Competitive Advantage Attacks to Decentralized Federated Learning
Authors: Yuqi Jia
Minghong Fang
Neil Zhenqiang Gong
Venue: NeurIPS 2025 poster ()
Keywords: Competitive advantage
Decentrailzed federated learning
Attack
Selfish clients
Primary area: general_machine_learning

Abstract: Decentralized federated learning (DFL) enables clients (e.g., hospitals and banks) to jointly train machine learning models without a central orchestration server. In each global training round, each client trains a local model on its own training data and then they exchange local models for aggregation. In this work, we propose SelfishAttack, a new family of attacks to DFL. In SelfishAttack, a set of selfish clients aim to achieve competitive advantages over the remaining non-selfish ones, i.e.,  the final learnt local models of the selfish clients are more accurate than those of the non-selfish ones. Towards this goal, the selfish clients send carefully crafted local models to each remaining non-selfish one in each global training round.  We formulate finding such local models as an optimization problem and propose methods to solve it when DFL uses different aggregation rules. Theoretically, we show that our methods find the optimal solutions to the optimization problem. Empirically, we show that SelfishAttack successfully increases the accuracy gap (i.e., competitive advantage) between the final learnt local models of selfish clients and those of non-selfish ones. Moreover, SelfishAttack achieves larger accuracy gaps than poisoning attacks when extended to increase competitive advantages.

Competitive Advantage Attacks to Decentralized Federated Learning
Yuqi Jia'
Minghong Fang²
Neil Gong'
Duke University, University of Louisville
"yuuq. jia, neil, neil.gong] @duke. 'minghong, fang@louisviile edu
Abstract
Decentralized federated learning (DFL) enables clients (c.g., hospitals and banks) jointly train machine learning models without central orchestration server. In each global training round, each client trains a local model on its own train- ing data and then they exchange local models for aggregation. In this work, we propose SelfishAttack, new family of attacks to DFL. In SelfishAttack, a set of selfish clients aim achieve competitive advantages selfish ones, i.e., the final learnt local models of the selfish clients are more ac- curate than those of the non-selfish ones. Towards this goal, the selfish clients send carefully crafted local models to each remaining non-selfish one in each global training round. We formulate finding such local models as an optimiza- tion problem and propose methods to solve it when DFL uses different aggrega- tion rules. Theoretically, we show that our methods find the optimal solutions to the optimization problem. Empirically, we show that SelfishAttack success- fully increases the accuracy gap (i.e., competitive advantage) between the fi- nal learnt local models of selfish clients and those of non-selfish ones. More- over, Selfish achieves larger accuracy gaps than poisoning attacks when extended to increase competitive advantages. Our code and data are available at: https://gi httpb/gtttuuut/.///// www wwomm/iggaaaa//elle.. shhtttack
the remaining non-
Introduction
In decentralized federated learning (DFL) 8 15
35),
group of clients (e.g..
hospitals or banks) collaboratively train machine learning models without relying on a central server. Each client maintains local model (called pre- pre-aggregation local model), trains using private data, exchanges shared model with others, and aggregates shared models from all clients as new local model (called post-aggregation local model) through an aggregation rule, e.g., FedAvg (24. In non-adversarial settings, all clients converge to identical models after each round. Compared to centralized federated learning (CFL), which requires a trusted coordinator, DFL offers enhanced robustness by eliminating single points of failure and is better suited scenarios, e.g., the clients are hospitals or banks, where clients cannot agree on a central authority.
This paper reveals a new vulnerability in DFL: its decentralized nature opens the door to a unique class of insider attacks, which we call SelfishAttack. this attack, a subset of selfish clients collude to compromise the training process, aiming to: 1). improve their final local models beyond what they could achieve by training among themselves (called utility goal), and 2). outperform the remaining non-selfish clients (called competitive-advantae
goal).
Unlike conventional poisoning attacks B 6
TO B1 13). which assume external adversaries that compromise or inject malicious clients to cause indiscriminate misclassification. SelfishAttack an internal, collusion-based threat. The selfish clients participate fully in the DFL process but selec- tively manipulate only the models shared with non-selfish participants. Their goal is not to poison
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

models outright, but to widen the performance gap in their favor-while still benefiting from col- laboration. This makes SelfishAttack more subtle and targeted than traditional attacks.
For instance, medical DFL. applications such as Alzheimer's diagnosis from 3D brain MRI 28 32
several hospitals may collaborate train diagnostic models. However, few self-interested centers could covertly apply SelfishAttack to gain diagnostic advantages, improving their models by leveraging external updates while degrading those of non-collaborators-all without disrupting the overall training. This scenario underscores the risks of collusion in decentralized systems, where no central authority exists to detect or prevent such subtle manipulations.
To formalize the attack, we cast SelfishAttack as an optimization problem balancing two loss terms corresponding to its dual objectives. The key idea is to craft the shared models sent to non-selfish clients such that: 1). their post-aggregation local models remain close to their pre-aggregation mod- els (ensuring they continue contribute useful updates), while 2). being strategically perturbed to degrade their model performance relative to the selfish group. For aggregation rules such as FedAvg, Median, and Trimmed-mean, we derive the closed-form expressions for the optimal shared models. For more complex rules (e.g., Krum [3), FLTrust [5], FLDetector [37] REA (27), FLAME [25] ) we
adapt these expressions construct effective attacks.
We evaluate SelfishAttack on three diverse datasets, e.g., CIFAR-IO, FEMNIST, and Sent140, and compare it against poisoning- baased baselines adapted to setting. Our experiments show that SelfishAttack can simultancously achieve the utility and competitive-advannae
goals. For example, CIFAR-10 with 30% selfish clients, SelfishAttack improves their final model accuracy by least 11% % over that of the non-selfish clients. Moreover, it consistently outperforms poisoning- based baselines in both absolute model performance and accuracy gap. Our contributions can be summarized as follows:
We propose SelfishAttack, new family of attacks for DFL where selfish clients seek com- petitive advantage and maintain local model utility.
We theoretically derive optimal shared models of selish clients that balance these goals under three aggregation rules, including FedAvg, Median, and Trimmed-men mean.
Experiments on three benchmark datasets show that SelfishAttack effectively achieves both attack goals and outperforms existing poisoning attacks.
2 Preliminaries and Related Work
2.1 Decentralized Federated Learning
In Decentralized Federated Learning (DFL) system, N clients collaboratively train model with- out a central server. Each client h has its own dataset DA and maintains a local model. The training process proceeds in global training rounds, where each round includes three steps:
Step I. Local Training: Each client trains its local model using local data and obtains a pre- aggregation local model thn.
Step II Model Sharing: Client h exchanges shared models ((, to each other client N.. In honest settings, shared models are identical to pre-aggregation local models.
Step III. Model Aggregation: Each client aggregates received shared models using an aggregation rule to update its post-aggregation local model wi.
The process repeats for multiple rounds until convergence. In aon-aaveraa settings, all clients typically converge to the same local model. See Appendix A.I more details.
2.2 Poisoning Attacks FL
Poisoning attacks in FL aim to degrade the performance of global or local models and can broadly categorized into untargeted and targeted attacks. Existing works such as Gaussian attack 3 and Trim attack 100 show that adversaries can manipulate shared models to corrupt learning. We provide further background and details on poisoning attack strategies in Appendix A.2

