each player  $i$  is equal to 0. Each player is incentivized to participate in the penalized game rather than relying on their own estimate, whenever  $N > 2$ , the other  $N - 1$  players participate at the honest equilibrium, and  $\lambda_i > \frac{N}{(N - 1)^2}$ .
Intuitively, our incentive mechanism is effective because  $\alpha^i$  and  $b^{i}$  only affect the first term of the original reward of player  $i$  (equation 2), as well as the penalty, to which they contribute at most as  $\frac{1}{N^2}$  and  $-\frac{(N - 1)^2 - 1}{N^2} C$  respectively. At the honest equilibrium every player's MSE is in  $O\left(\frac{1}{N}\right)$ , such that for large  $N$  a player can strongly improve their own error by joining the collaboration, while barely affecting others' errors. For a complete proof consider Appendix D.1.
Theorem 5.1 shows that our mechanism fulfills two desirable properties: (budget) balance and (ex-ante) individual rationality/voluntary participation (Jackson, 2014). The first property means that the server neither makes a profit nor a loss. The second holds as long as  $\lambda_{i} > \frac{N}{(N - 1)^{2}}$  and the other players take part in the optimization, and means that a player will receive better reward at the game's equilibrium, than when learning with their own data, despite the penalties assigned by the server. While non-honest equilibria exist, these are difficult to coordinate on (as they lack the natural symmetric Schelling point of honesty), while also yielding less total reward summed across players than honesty, such that there is no strong incentive for such coordination.
5.2 Non-transferable utility
We now discuss a way to achieve similar results in the case of non-transferable utility, where players' rewards are not translatable to monetary terms. Instead of modifying players' reward function, we modify the FL protocol, altering the server's messages to players. This effectively results in a robust learning algorithm that the server can implement. We do so by letting the server send noisier versions of its mean estimate to players whose messages suspiciously deviate from the average of all players' updates. The penalization scheme is designed in a way such that players receive expected rewards  $\mathbb{E}(\mathcal{R}^i)$  similar to the expected penalized rewards  $\mathbb{E}(\mathcal{R}_{p'}^i)$  in the previous section. This is conceptually similar to methods against free-riding (e.g. Karimireddy et al. (2022)), which often tie the accuracy of the model a client receives in an FL setting to the client's overall contribution to model training.
Theorem 5.2. Consider the modified game with reward  $\mathcal{R}^i = \frac{\sum_{j\neq i}\|\theta^j - \mu\|^2}{N - 1} -\lambda_i\|\theta^i - \mu\|^2$ , where player  $i$  receives an estimate  $\bar{m} +\sqrt{C}\epsilon^i\| m^i - \bar{m}\|$  for independent noise  $\epsilon^i$  with mean  $\mathbb{E}\epsilon^i = 0$  and "variance"  $\mathbb{E}\| \epsilon^i\| ^2 = 1$ , instead of the empirical mean  $\bar{m}$ , from the server. Then honesty
$(\alpha^i = 0, b^i = 0, \beta^i = \frac{C}{C + 1})$  is a Nash equilibrium, as long as  $C > \frac{1}{\lambda_i(N - 1)^2 - 1}$  and  $\lambda_i > \frac{1}{(N - 1)^2}$ . Furthermore, honesty maximizes the sum of all players' rewards among equilibria whenever  $\lambda_i \geq 1$  for all players.
For fixed  $\lambda_{i} = \lambda, k > 1$  and  $C = \frac{k}{\lambda(N - 1)^2 - 1}$ ,  $\mathbb{E}\left(\|\theta^i - \mu\|^2\right) = O\left(\frac{\sigma^2}{Nn} + \frac{\sigma_\star^2}{N}\right)$  and players are incentivized to participate in the penalized game rather than relying on their own estimate, whenever  $N \geq 2$ , the other  $N - 1$  players participate at the honest equilibrium and  $\lambda \geq 1$ .
Essentially, the noise added by the server increases the expected MSE for player  $i$  by  $C\| m^i - \bar{m}\|^2$ , producing similar incentives as in Theorem 5.1. Theorem 5.2 is proven in Appendix D.2. We obtain voluntary participation if at least two other players participate at the honest equilibrium and  $\lambda > 1$ .
The benefits of modeling clients' rationality Note that at the equilibrium, players' MSEs are of the same order as if all clients honestly communicated their sample means. In particular, when  $\sigma^{*} = 0$  (i.e. homogeneous clients), this is in contrast to known negative results for worst-case poisoning attacks Qiao & Valiant (2018) and single-round Byzantine robustness Alistarh et al. (2018). In this sense, our modified protocol acts as a robust and efficient collaborative learning algorithm. This is possible because our data corruption model is derived by explicitly modeling clients' incentives.