---

2.3 Robust Aggregation Rules
To defend against adversarial behaviors, several Byzantine- aggregation rules have been pro- posed, including Median (36). Trimmed-mean [36], and Krum [3]. which aim to limit the influence of outlier models. More advanced defenses [5] 27 25 14,
37 [2] like FLTrust [5], FLDetector [37], RFA [27]. and FLAME [25] use additional mechanisms such as trust scoring or clustering. We summarize these defenses in Appendix
15 30
3 Threat Model
We consider colluding subset of clients, termed selfish clients, as the attacker. Their goal is to compromise the DFL training to achieve two objectives: 1). The utility goal: self- ish clients aim to obtain more accurate local models than those learned by training solely among themselves. Formally, let M1 be the local model obtained when selfish clients train solely among themselves, and M2 the model learned when they participate in full DFL. The utility goal requires that M2 is more accurate than M1 2). The paapperrrive-ddvanteee obtain more accurate local models than those of the non-selfish clients, gaining practical benefits such improved service quality increased revenue in competitive domains.
Attacker's goal:
goal: the selfish clients aim to
Attacker's capabilities: A selfish client sends its true pre-aggregation local model other selfish clients but can arbitrarily manipulate the models shared with non-selfish clients. In contrast, non- selfish clients follow standard DFL behavior and share their pre-aggregation local models with all peers. We assume the standard resilience condition N 2 3m = [21], where m is the number of selfish clients and N is the total number of clients. Fig illustrates the attack mechanism.
Attacker's knowledge: As legitimate participants, selfish clients know the aggregation rule and receive the pre-aggregation local models from all non-selfish clients. They also share their own pre-aggregation local models among themselves.
which typi- cally involve external adversaries injecting faulty updates to indiscriminately degrade model perfor- mance, SelfishAttack is an internal, coordinated attack. Poisoning attacks often reduce the perfor- mance of all involved clients, including compromised ones, yielding no competitive advantage. In contrast, SelfishAttack carefully manipulates only selected updates to degrade non-selfish clients' models while maintaining or improving the accuracy of selfish clients' own models. As shown in our experiments, compared to poisoning attacks, SelfishAttack effectively degrades non-selfish clients' performance under robust aggregation, while also giving selfish clients a competitive advantage.
Comparison with poisoning attacks: Unlike traditional poisoning attacks 3 6 10].
4 Our SelfishAttare
4.1 Overview
SelfishAttack is formulated as an optimization problem min- imizing weighted sum of two losses that capture the util- ity and competitive-advanne
goals. The utility loss ensures that non-selfish clients' local models remain close their pre- aggregation versions, preserving valuable training information. loss encourages divergence from the aggregation that would occur without selfish clients, degrading non-selfish clients' models. As the objective is con-differentiable w.r.t. shared models, aggregation local model and then construct corresponding shared models that achieve it under aggregation rules such FedAvg, Median, and Trimmed-mean apply shared models optimized for these three general strategy. Finally, we propose a criterion for deciding when to start attack. Algorithm D
The competitive-advanta
Seffsh
Nom-sellih
cilants
instead derive the optimal post-
Figure 1: An illustration of SelfishAttack. selfish clients share their pre-aggregation models with all; selfish clients send tailored models to non-selfish clients to manipulate their updates.
Non-
other aggregation rules are used,
Appendix shows the complete algorithm.
4.2 Formulating an Optimization Problem
We assume n non-selfish and m selfish clients in the DFL. system, denoted 0, .....,K .,, n + m - 1, respectively. In each round, selfish clients craft shared models to manipulate
and
3

---

the aggregation of target non-selfish client i. Let e; and denote the pre- and pogt-aggre local models of and w; its model had only non-selfish clients participated. Table 4 in Appendix summarizes our important notations.
To achieve the utility goal, selfish clients need to preserve the learning benefits from non-selfish clients. Therefore, they can keep the non-selfish client i's post-aggregation model wy close to its original local model ú0; We quantity this the squared Euclidean distance ||,, - u w; To achieve the cenpetitye-avvantenn they can drive the non-selfish client i's gost-aggregation model away from the model wn; would get without any selfish participants. This is captured by -I|w; w,ll² Finally, the objective is:
goal, selfish clients should reduce the accuracy of non-selfish clients, so
min (192)) bossstr
ww; wn 2 A1lws will?
where w, = (1 Jocksn-m-)) w. = Agg ( (h,) Joshen- 1), A 2 0 is a hyperparameter achieve trade-off between the two attack goals, and the variables of the optimization problem are shared models ((ngs)))ssss++mm sent from selfish clients to non-selfish client i.
4.3 Solving the Optimization Problem
Since the objective function is not differentiable with respect shared models wyy,) for many ag- gregation rules, we reparameterize the optimization over the post-aggregation model w, and solve it dimension- wiie. For each coordinate k, the problem becomes bounded quadratic program accord- ing to wi [k], where [k]] indicates the kth dimension:
min w 1.lkSwwiK (.S.wikss.lll
(1 X)w; [k]] 2(2 Xui (k))) (zb;[[<]²
[x [M]]).
(2)
where un, [A:] and wo [k] denote the lower and upper bounds of uz [k], which will be derived for each aggregation rule. The unconstrained minimizer is p.[k] - and the optimal solution
1-
an [k] is either [k] or clipped to the interval bounds. Formally, we have
P. [k), <A E
[an [wn, [1]]
w
[k]
(3)
w.[k or w. (k), otherwise
The details and proof can be found in Appendix B Then we introduce how craft selfish clients' shared models they send to each non-selfish client i to achieve the optimal solution w [k] when using FedAvg, Median, or Trimmed-mest mman as the aggregation rule.
4.4 Attacking FedAvg
FedAvg not robust, so the selfish clients can make wr[kk arbitrary. To avoid being easily detected, we define upper and lower bounds as [K(k] = maxochga-1 W(x,)) [k] and
Bound derivation:
w, [k] = minoghgn (Pt..)) [k).
Shared model construction: After computing the optimal target w [k] via Equation 3
we set
m 1 selfish clients' values to w [k]], and solve for the last one to ensure the kth dimension of the post-aggregation local model of client becomes un [k)]. Therefore, we have:
(m++1,0) [k] = Wn 1.0) [k] = = [k), (m. [k] = (n + 1) w
Σ h=0
w [k]. (4)
In Theorem 2 in Appendix, we prove that the shared models crafted using Equation constitute the optimal solution the optimization problem in Equation] []
4.5 Attacking Median
Bound derivation: Since Median discards outliers and m < N/3, the aggregated value wi(Ai [k] lies within bounded range. We sort the kth-dimensional shared models from non-selfish clients to i in descending order as [k] 2 ... 2 1)==1)a(k]] [k). When m values shared by selfish clients are larger than qox [k], the median reaches its maximum; when m values are smaller than 1)= [k]. the median is minimized. Hence, the upper and lower bounds are:
1 { p-m [k] + - [k]),
W. [k]
az [k]
2 (9
-
[k] + 9 2 [t). (5)
2

---

Part
Part
(( 1)s Rd
4im- [e]
41--1y [R]
9r [k]
Figure 2: Example of selfish clients crafting shared models attack Trimmed-mes mean. Values in-
crease from left to right. Arrows indicate the shared model parameters of selfish clients. Parameters
within the two grey regions will be filtered out by a non-selfish client.
Shared model construction: Our goal is to craft m selfish clients" shared values such that the median equals w [k:] A simple strategy to set all m values to w [k], which works when the median falls exactly at this value. However, when the total number of clients is even and w [k] lies between the two middle elements of the aggregated sequence, the resulting median deviates. Specifically, if wi[ the final median becomes the average of w [k] and either qui(k) or qoa
[M]] w. [K:]] or [wc [k], Qui [k]], where u |" and t [
2
[k], which not the exactly w [k]. To address this, set m-1 selfish clients values to w. [k] and adjust one value (c.g.,
(n. kk]), like the following:
w (n [kc]
W (n++m 1,1) [A:] w [k].
2w [k|] que
if w [A] > qus [k]]
(6)
w [n.i)]k]
=
2w; [k] [k),
if w [k] < q [k],
wn [k]:
otherwise.
We prove that the above design guarantees that the overall median equals wo [k] in Appendix D
4.6 Attacking Trimmed-mean
Bound derivation: In Trimmed-mean, each client drops the largest and smallest e values per dimension and averages the remaining ones. We assume c m, the number of selfish clients, which gives advantages to non-selfish clients. Given m N/3, w: wi[k] has bounded range. Similar to attacking Median, denote qoi[k] [k] 2 ... 2 Q[n-1)s(k) [k] the sorted values from non-selfish clients. all ma selfish values are set above qo: [k] (or below ((n-1)e(k) (k), they get trimmed, leading to the following bounds:
n mm
n
wi
w [k]
Tha [ka
n
m
n2
m
Shared model construction: After computing [T].,, design selfish models that the
trimmed mean equals [k). Our intuition is, to manipulate Trimmed-mean, selfish clients can divide their shared models into two groups: one deliberately crafted to be filtered out, and the other carefully adjusted to influence the final aggregation. By balancing the number and values of unfiltered shared models, the attacker ensures that the trimmed mean equals the desired target w [k], while maintaining stealth under the aggregation rule's 's robustness. Therefore, we split the parameters of the kth dimension of selfish clients' shared models into two parts: Part I selfish model parameters are extreme values that get trimmed, and Part Il selfish model parameters are values included in the aggregation, tuned to steer the average. We discuss two cases craft the selfish models.
Case I: w [k] < w [K)] We set Part I selfish model parameters to smaller than q(n- ()x so they will be trimmed, and set remaining (n-r) Part values to:
(n m)w; [K] Ex=L. q [A]
c
(8)
n r with r is the largest integer to ensure n m S r S n and wi S
n-m - ((n - r)- q)m-1)((k] +
Ex=hn [k)) summary, we have:
an- 1yr [k] - b
2n 2n 2n-rsjsntma
w [k]
(9)
[j[k],
n S f 2n-r-1
where b is a positive constant to guarantee that W() [k] smaller than I(n [k), e.g., in our experiments. Figure shows an example of crafting selfish clients' shared models.
5