6 Beyond mean estimation: stochastic gradient descent
We now extend the ideas from the last section to multi-round collaborative Stochastic Gradient Descent (SGD) in the FL setting. We show that under stronger assumptions, mechanisms similar to those described in Section 5.1 can still provide arbitrary bounds on manipulations by rational players. Again, this is complimentary to methods for robust federated learning such as median-based gradient aggregation that can reduce but not eliminate the impact of existing manipulations.
6.1 The game and rewards
We consider a  $T$ -round version of the game described in Section 3. The FL protocol is designed to minimize a loss function  $f_{\mathcal{D}}(\theta)$  over a closed and convex set of model parameters  $\theta \in W \subset \mathbb{R}^d$  that contains the global minimizer of  $f_{\mathcal{D}}(\theta)$ . At every time step  $t$ , each player is meant to communicate an update  $g_t(\theta_t^s, x^i)$  with expectation  $\nabla f(\theta_t^s)$ . We denote by  $e_t^i(\theta_t) = g_t(\theta_t^s, x^i) - \nabla f(\theta_t)$  the difference between the gradient and the estimate, which is a deterministic function of  $\theta_t$  for fixed data  $x^i$ , but is assumed to fulfill  $\mathbb{E}_{x^i} e_t^i(\theta) = 0$  for all  $\theta$ , and to be independent across time and players. Intuitively,  $f_{\mathcal{D}}(\theta)$  can be thought of as an expected loss  $\mathbb{E}_{x \sim \mathcal{D}} f_x(\theta)$ , for which player  $i$  computes approximate stochastic gradients as  $\nabla f_{x_t^i}(\theta_{t-1}^s)$  using their  $t$ -th sample  $x_t^i$ . The message sent by player  $i$  is termed  $m_t^i$ . The server averages the received messages to compute a gradient estimate  $\bar{m}_t = \frac{1}{N} \sum_i m_t^i$  and updates the parameter  $\theta$  via  $\theta_{t+1}^s = \Pi_W(\theta_t^s - \gamma_t \bar{m}_t)$ , using a fixed learning rate schedule  $\gamma_t$  and the projection  $\Pi_W$  onto  $W$ . Finally, the server sends the updated  $\theta_{t+1}^s$  to all players.
Strategies and rewards We consider attacks of the form  $m_t^i = g_t(\theta_t^s, x^i) + \alpha_t^i \xi_t^i$ , that is, the true gradient estimate plus random noise of the form  $\alpha_{t'}^i \xi_{t'}^i$ , where  $\mathbb{E} \xi_t^i = 0$ ,  $\mathbb{E} \| \xi_t^i \|^2 = 1$  and  $\xi_t^i$  is sampled independent from the other  $\xi_{t'}^j$  and the algorithm's trajectory. The set of attack strategies  $\mathcal{A}^g$  is then described by the sequence of aggressiveness parameters  $\alpha_t^i > 0$ , which we assume to be selected in advance, independent of the optimization trajectory. Since defenses were already ineffective for mean estimation, we directly focus on mechanisms and only consider adjustments to the server's final estimate for the noise player  $i$  added themselves in the final step  $T$ :  $\theta_{T+1}^i = \theta_T - \frac{\alpha_T^i}{N} \xi_T^i$ . The assumption of non-adaptive strategies is needed to avoid complicated dependencies between successive SGD rounds and more sophisticated attack strategies are beyond the scope of our analysis.
We do not consider a bias term for these attacks. Our unbiased attacks have natural interpretations, both in terms of hiding randomly selected data points and differential privacy defenses, and unlike in the mean estimation case, the effects of a fixed-direction attack on the loss  $f_{\mathcal{D}}(\theta)$  can strongly depend on the current estimate  $\theta_t^s$  and the attack's precise direction, making it substantially harder to analyze such attacks. That said, it is easy to see that if the server aims to optimize  $f_{\mathcal{D}}(\theta_{T + 1})$  and is allowed to shift its estimate  $\theta_t^s$  to defend against fixed-direction attacks at every step  $t$ , the fixed direction attacks would be neutralized by the server at any equilibrium, unless they inadvertently improved  $f_{\mathcal{D}}(\theta_{T + 1})$ .