---

Case II: [k] > w; [k]. In this case, we aim to increase the trimmed mean. We set Part I selfish model parameters be larger than qo: [k] they will be trimmed, and set the remaining (r+1) Part II values to:
" (n- m.) u0; [k]
qha
c:
[k]
1=++1
(10)
where is the smallest integer such that -1 S S and 1t [k]
- ((++1)
(
Q(n-m)i [K]
n-m
E 21 [hi(k]). This ensures that Part II values are not filtered out. Formally, construct:
wG.n 1
qos [A]] + b, [b],
n mtr+lsje n
(11)
n m
where b is a positive constant to guarantee that wG.i) [k] is larger than go:
This design ensures all Part I selfish model parameters are trimmed and Part II parameters dominate the aggregation, yielding w. [k] = w [k]. See Appendix for detailed proof.
4.7 Attacking Other Aggregation Rules
For non-coordinate-wise aggregation rules (e.g.. Krum, FLTrust, FLDetector, RFA, and FLAME), exact optimal shared models difficult derive. These rules treat model parameters holisti- cally using non-differentiabl mechanisms like Euclidean distance scoring (e.g., FLTrust, FLDe- tector, RFA) clustering-based aggregation (e.g., Krum, FLAME), making hard optimize per-dimension as we do for coordinate-wise rules. To demonstrate the transferability of SelfishAt- tack and its robustness against unknown rules, selfish clients can still use shared models crafted for FedAvg, Median, or Trimmed-mean (we use FedAvg in experiments). We also tailor our attack for FLAME, described in Appendix [] While these attacks may not be optimal, experiments show they remain effective.
4.8
When to Start Attack
If selfish clients attack too early, non-selfish clients may fail to learn good local models, limiting the usefulness of the shared models and hurting the utility goal. To avoid this, design mechanism to determine when selfish clients should start attacking. The core idea is to wait until clients have learned sufficiently accurate local models. In each global round selfish clients share their local training losses 1/0) Each client then computes the average loss and tracks the minimum value z(0) time. When the decrease in 7(t) over the past I rounds becomes small- smali-specifiially, less than an e fraction of the maximum decrease observed-selfih clients begin attacking by sending crafted models. This indicates that training has stabilized and clients likely have decent local models. The timing is controlled by two hyperparameters, and 1, whose effects are analyzed Section] J
5 Evaluation
5.1 Experimental Setup
Datasets: We evaluate the proposed SelfishAttack on three benchmark datasets CIFAR-IO 20 and FEMNIST [4) for image classification, and Sent140 [16] for text classification. Detailed dataset descriptions are provided in Appendix [F]
Aggregation rules: A client can different aggregation rules to aggregate the shared models
as a post-aggregation local model. We evaluate SelfishAttack under diverse set of aggregation rules, including both standard and Byzantinerrobust methods: FedAvg (24), Median [36), Trimmed-
mean (36), Krum 33, FLTrust [3]. FLDetector (37], RFA [27] and FLAME 25 Detailed descrip-
tions of these rules provided in Appendix G
DFL parameter settings: We assume 20 clients by default, including 6 selfish and 14 non-selfish ones. Clients train CNN on CIFAR-10 and FEMNIST, and an LSTM [8] on Sent140. The CNN and LSTM architectures are shown in Tables 5a 5b and 6 in Appendix. Training hyperparameters summarized in Table 7 in Appendix. We simulate non-lID for CIFAR-10 following [10] with

---

Table Results (MTASIMTTANS/Gap)) under different aggregation rules across datasets.
Dataset
Method
Fod-Ag
Median
Trimmed-mean
No attack
0.627 0.627 0.0000
0.644 /0644 / 0.000
0.644 / 0.644 00,000
Independent
0.321 /0.014
0.321 /0,307 00001
/0.307
Two Coalitions
0.505 0,577 / -0.077
0.505 0.578 -0.073
0,505 / 0.578 -0.073
CIFAR-10
TrimAttack
0.207 0.165 0.043
0,524 0.511/ 0.0011
0.456/ 0.440 0.016
GaussianAttack
0,05K 0.089/ / 0.008
0.619 (5699/0617/000 0.0001
0.609 000000
SelfishAttack
0.375/0.326/ 0.150
0.543 /0.425/ / 00.19
0.597 / 00444///4/// 0.113
No attack
0.790/0.750/ 0.0000000000000 0.000
0.791 /0.791 / 0.0000
0.795 / 0,795 0.000
Independent
0.543/0.545 /0.000
0.54// -0.002
0.543/ 0.545 /-0.002
Two Coalitions
0.755/0,784/ /0.022
0,755 -0.029
0.755/ 0.755/0.784 0.784 -0,029
FEMNIST
TrimAttack
0.056 0.055 0.001
0.751 0474 000010
0.744/ 0.736/ 0.008
GaursianAttack
0.0028 / -0.022
0.788 7.785/ 0.003
0.793 / 0.789/ 0.003
SclfishAttack
0.,57 0.123
0.771 /0.643// / 0,128
0,792/ 0.747 0,045
No attack
0.791 0.791 / 0.0000
0,824 0.824 0,0000
0.788 / 0.788/ 0.000
Indopendent
0.631/0.637 /00000
0.631 / 0.637 -0.006
0.631 0.637 -0.000
Two Coalitions
0.751 /.7991 / /0.039
0,751 0.791 -0.039
0.751 0231/0.77 0.791 -0,039
Sent140
TrimAttack
0,740 0.715 0.025
0.760 / 763 / 0.0033
0.771 / 7.766 / 0.006
GausstanAttack
0.807
0,000
0.785 0.785 0.000
SelfishAitack
0.799 0.647 0.152
0,804 0.683/ 0,121
0.816 0.730/ 0.085
P 0.7 (details in Appendix Hp. FEMNIST and Sent140 are naturally non- non-IlI, needed. All the experiments are finished on one single Quadro RTX 6000 GPU with 24GB memory.
simulation is
Parameter settings for SelfishAttacke By default, we set = 0.0 for FedAvg. À = 0.5 for Median, and X = 1.0, b 1.0 for Trimmed-mean, they use different aggregation strategies. Since selfish clients know the rule used in DFI., they can adjust À accordingly. We fix e = 0.1 and = 50 across all aggregation rules, and report CIFAR- 10 results unless stated otherwise. By default, selfish clients adopt the same aggregation rule and use all shared models, but we also explore cases where they use different aggregation rules or only their own shared models for aggregation.
We use three metries: mean test accuracy of selfish clients (MTAS), mean test accuracy of non-selfish clients (MTANS), and their difference (Gap = MTAS -MTANS) MTAS and MTANS are the average accuracies of selfish and non-selfish clients' local models:
Evaluation metries:
MTAS 1
7-m
Σ j=n
ACC(wj,
MTANS = n. Σ 0===0-=AAC(uus D),
m
where ACC(w, D) denotes client i's test accuracy with local model w, testing set D. Note that selfish clients share the same final model, while non-selfish ones may differ.
5.2 Compared Methods
Independent. Each client independently trains local model using its local data without DFL.
Two Coalitions. This method divides the clients into coalitions: selfish clients and non-selfish clients. Clients within the same coalition collaborate using DFL with the FedAvg aggregation rule. This scenario means that selfish clients do not join DFL together with non-selfish clients.
TrimAttack [00. TrimAttack was originally designed as a model poisoning attack to CFL. We extend it to our problem setting. Specifically, selfish clients use TrimAttack to craft shared models sent to non-selfish clients such that the post-aggregation local model of a non-selfish client after attack deviates substantially from the one before attack, in terms of both direction and magnitude.
GaussianA Atack [3]. selfish client sends random Gaussian vector as a shared model to a non- selfish client. Each dimension of the Gaussian vector is generated from normal distribution with zero mean and standard deviation 200.
5.3 Main Results
SelfishA ttack achieves both attack goals: Table Summarizes the performance of SelfishAttack and baselines across different datasets and aggregation rules. "No attack" indicates selfish clients behave honestly by sending their own local models. In summary, our results demonstrate that Self- ishAttack successfully achieves both the utility and competitive-advantee goals.
7

---

First, selfish clients achieve higher accuracy when collaborating with non-selfish clients under Self- ishAttack, compared to training only among themselves (Two Coalitions), confirming the utility goal. For example, under Median and Trimmed-mean, MTASs of SelfishAttack are consistently higher than those of Two Coalitions across all datasets. The exception FedAvg on CIFAR- 10/FEMNIST. This is because FedAvg is not robust, in which the post-aggregation local models of non-selfish clients are negatively influenced by shared models from selfish clients too much.
Second, SelfishAttack effectively increases the gap between the mean accuracy of selfish and non- selfish clients, achieving the competitive-advanee most cases, showing clear competitive advantage. On CIFAR-10, for instance. Gaps reach 15.0%, 11.9%, and 11.3% under FedAvg, Median, and Trimmed-men mean, respectively.
goal. Particularly, the Gap exceeds 10% in
SelfishAttack consistently outperforms existing attacks: TrimAttack and Gaussian pro- duce negligible or even negative Gaps in most cases, especially under robust rules like Median. AaussianAtttak performs poorly under robust aggregation rules like Median and Trimmed-mean, and achieves low MTAS under FedAvg. In contrast, SelfishAttack allows selfish clients benefit from useful shared models provided by non-selfish clients, improving their local models. TrimAt- tack fails in this regard, as non-selfish clients learn inaceurate models and propagate poor updates, resulting in low accuracy for both selfish and non-selfish clients, and thus smaller Gaps.
Aggregating shared models from all vs. selfish clients only: By de- fault, selfish clients aggregate shared models from both selfish and non- selfish clients. However, attacks like TrimAttack and GaussianAttack can degrade their local model accuracy, as they hinder non-selfish clients' learning and introduce harmful shared models into aggregation. To avoid this, selfish clients may choose to aggregate only models from selfish clients. In Table 2 "All" refers to aggregating from all clients, and "Selfish" means using only selfish clients' models. Selfish clients use FedAvg to enhance accuracy, while non-selfish clients use Trimmed-mean for robustness. SelfishAttack benefits from aggregating all shared models, as it still preserves useful information from non-selfish clients. In contrast, TrimAttack performs better when selfish clients exclude non-selfish models, which are degraded under attack. Overall, the best strategy is to use SelfishAttack and aggregate from all clients.
Table 2: MTAS/MTANS/Gap when a selfish client aggre- gates all vs. only selfish clients' models.
Info.
TrimAttack
GausstanAttack
SellishAttack
All
0.456/ 0.016
0.613
0.004
0.597 00444//4///// 0.113
Sellish
0,540/ 0.440 0,100 0.540 0.609
/ -0,069
0.540 / 0.484 0.005
5.4 Ablation Studies
This section presents ablation studies on SelfishAttack, examining the impact of X, degree of non-IID data, fraction of selfish clients, and other aggregation rules. Appendix further explores the impact of and 1, total number of clients, and aggregation rule used by selfish clients.
Impact of X: Fig. shows how À in Equation I Jaffects the Gap under different aggregation rules. For robust aggregation rules like Median and Trimmed-mean, increasing À initially increases the Gap, as more emphasis is placed mean on CIFAR-10, the Gap rises from 6.2% at A=0.5 to 11.3% at 1=1.0. However, beyond a threshold, e.g., A>0.5 for Median or 1.0 for Trimmed-mean, the Gap drops because overly degraded non-selfish models harm the selfish clients' local models in later rounds.
the competitive-advantaa goal. For example, with Trimmed-
Impact of NID- degree: Fig. 4 shows that SelfishAttack consistently outperforms other attacks on CIFAR-IO across various Non-IID levels and aggregation rules. For instance, when attacking Median, Selfish maintains at least 5% higher Gap than all baselines. Other attacks typically yield Gaps near zero, except for TrimAttack under FedAvg with moderate Non-IID (e.g., 0.5 or 0.7). As the Non-III level increases, SelfishAttack becomes more effective, except for FedAvg where the Gap slightly declines from NID-IID 0.7 to 0.9 due to aggregation instability. Still, SelfishAttack achieves 7.2% Gap under FedAvg the highest Non-IIID level.
Impact of selfish client fraction: Fig. 5 shows the impact of the selfish client fraction. Self- ishAttack consistently outperforms other attacks across aggregation rules and different fractions. Compared attacks generally yield Gaps close to O, except TrimAttack on FedAvg. For SelfishAt- tack, the Gap remains stable under FedAvg but increases with more selfish clients under Median
8

---

CEADO STIE
CEAD0
00.00
Dbp
1483
0.00
0000
0.00
-000
-0.0
-0.00
(a) FedAvg
(b) Median
(c) Trimmed
mean mean
Figure 3: Impact of À Gap of SelfishAttack when DFL uses different aggregation rules.
3.20
0,30
3:23
-Bh Drmmen
Canoonl Lock
Grmve Alain
8 3.00
3.00
365
0.66
365
400
0.00
300
Degree of Non ILD
Degne NonilU
Degro of Nos IID
(a) FedAvg
(b) Median
(c) Trimmed- mean
Figure 4: Impact of the degree of Non-IID on Gap when DFL uses different aggregation rules.
Tiu srack
3.00
0.10
3.04
010
0100
15
16
21
20
Pradio dooctii dians (1)
Frodion of adiak cleats
Bacia of sollib deana
(a) FedAvg
(b) Median
(c) Trimmed mean
Figure 5: Impact of the fraction of selfish clients Gap when DFL uses different aggregation rules.
and Trimmed-mean. This is because more selfish clients enlarge the upper and lower bounds in Equations 5 andd] 7 expanding the attack range and improving effectiveness.
Attacking other aggregation rules: Ta- shows that SelfishAttack remains effective when non-selfish clients use Krum, FLTrust, FLDetector, RFA, or FLAME. Selfish clients apply tailored version for FLAME (detailed in Appendix []. or the FedAvg-based version of SelfishAttack for other aggregation rules. In all cases, SelfishAttack achieves notable Gaps (c.g., 18.9% for Krum, 15.1% % for RFA, and 10.5% for FLAME), indicating SelfishAttack can transfer to these aggregation rules.
Table 3: Results of attacking other aggregation rules used by the non-selfish clients.
Aggregation Rule
MTAS
MTANS
Gap
Krum
0.545
0.356
0.189
FLTrust
0.537
0.469
0.069
FLDetcctor
0,556
0.439
0.118
RFA
0.484
0.333
0.151
FLAME
0.525
0.420
0.105
6 Conclusion, Limitations, and Future Work
In this paper, we propose SelfishAttack, the first competitive advantage attack for DFL. In SelfishAt- tack, selfish clients craft shared models to 1). learn more accurate local models than performing DFL among themselves, and 2). outperform non-selfish clients. These models are generated by solving an optimization problem that balances two attack goals. Experiments on three benchmarks show that SelfishAttack achieves both attack goals and outperforms conventional poisoning attacks. However, while SelfishAttack effective across various aggregation rules, its optimality is unknown for non- coordinate-win rules (e.g., Krum, FLAME).. Future work includes developing attacks that adapt to unknown dynamic aggregation rules, extending SelfishAttack to broader settings, and designing defenses against SelfishAttack.