Given these strategies and a Lipschitz function  $U_{i}:\mathbb{R}^{N}\to \mathbb{R}$ , player  $i$  aims to maximize the reward
$$
\mathcal {R} _ {U} ^ {i} = U ^ {i} \left(f \left(\theta_ {T + 1} ^ {1}\right), \dots , f \left(\theta_ {T + 1} ^ {N}\right)\right). \tag {7}
$$
It is easy to see that this game does not always have an equilibrium and players are often incentivized to lie aggressively. In particular, we recover the mean estimation setting with  $\beta^i = 0$  when setting  $U^i (x) = \sum_{j\neq i}\| \theta -\theta^j\| ^2 -\lambda_i\| \theta -\theta^i\| ^2,T = 1,\theta_1 = 0$  and  $\gamma_{1} = 0.5$  , as  $\frac{d}{d\theta}\| \theta -x_i^j\| ^2 = 2(\theta -x_i^j)$
Our next result establishes that players can be incentivized to be arbitrarily honest, using a penalty scheme similar to the one in Section 5.1. Again, penalties are redistributed such that players' penalties have zero expectation whenever  $\alpha_{t}^{i} = \alpha_{t}^{j}$  for all  $i,j,t$ . We set  $\bar{m}_t = \frac{1}{N}\sum_j m_t^j$  and
$$
\mathcal {R} _ {U _ {p}} ^ {i} = U ^ {i} (f (\theta_ {T + 1} ^ {1}), \dots , f (\theta_ {T + 1} ^ {N})) - \sum_ {t = 1} ^ {T} C _ {t} \| m _ {t} ^ {i} - \bar {m} _ {t} \| ^ {2} + \frac {1}{N - 1} \sum_ {k \neq i} \sum_ {t} ^ {T} C _ {t} \| m _ {t} ^ {k} - \bar {m} _ {t} \| ^ {2}
$$
for constants  $C_t$ . With this penalized reward we prove:
Theorem 6.1. Assume  $f$  is  $B$ -smooth and  $L$ -Lipschitz on  $W$  and  $m$ -strongly convex on  $\mathbb{R}^d$  (See Appendix 2 for definitions of these properties). Also assume that for all  $i$  and  $t$  the gradient noise  $e_t^i$  is  $B'$ -Lipschitz with probability one and that there exist scalars  $M \geq 0$  and  $M_V \geq 0$ , such that for all  $t$ :
$$
\mathbb {E} _ {s _ {i}} \left(\| \left(e _ {t} ^ {i} \left(\theta_ {t} ^ {s}\right) \| ^ {2}\right) \leq M + M _ {V} \| \nabla f \left(\theta_ {t} ^ {s}\right)\right) \| _ {2} ^ {2}. \tag {8}
$$
Set the learning  $\gamma_{t} = \frac{4}{\eta m + tm}$  for an integer constant  $\eta > 1$ , such that  $\frac{4}{\eta m + m} \leq \frac{1}{B(M_V / N + 1)}$ .
Then if  $U^i$  is  $l_1$ -Lipschitz with constant  $L_U$  for all players  $i$ , all player's best response strategy fulfills  $\alpha_i^t \leq \frac{8LL_U N}{C^t(N - 2)m\sqrt{T + \eta}}$  independent of other players' strategies. If  $\alpha_i^i = \alpha_i^j, \forall i,j,t$ , each player's expected penalty is 0. For  $\epsilon > 0$ ,  $C^t \geq \frac{8LL_U N}{\epsilon(N - 2)m\sqrt{T + \eta}}$  yields  $\alpha_i^t \leq \epsilon$  for rational players. In that case, if in addition  $W$  is bounded and we have that  $P(\exists t \leq T: \Pi_W(\theta_t^s - \gamma_t \bar{m}_t) \neq \theta_t^s - \gamma_t \bar{m}_t) \in O(\frac{1}{NT})$ , we get  $\mathbb{E}\left(f(\theta_{T+1}) - f(\theta^*)\right) \in O\left(\frac{1 + M + \epsilon^2}{NT}\right) + O\left(\frac{1}{T^2}\right)$ .
Intuitively, small perturbations of gradient estimates sent to the server should only have a small effect on the final learnt model. Formally, our assumptions allow us to inductively prove bounds on the difference between the values of  $\mathbb{E}f(\theta_{T + 1}^j)$  in a clean  $(\alpha_t^i = 0)$  scenario and a scenario with other values of  $\alpha_{t}^{i}$ . By setting  $C^t$  large enough, we can then ensure that the penalties paid by a dishonest player always outweigh their effect on the final model. The condition on  $\Pi_W$  ensures that SGD is not slowed down by projections and holds for "sufficiently large" distances between the boundary of  $W$  and  $\theta^1$ . See Appendix E.2 for more details on this and the theorem proof. Theorem 6.1 implies that for sufficiently large  $C^t$ , despite all players acting strategically, the model converges at speed comparable to when all clients share clean updates (where the convergence rate is  $O(\frac{1 + M}{NT}) + O(\frac{1}{T^2}))$ , thereby ensuring full learning benefits from the collaboration. Moreover, as long as all players are equally honest, this is achieved with zero expected penalties for players and thus with budget balance.