---

Acknowledgement
We thank the anonymous reviewers for their constructive comments. This work was supported by NSF under grant no. 2131859, 2125977, 2112662, and 1937787.
References
[1] Eugene Bagdasaryan, Andreas Veit, Yiging Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In AISTATS, 2020.
[2] Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing
federated learning through an adversarial lens. ICML, 2019.
[3] Peva Blanchard, EI Mahdi EI Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In NeurIPS, 2017.
[4] Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečný, H Brendan McMahan, Virginia Smith, and Ameet Talwalkar. Leaf: benchmark for federated settings. 2018.
arXiv preprint arXiv:
[5] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS, 2021.
[6] Xiaoyu Cao and Neil Zhenqiang Gong, Mpaf: Model poisoning attacks to federated learning based on fake clients. In CVPR Workshops, 2022.
[7] Xiaoyu Cao, Zaixi Zhang, Jinyuan Jia, and Neil Zhenqiang Gong. Flcert: Provably secure federated learning against poisoning attacks. IEEE Transactions on Information Forensics and Security, 17:3691-3705. 2022.
[8] Rong Dai, Li Shen, Fengxiang Hc, Xinmei Tian, and Dacheng Tao. Dispfl: Towards communication--ffccientt personalized federated learning via decentralized sparse training. In ICML, 2022.
[9] Cheng Fang, Zhixiong Yang, and Waheed U Bajwa. Bridge: Byzantine-resilient decentralized gradient descent. arXiv preprint 1908v:19080000000 2019.
[10) Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantine-robust federated learning. In USENIX Security Symposium, 2020.
(11) Minghong Fang, Jia Liu, Neil Zhenqiang Gong, and Elizabeth S Bentley. Aflguard: Byzantine- robust asynchronous federated learning. ACSAC, 2022.
[12] Minghong Fang, Seyedsina Nabavirazavi, Zhuqing Liu, Wei Sun, Sundararaja Sitharama Iyen- gar, and Haibo Yang. Do we really need to design new byzantine-robust aggregation rules? In NDSS, 2025.
[13] Minghong Fang, Minghao Sun, Qi Li, Neil Zhenqiang Gong, Jin Tian, and Jia Liu. Data poisoning attacks and defenses to crowdsourcing systems. In The Web Conference, 2021.
[14] Minghong Fang, Xilong Wang, and Neil Zhenqiang Gong. Provably robust federated rein- forcement learning. In The Web Conference, 2025.
[15] Minghong Fang, Zifan Zhang, Hairi, Prashant Khanduri, Jia Liu, Songtao Lu, Yuchen Liu, and Neil Gong. Byzantine-robust decentralized federated learning. In CCS, 2024.
[16] Alec Go, Richa Bhayani, and Lei Huang. Twitter sentiment classification using distant super- vision. CS224N project report, Stanford, 2009.
[17] Shangwei Guo, Tianwei Zhang, Han Yu, Xiaofei Xie, Lei Ma, Tao Xiang, and Yang Liu. Byzantine-resilient decentralized stochastic gradient descent. IEEE Transactions on Circuits and Systems for Video Technology, 2021.
10

---

[18] Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. In Neural computation, 1997.
[19] Yuqi Jia, Saeed Vahidian, Jingwei Sun, Jianyi Zhang, Vyacheslav Kungurtsev, Neil Zhenqiang Gong, and Yiran Chen. Unlocking the potential of federated learning: The symphony of dataset distillation via deep generative latents. In European Conference on Computer Vision, pages 18-33. Springer, 2024.
[20] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[21] Leslie Lamport, Robert Shostak, and Marshall Pease. The byzantine generals problem. In Concurrency: the works of leslie lamport, 2019.
[22] Yann LeCun, Corinna Cortes, and CJ Burges. Mnist handwritten digit database. Available: http::/yyann. lecun. com/exdb/mnist, 1998.
[23] H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, et al. Communication- efficient learning of deep networks from decentralized data. In AISTATS, 2017.
[24] H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera Ar- cas. Communication--fficcenn learning of deep networks from decentralized data. In AISTATS. 2017.
[25] Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Brandenburg, Hos- sein Yalame, Helen Möllering. Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. Flame: Taming backdoors in federated learning. In USENIX Security Symposium, 2022.
[26] Jeffrey Pennington, Richard Socher, and Christopher D Manning. Glove: Global vectors for word representation. In EMNLP, 2014.
[27] Krishna Pillutla, Sham M Kakade, and 7aid Harchaoui. Robust aggregation for federated learning. IEEE Transactions Signal Processing, 70:1142-1155 2022.
[28] Abhijit Guha Roy, Shayan Siddiqui, Sebastian Pölsterl, Nassir Navab, and Christian Wachinger. Braintorrent: A peer-to-peer environment for decentralized federated learning. arXiv preprint arXiv: /905.0673,, 2019.
[29] Zhaoxian Wu, Tianyi Chen, and Qing Ling. rezinntn decentralized stochastic opti- mization with robust aggregation rules. arXiv preprini wwXiv:2206.04568 2022.
[30] Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error. In International Conference on Machine Learning, 2024.
[31] Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong, Model poisoning attacks federated learning via multi-round consistency. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 13454-15463, 2025.
[32] Ekin Yagis, Luca Citi, Stefano Diciotti, Chiara Marzi, Selamawet Workalemahu Atnafu, and Alba G Seco De Herrera. 3d convolutional neural networks for diagnosis of alzheimer's 's disease via structural mri. In 2020 IEEE 33rd International Symposium on Computer-Bon Based Medical Systems (CBMS), pages 65-70. IEEE, 2020.
[33] Zhixiong Yang and Waheed U Bajwa. Byrdie: Byzantine-resilient distributed coordinate de- scent for decentralized learning. IEEE Transactions on Signal and Information Processing over Networks, 2019.
[34] Zhixiong Yang, Arpita Gang, and Waheed U Bajwa. Adversary-resilien distributed and de- centralized statistical inference and machine learning: An overview of recent advances under the byzantine threat model. In JEEE Signal Processing Magazine, 2020.
[35] Gokberk Yar, Cristina Nita- NotarRotaru, and Alina Oprea. Backdoor attacks in peer-to-peer feder- ated learning. arXiv preprint 2rX1v:2301.09732. 2023.

---

[36] Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust dis- tributed learning: Towards optimal statistical rates. In ICML, 2018
[37] Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fidetector: Defending federated learning against model poisoning attacks via detecting malicious clients. In KDD, 2022.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims in the abstract and introduction that SelfishAttack a new family of attacks to DFL that gives selfish clients competitive advantage fully supported by both the theoretical formulation and empirical results in Sections
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
fine to include aspirational goals motivation as long it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We discuss limitations in Section We further have a 'Discussion and Limi- tations' Section in Appendix
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The au- thors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to ad- dress problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't it acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and prool's
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
13

---

Answer: [Yes]
Justification: Theoretical results such as the optimal solution to the optimization problem are provided in Section with detailed derivations and formal proofs in Appendix B
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theo- rems.
The proofs can either appear the main paper or supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be comple-
mented by formal proof' provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Ys]]
Justification: Section 5 and Appendix F-D H iinclude full details of datasets, model architec-
tures, hyperparameters, aggregation rules, and evaluation metrics necessary for reproducing the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results way produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case thors are welcome to describe the particular way they provide for reproducibility. In the case of closed-souree models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
14

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [No]
Justification: All datasets used are publicly available, and will release code and implementation upon publication to facilitate reproducibility.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
Sibblitc/uiddes/odeeubiiii www.aammiiiiiooooooooooooooooiie for more details.
While we encourage the release of code and data, understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips.com cc/ wwtpc/puliccgeee http:/ic/ggii////eee
Stt.oodeessssssioeeeeeeeeeam swtebbmmsssooooocccy..... for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: Training/test splits, model architectures, and all relevant hyperparameters specified Section and Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Answer: [Ye]]
Justification: While formal bars not reported, we evaluate our method across three diverse datasets, eight aggregation rules, multiple baselines. and conduct extensive ablations, all of which consistently demonstrate the advantage of SelfishAttack. These results support the statistical robustness and generality of our findings.
Guidelines:
The answer NA means that the paper does not include experiments.
15

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK report I-sigma error bars, but should state it. The authors should prefer- ably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors verified.
For asymmetric distributions, the authors should careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eπror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Section 5 specifies that all experiments were single Quadro RTX 6000 GPU with 24GB memory.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental rums well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: Our research complies with the NeurIPS Code of Ethics. We responsibly disclose new vulnerability in DFL and refrain from releasing potentially harmful code.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
Answer: [Yes]
16

---

Justification:
We provide discussion of both positive and negative societal impacts in While our work could be misused harm collaborative learning systems, we discuss potential directions for defending against SelfishAttack in Appendix K to encourage responsible follow-up research.
Appendix L
Guidelines:
The answer NA means that there societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative socictal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitiga- tion strategies (e-g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (c.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We do not release any high-risk data models. Our work is conceptual and does not involve pretrained models or scraped datasets.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by quiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All datasets used (CIFAR-10, 10, FEMNIST, Sent140) are publicly available and cited in the paper with license details included in Appendix F
Guidelines:
17

---

The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g.. website), the copyright and terms of service of that souree should be provided.
If assets are released, the license, copyright information, and terms of use the pack- age should be provided. For popular datasets, paperswi paperswithcode thcode com datasets has
curated licenses for some datasets. Their licensing guide can help determine cense of dataset.
li-
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documenta- tion provided alongside the assets?
Answer: [NA]
Justification:
No new datasets or models are released.
Guidelines:
The answer NA means that the paper does release assets.
Researchers should communicate the details the dataset/code/mooel as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the pa- per include the full text instructions given to participants and screenshots, applicable, well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve human subjects or crowdsourcing.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, cura- tion, or other labor should be paid at least the minimum wage the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve human subjects or IRB-relevant research.
18