7 Experimental results
To verify that our mechanisms can work for SGD in the non-convex case we simulate FedSGD McMahan et al. (2017) with clients corrupting their messages to different degrees, and record how players' rewards and penalties are affected by their aggressiveness  $\alpha$  for different penalty constants  $C$ . The  $\alpha_{t}^{i}$  that empirically maximizes a player's reward is an approximate best response for a given  $C$  and fixed  $\alpha_{t}^{j}$  for  $j \neq i$ , and should thus be small for a successful mechanism.
First, we simulate FedSGD, treating each writer as a client, to train a CNN-classifier using the architecture provided by Caldas et al. (2018) for the FeMNIST dataset that consists of characters and numbers written by different writers. Second, we train a two-layer linear classifier with 384 hidden neurons on top of frozen "bert-base-uncased" embeddings on the Twitter Sentiment Analysis dataset from Caldas et al. (2018). In both cases, we randomly select  $m = 3$  clients and compute a gradient estimate  $g_{t}^{i}$  for the cross entropy loss  $f$  using a single batch containing  $90\%$  of the data provided by the corresponding writer at time step  $t < T = 10650^1$ . We test on the remaining  $10\%$  of the data.
${}^{1}T$  was selected as 3 times the number of writers in the FeMNIST dataset,as reported by Caldas et al. (2018).
For both experiments, we randomly split writers into two groups  $A$  and  $B$  containing one and two thirds of the writers respectively, and corrupt the gradient estimates  $(m_t^i)_l = (g_t^i)_l + \alpha_A(\xi_t^i)_l$  sent by players in group  $A$  for each weight tensor and bias vector  $l$  separately, by adding isotropic normal noise  $(\xi_t^i)_l$  with "variance"  $E\| (\xi_t^i)_l\| ^2 = 1$ . We do the same with  $\alpha_B$  for group  $B$ . At each step, the three corrupted gradients are then averaged (weighted by the corresponding writers' datasets' sizes) to  $\bar{m}_t$ , which is used to update our neural network's parameters  $\theta_{t}$  with learning rate 0.06, i.e.  $\theta_{t + 1} = \theta_t - 0.06\bar{m}_t$ . Unlike in our theorems, writers reuse the same data points whenever they calculate gradients. In the clean case  $(\alpha_{A} = \alpha_{B} = 0)$ , our final models achieve a test accuracy of 86% on FeMNIST  $^2$  and 63% on Twitter. We record both the cross-entropy loss  $f$  achieved by the final model  $\theta_T$  on the test set, as well as the sum of the squared deviations  $\| m_t^i -\bar{m}_t\| ^2$  incurred by each individual client  $i$  across all steps. This allows us to calculate the estimated reward  $\mathcal{R}_p^i (C) = f(\theta_T) - \sum_{t = 0}^{T - 1}\mathbb{I}_t(i)C\| m_t^i -\bar{m}_t\| ^2 +\frac{1}{2}\sum_{k\neq i}\sum_{t = 0}^{T - 1}\mathbb{I}_t(i)\mathbb{I}_t(k)C\| m_t^k -\bar{m}_t\| ^2$  received by every player for penalty weights  $C$  held constant over time, where  $\mathbb{I}_t(j)$  is a binary indicator equal to 1 whenever player  $i$  provided an update at time  $t$ .
Figure 3 shows the average reward  $\mathcal{R}_p^i (C)$  received by players in group  $A$  for  $\alpha_{B} = 0$  and  $\alpha_{A}$  varying on the x-axis for different penalty weights  $C$ . It clearly shows that penalization decreases players' gains from adding noise even in the non-convex case, and that near-zero noise is optimal for players given sufficiently large penalty weights  $C$ . At the same time, despite client heterogeneity, the penalties paid by honest players are small: In the FeMNIST experiments, if all players are honest, an overwhelming majority  $(98\%)$  of players end up paying less than 0.0031 on average (over 10 rounds), even at  $C = 0.0002$ . This is an order of magnitude under the increase in loss from moving from  $\alpha_{A} = 0$  to  $\alpha_{A} = 9$ , which is already disincentivized for the substantially smaller penalty constant  $C = 5e - 5$ . On the Twitter dataset, noise has a larger effect on the loss (the loss is degraded by 0.084 already at noise level  $a_{A} = 5$  compared to 0.034 at noise level  $a_{A} = 9$  for FeMNIST). This means that larger penalty weights are necessary to incentivize honesty. Correspondingly, the 98th percentile of penalties paid at the largest considered penalty level  $C = 0.002$  is also larger (0.0243) than on FeMNIST. Additional experimental results can be found in Appendix B.2.
In this paper, we studied a framework for FL with strategic agents, where players compete and aim to not only improve their model but also damage others' models. We analyzed both the single- and multi-round version of the problem for a natural class of strategies and goals and showed how to design mechanisms that incentivize rational players to behave honestly. In addition, we empirically demonstrated that our approach works on realistic data outside the bounds of our theoretical results.