---

Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research
with human subjects.
Depending on the country in which research conducted, IRB approval (or equiva-
lent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: This work does not rely large language models primary methodologi- cal component.
Guidelines:
The answer NA means that the core method development in this research does involve LLMs as any important, original, or non standtad components.
Please refer to our LLM policy for what should or should not be described.
19

---

Appendix
A Preliminaries and Related Work
A.1 Decentralized Federated Learning
Consider decentralized federated learning (DFL) system with N clients. Each client h has local training dataset D,. where h 0, 1............. .V- These N clients collaboratively train a machine learning model without the reliance of a central server. In particular, DFL aims to find a model w that minimizes the weighted average of losses among all clients: min N E> N-1 Fh(w, Dz), where (n, Dr.) [Pa] ECED, F(w, () the local training objective of client h. d is the number of model parameters, and [Da, is the number of training examples of client h. In each global training round, DFL performs the following three steps:
Step I. Every client trains local model using its own local training dataset. Specifically, for client ht it samples a mini-batch of training examples from its local training dataset, and calculates a stochastic gradient gh- Then, client h updates its local model as wh, <- Wh - 9h, where 1) represents the learning rate, w is the local model of client h at the beginning of the current global training round, and W6, is the pre-aggregation local model of client h after local training. Note that client can compute stochastic gradient and update its local model multiple times in each global training round.
Step II. Client h sends shared model ((,h'') to each client h', where 0 S For notation convenience, we assume a client h sends its own pre-aggregation local model to itself, i.e., (()))) = zi/- In con-adversarial settings, the shared model ((,,)) is the pre- pre-aggregation local model of client h, i.e., ((N,N') = w SelfishAttack carefully crafts the shared models sent from selfish clients non-selfish ones.
Step III. Client h aggregates the clients' shared models and updates its local model as Wh, Agg( ( (w A)) fo where {w(Ke,)) Jos is the set of shared mod- els other clients sent to h and Agg(-) denotes aggregation rule. We call wn the post- aggregation local model of client at the end of the current global training round.
DFL repeats the above iterative process for multiple global training rounds. Different DFL methods use different aggregation rules, such as FedAvg (33 and Median [36]. Note that in non-adversarial settings, all clients have the same post-aggregation local model in each global training round. Table summarizes the key notations used in our paper.
A.2 Poisoning Attacks to CFL/DFL
Conventional poisoning attacks to FL can be divided into two categories depending on the goal of the attacker, namely untargeted attacky 3 10 and largeted attacks 2 These poisoning attacks were originally designed for CFL, but they can be extended to our problem setting. Specifically, an untargeted attack aims to manipulate the DFL system such that poisoned local model of non-selfish client produces incorrect predictions for large portion of clean testing inputs indis- criminately, i.c., the final learnt local model of a non-selfish client has low testing accuracy. For instance, in Gaussian attack 3 each selfish client sends an arbitrary Gaussian vector to non-selfish clients; while Trim attack [10] carefully crafts the shared models sent from selfish clients to non- selfish ones in order to significantly deviate non-selfish clients' post-aggregation local models in each global training round. targeted attack [ [ aims to poison the system such that the local model of non-selfish client predicts a predefined label for inputs that contain special characteristics such as those embedded with predefined triggers.
A.3 Byzantine-robust Aggregation Rules
The FedAvg (3 aggregation rule is commonly used in non-adversarial settings. However, a single shared model can arbitrarily manipulate the post-aggregation local model of a non-selfish client in FedAvg B Byzantine-robust aggregation rules 25 36 aim to be robust against "outlier" shared models. In particular, when non-selfish client uses Byzantine-robust aggregation rule,
20

---

Algorithm 1 SelfishAttack Algorithm. Lines 5 to 7 describe Step of DFL, where each client performs local training of its pre-aggregation local model. Lines 8 to 13 illustrate the process of exchanging shared models among clients in the global training rounds before our attack starts. Lines [6 to 22 provide a detailed description of Section [488. explaining how to determine when start
attack. The process of performing attack is shown in lines 24 and 25 while the methods of crafting shared models are presented in Algorithm 2
Input: Number of non-selfish clients number of selfish clients loss checking interval 1; parameter in
Joss function; parameter e; aggregation Age(-) and number of global training rounds T.
1: start=False;
2: (19) = -nnf:
3: mar-gap 0:
4: for f-t-= to T do
h = to n m 6: 1 //
clients
LocalU LocalUpdate((ii) pdate(rss. Dx):
7: end for
8:
for i == to 1 do
all non-selfish elients
Client sends ((,))) w. each client h;
10:
end for for jorj=nnt to m do
11:
all selfish clients
12:
Client j sends w(j,A) = v and 1d) to each selfish client h; end for
13:
14: for nn
do Client receives W fosism-i:
all selfish elients
15:
((0) (i Ensientm-1 (0);
17:
if > 7 and stort==Falsc then
18:
max gap (1=xx((t-)) 1(0) max .gp):;
19:
0 < 10-1) - 1(0) < mar gap then start=True;
20:
21:
end if
22:
end
23:
= to - do ((.0)) Sel(n, m, W, úr Agg(-), X, start); Client j sends (( non-selfish client i; for end for
for
24:
25:
26:
27:
28:
for I = 0 to
do
all clients
29:
wi Agg Agg(( ( (owws
30:
th wa:
31:
end for
32:
end for
its post-aggregation local model is less likely to be influenced by outlier shared models, c.g., those from selfish clients.
For instance, Median (36] and Trimmed-meat 36 two coordinate- wiser aggregation rules, which remove the outliers in each dimension of clients' shared models in order to reduce the impact of outlier shared models. Specifically, for given client, the Median aggregation rule outputs the coordinate-wise median of the client's ss received shared models as the post-aggregation local model. For each dimension, Trimmed-mean first removes the largest and smallest elements, then takes the average of the remaining N 2c items, where e is the trim parameter. Krum 3 aggregates a client's received shared models by selecting the shared model that has the smallest sum Euclidean distance to its subset of neighboring shared models. We note that the previous work (9) has already applied Median, Trimmed-men
and Krum aggregation rules in the context of DFL. In FLTrust (5), a received shared model diverges significantly from the pre-aggregation local model of client i, then client i assigns low trust score this received shared model. In FLDetector [37], clients leverage clustering techniques to detect outlier shared models and then aggregate shared models from clients that have been detected as non-selfish. In RFA (27], clients use a geometric- based robust aggregation oracle to aggregate shared models from other clients. In FLAME (25), clients leverage clustering, model weight clipping, and noise injection techniques to mitigate the impact of outlier shared models.
21

---

Algorithm 2 Se, m, Wj, Wj Agg()); X, start).
Input: Number of non-selfish clients number of selfish clients non-selfish clients' local models W; (w(a.))ooAgs=e pre-aggregation local model úy of selfish client j; aggregation rule Agg(:): non-selfish client index parameter in loss function; boolean variable start.
Output: Shared model ((),) sent from elient j to
I: if start=Faalse then
2: ((.4)) t0y;
3: return ((.)))
5: if Agg(-) is FedAvg then
6: for k = 0 to d - do Compute wG.a) [k] based Equation end for
7:
9:
else Agg(-) is Median then
10:
for k= 0 - do
11:
Computc WG.0) [A:] based Equation 6 12: end for
13:
else if Agg(.) ( is Trimmed-ment mean then
14:
for == 0 to d - 1 do
15:
Compute wG.0 [k] based on Equation o end for
16:
end
return ((G.)))
B Solving the Quadratic Program (Equation 2)
Theorem 1. The optimal solution wi [k] of Equation is as follows:
P.kk] A ><1Ap,l [w, [A]]
w [A]]
(12)
or w. [k), otherwise
Proof. We can solve w [k] separately in the following three cases:
Case I: 1. In this case, if P: [k] within the interval (uz, [k), w. w.[k]] [k:]] then the optimal solution is
w [k] = P, [k]. Otherwise, we have woj [K] [.(Kk if p. [A]] is larger than w. [k)] and wo [k] = w
if [k]]] smaller than w. [K].). In other words, have the following:
pa [
w k
p.
[
W. [kc
w [k]]
W
k
P
k
W
(13)
Pa
Case II: X == 1. In this case, we have w
[k] as follows:
wo [k] [k]
w [k]
(14)
A...
wa [
< u
Case III: X > 1. In this case, wi [k] is value between w. [k] and w [k] that has the larger distance to [kk]. That is, we have the following:
w [k]k, w [k],
P. lk]
[.(k [k]k]
Ip w P.
w [
(15)
p. [kj
-w,
By combining Equations
13 15 can get Equation 12
C Proof of Attacking FedAvg
Theorem 2. Suppose non-selfish client i uses the FedAvg aggregation rule. The crafted shared modely in Equation for the selfish clients are optimal solutions the optimization problem in Equation 1
22

---

Proof. According to Equation 4 we have:
n+mm-
wi [k]
(h, [k]
nO +
h=0
2-1
(h.s)) [6] (n m)w
Σ
(h.)) [k])
(16)
n2 + m
((1 + m ) [k:]
+
w [A]
D Proof of Attacking Median
Theorem 3. Suppose non-selfish client uses the Median aggregation rule. The crafted shared models in Equation 0 for the selfish clients are optimal solutions the optimization problem in Equation 7
Proof. We discuss the three cases in Equation 6 separately.
Case I: un(sk [k] 2 ui [k]
> q m [c.. We have
9 ---=-1 [K] 2 2w [k] q 1- [1]] 2 9 [[k:].
Thus
9 n [k] > w (n, [k] 2 91 n- " [r[1:],
w 1,5)
Wn 1.1) [k:] = w [k] q --m [k:]
So -
[k] ranks
m+m-i |th among (0,,)) [kt. ... 20 (n+m-1,1)) [k)] and g ---p-1 [:b]] (n. [A]
rank
a
th. stm+1
th, respectiieyy. We have
wi [k] = m (n. [k] 91 -1 [b]) 20, [A).
(17)
Case II: p-m-1 [k] > 2 [k] 2 w. [k:. We have
Lm 1 is [k]
2uc [R]
[k] q = [R:].
Thus
q --
[k] > w (n. [k] > 2 [kk]
w (n++1.8) 1,0)
w (n+ 1.5) [k] w [k]
[k].
So q m 1 Já [k] ranks
m+ th among ((, [k]..... w wm - 1,1) [k], and q سيسس [a[k),, w (m.
rank
a+ |h and
a+ th. respectively. Therefore,
1
w. [k]
1 (n.i) [k] + 9 ammmm [k]) w [k]]
(18)
2
Case III: q
[ 2 w. [k]] z q - [k.] In this case, we can find r such that [+t--)
n mm
and ari [k] un [k] 4041y (R). Thus
gra [k] w m. [k]
u 1,1) [k] 2 ((r+))(k)).
gri(k), (m. [k], ... W 1,4) [k], [1) rank (r+1)thh, (r+ 2r+h) ... (r+m++1)t (r+m+
2 2)th among w [k:], w (m+mm11.) [k), respectively. Because r +1 n+m+1 and +
23

---

| J, the median value of ((.i) [k.. ... fin++mm-..)) must between ((++): and [r][k],
which means (r-[k] 2 wilk) [k] 2 q(r ((r+1)il [k]. So we have
w; [k]] 2
(w [k] +
2o [k]) = we [R:]-
(19)
After summarizing results of Equations
17 18 and
19
we have
w.
[A]
w [k].
E Proof of Attacking Trimmed-mean
Theorem 4. Suppose non-selfish client uses the Trimmed-mean aggregation rule. The crafted
shared models in Equation 99 or Equation 17 for the selfish clients are optimal solutions to the optimization problem in Equation
Proof. We discuss two cases based on the definitions of Equation and Equation 11
Note that w: [k]
Σh=m
qhe [k]]
2m
Case 1: w. [k] < w [b:] S w. [k]. According to the definition of r, we need to find maximum r, such
that S n, and
w. [k] z n ((n - r) (mm
Σ qha [k]).
(20)
Since q(m- 1); [r]k]
w. [k] ž :i [A:], when r = nI - m,, we have
(n - m.) 20, [k| S m q(m 1): [k]] + (n 2m) 20:
4(m ((m-1)i(A) + Σ
[nilk]
(21)
hmm
(n r)
q(m 1ki
ghilk),
so such exists, and r 2 n m. If n, there are no Part II selfish model parameters, and
w [k] <
[halk] = [k).
h=m
Since w [k] 2 w. [k). we have w [K] w. [A]. Note that in this case all the shared model parameters of selfish clients are Part model parameters, which are all less than 1(n-1)i [k:]. so
w.ik] w [k] w [k]]
(22)
r S n - 1, then we prove that [k] < ((.a)) [ 4im- 1) [k] when S j < 2n r - 1. In fact, the right side can be directly obtained by Equation 20 so we only need to prove the left side. Since r is maximum, we have
1 2
w [t]
((n r 1) (mm
(kelk)).
(23)
m
h=m
So we have
1
wilk
((n - 1). qmm [k] + [k)(k))
n m
hm
1
((n - 1) grilk] Σ (na(
(24)
m
((n r) [ri(k] + Σ [k)())).
71 - m
h=m
24

---

tion Hence, when calculating the trimmed mean value of according to Equa- qod ko] . 1)<k) will be filtered out since they are the largest m values in the kth dimen- sion, and qr: [k]. ((n-1y(kk, (12n-r; [k]. 1 ((n [k] will be filtered out since they are the smallest m values in the kth dimension, and
Thus gri(k] = cj[k] (.,) [k] for S < 2n -
w; [k]
1
Dh [k] +
Σ
(G.) [k]
m
=
qhe [k] + (n m.)
u
Σ
gms(A:))
(25)
m
h=m
h=m
((n m) [k))
n m
w [k:].
Case H: wk:sk] < wt [k]] < wi [k]. Similar to Case I, according to the definition of r, first we need to find minimum such that r 2 0, and
w
1 ((++1) minmm)i +
Th 3
Σ
(hc(k))).
(26)
n - m
Since ((n-m)ilk) S [b) w [k), when m 1, we have
(n m) wi[k| z m q(n + (n 2m): - -0,
n n-m-1
m Qnn +
Σ
qhi
(27)
hmm.
= +r (n- +
Σ
qhilk),
hmr+1
such exists, and S I 11, there Part II selfish model parameters and have
woikk w.(k| -0 [k]]
(28)
If r 2 0, then we can similarly prove ((n-m)i [k] S wi.) [k] < qrr[k] when n S j S n r. Hence, when calculating the trimmed mean value of (BggAsetm (k)mmu(kk),... ... ((n-1)((k [k] will be filtered out since they are the smallest m values in the kth di- mension, and qoo [k] ... gri [k)[ w ((++++1,0))) [B)...., ((n+m-1.0 [k] will be filtered out since they are the largest m values in the kth dimension, and
(
utr
wv [k]
Ihi [k]
Σ (g.))K)))
m
n-
m-11
[ko[kd] + (n m)w; [k]
Σ
khllk))
(29)
h b=r+1
h-++1
((n m) 2 [k])
w [k].
After summarizing results of Equations
22
and 29
we have:
w. [k] w [k].
25

---

Table 4: Notations.
Notation
Description
Number of non selfish clients.
Number of selfish clients.
h
Index of any clients.
Index of non-selfish clients.
Index of solfish clients.
À
Hyperparameter our optimization problom.
LP,
Local model of clicat the start of global round.
Pre-agaregation local model of client s.
Post aggreggtton local model client
kP: [A]
1-th dimension w.
Optimal solution of optiiczation problem.
Model aggregated non selfish clients" shared models.
[A]
Upper bound (p]]
Lower bound of ur, [R].
Shared model that client sends client R'.
Table 5: CNN architectures for CIFAR-10 and FEMNIST.
(a) CIFAR-10.
(b) FEMNIST.
Layer
Size
Layer
Size
Input
32 32 x
Input
28 x 28 x
Cony + ReLU
3 3 x 30
Conv + ReLU
7 7 32
Max Pooling
2 2
Max Pooling
2 2
Cony ReLU
x 3 x 50
Conv ReLU
3 x x 64
Max Pooling
2 x
Max Pooling
2
PC + ReLUU
100
PC
62
PC
10
F
Dataset Description
CIFAR-10 [20). CIFAR-10 is 10-class color image classification dataset, with 50,000 training examples and 10,000 testing examples. License: MIT License. Available at https: // www. cs. toronto. edu/ krēz/ cifar. html
Federated Extended MNIST (FEMNIST) 4 FEMNIST a 62-class image classification dataset. It is constructed by partitioning data from Extended MNIST [22) based on the writer of the digit or character. There are 3,550 writers and 805,263 examples in total. To distribute training examples to clients, we select 10 writers for each client and combine their data the lo- cal training data for a client. License: Apache License 2.0 (via LEAF benchmark). Available at https: // leaf. cma. edu
Sentiment140 (Sent140) [6). Sent140 is a two-class text classification dataset for sentiment analy- sis. The data are tweets collected from 660,120 Twitter users and annotated based on the emoticons present in themselves. In our experiments, we choose 300 users with at least. 10 tweets for each client, and the union of the training tweets of these 300 users is the client's local training data. Li- cense: Other. No explicit license is provided. Available for academic use only. Hosted on Hugging co/ datasets/ st stanfordi lp/ heeiaapp//etttteeeeeeeeeeeeeeeee sent contimmet100
Face at ht tps: // h/thgggnnggfftto
G Details of Aggregation Rules
FedAvg [2]. In FedAvg, a client aggregates the received shared models by calculating their average. Median (36.. Each client in Median obtains the post-aggregation local model via taking the coordinate-wis. wise median of shared models.
Trimmed-mean (36]. Trimmed- mean is also coordinate-wist method that calculates the trimmed mean the shared models in each dimension. Specifically, for dimension k. each client first removes the largest e and smallest values, then computes the average of the remaining elements. In our experiments, we set = m, where m the number of selfish clients, giving advantages to this aggregation rule.
26

---

Table 6: LSTM architecture for Sent140.
Layer
Configuration
Table 7: Default DFL parameter settings.
Word embeedingg GloVe (26
Purameter
CIFAR-I0
FEMNIST
Sent140
Embedding
Embedding dimension: 50
clients
Input size:
selitihh clients
LSTM
Hiddee 100
training opochs
Number of layers;
learning rate
Input features: 100x2
Optimizer
Adam (weight decny=5 x 10 10"2)
Fully Connected
Outpur features: 128
global training rounds
1,000
Fully Connected
Input features: 128
Batch size
128
256
256
Output features: 2
Krum [3. In Krum aggregation rule, each client outputs one shared model that has the smallest sum of Euclidean distances to its closest n - 2 neighbors.
FLTrust [5]. In FLTrust, client i computes a trust score for each received shared model in each global training round, where S i n++m--- 1. A shared model has lower trust score if it deviates more from the pre-aggregation local model of client i. After that, client i computes the weighted average of the received shared models. where the weights are determined by their respective trust scores. The higher the trust score, the larger the weight.
FLDetector 377. In FLDetector, client i predicts client's shared model updates based its historical information in each training round and identifies a client as selfish when the predicted model updates consistently deviate from the shared model updates calculated by the received shared model across multiple training rounds. Then client i employs Median to aggregate the predicted non-selfish clients' shared models.
REA [27]. The RFA algorithm employs a robust aggregation oracle based on the geometric median. It specifically uses the smoothed Weiszfeld algorithm to iteratively compute weights for aggregating the shared models. We follow the implementation as in Pillutla et al. [27].
FLAME 25 FLAME uses clustering -based method to detect and eliminate bad shared models. Moreover, uses dynamic weight-clipping and noise injection to further reduce the impact of bad shared models from selfish clients. We follow the implementation as in Nguyen et al. [25].
H Simulating Non-iid Setting in DFL
In DFL. the clients' local training data are typically not independent and identically distributed (Non-IID). We randomly split all clients into 10 groups, and then use probability to assign training example with label y to the clients one of these 10 groups Specifically, the training example with label y is assigned to clients in group y with probability of p. and to clients in any other groups with the same probability of - where P [0.1, 1.0). Within the same group, the training example is uniformly distributed among the clients. The parameter p controls the degree of Non-llI.. The local training data are IID distributed when 0.1, otherwise the training data are Non-IID. A larger value of implies a higher degree Non-IID.
I Attacking FLAME
Recall that FLAME first clusters models based on cosine distances between them and selects the largest cluster with no fewer than a+m + models. To encourage the clustering algorithm to mis- classify many non-selfish clients possible selfish and subsequently remove them, we select a subset of non-selfish clients. We then craft shared models of selfish clients such that the crafted models close to the shared models of these selected non-selfish clients, while keeping them dis- tinctly different from the models of the remaining non-selfish clients. Specifically, when client i employs the FLAME aggregation rule, we first identify n-m shared models of nen-selfish clients with the smallest cosine distance to wi, denoted as W(rr.))) ...,, (10-m))2))))) Then, we craft the shared model of selfish clients as follows:
(n,))
W ((n+m-1,5)
(n- m2/
1
(30)
Wra.i) + aw; 3 Σ w(.)),
3n
2
4=
)=0
27

---

Rddry
Dulls
Fddty
0.15
1.53
0.10
[0.00
0.10
D40
0.10
1095
0.16
0.00
0.01
0.00
-005
2033
Nandon dlaats
(a) Impact of
(b) Impact of I (c) Impact of number of clients
Figure 6: Impact of e, I, and total number of clients on Gap of SelfishAttack.
Table 8: Results when non-selfish clients and selfish clients use different aggregation rules. Each column represents the aggregation rule used by selfish clients, and each row denotes the rule used by nen-selfish clients.
FedAvg (selfish)
Median (selfish)
Trimmed-mean (selfish)
Aggregation Rule
MTAS
MTANS
Gap
MTAS
MTANS
Gap
MTAS
MTANS
Gap
FedAvg
0.475
0.326
0.150
0.478
0.326
0.152
0.470
0.326
0.144
Median
0.574
0.425
0.150
0.543
0.425
0.119
0.301
0.425
-0.123
Trimmed-meat mean
0.597
0.484
0.113
0.596
0.484
0.113
0.597
0.484
0.113
where a > 0 and 3 > O are some constants. In our experiments, we set a = 5 and B = 0.01.
In Equation 30 the first term aims to bring the crafted models closer to the selected n=m shared models; the second term satisfies our utility goal, which is to maintain the proximity of client i's post- aggregation local model its pre-aggregation local model; and the third term pushes the crafted models away from the unselected models, which satisfies our competitive advantage goal. The selfish clients use the Median aggregation rule to aggregate received models from all clients.
is noteworthy that although we do not devise specific attack strategies for FLAME's noise injec- tion, the attack outlined in Equation 30 still enables selfish clients to gain significant competitive advantage.
J Other Ablation Studies
Impact of and J: Figs.(6alande (aaand 6b) show the impact of and respectively. The larger the c and the smaller the I, the earlier the selfish clients start to attack. We observe that our SelfishAttack is more sensitive to these two parameters when attacking FedAvg compared to Median and Trimmed-mean. From Fig. [aa we observe that when does not exceed 0.05, our attack yields low Gap, especially when the aggregation rule is FedAvg or Trimmed-mean where the Gap O. In fact, in this case, the selfish clients do not start to attack until the end of the training process. When ranges from 0.1 to 0.2, our attack exhibits relatively stable performance. When e 0.5 and the aggregation rule is FedAvg, selfish clients initiate the attack before the local models have almost converged, resulting in a decline in the attack effectiivnness. We also observe from Fig. 6b that when attacking Median and Trimmed- mean, the performance of SelfishAttack is almost not affected by I, and the Gap obtained by our SelfishAttack is greater than 10% in all cases. In contrast, when attacking FedAvg, the value of 7 has notable impact Gap: when I is not greater than 30, the Gap is close to O; and when I is not less than 50, the Gap is larger than 13%.
Impact of total number of clients: To explore the impact of the number of clients on AttaishAttack, we first divide the training data of CIFAR-10 dataset among 30 clients, and then randomly select subsets of 10, 20, and 30 clients from them while maintaining fixed fraction of selfish clients at 30%. Fig. 66 shows the impact of the total number of clients on SelfishAttack. We observe that as the number of clients increases, our attack is more effective. For instance, when the aggregation rule is Median, increasing the number of clients from 20 to 30 results in a 4.2% improvement in Gap. This may be because that although the fraction of selfish clients remains unchanged, the absolute number of selfish clients increases, thereby making the attack more effective.
Impact of aggregation rule used by selfish clients: Selfish clients can use different aggregation rules from non-selfish clients. Table & presents the results of SelfishAttack under varying combina- tions of aggregation rules used by selfish and non-selfish clients. For each aggregation rule used by
28

---

Table 9: Performance when selfish clients use previous round models from non-selfish clients.
Aggregation Rule
MTAS
MTANS
Gap
FedAvg
0.475
0.327
0.148
Median
0.545
0.427
0.118
Trimmed-mean
0.594
0.483
0.111
non-selfish clients, we apply the corresponding version of SelfishAttack.. For instance, when non- selfish clients use Trimmed-mean, selfish clients craft their shared models using the Trimmed-mean based version of SelfishAttack. We observe that the Gap exceeds 11% in most cases, with only one exception: when non-selfish clients use Median and selfish clients use Trimmed-mean. Overall, regardless of the aggregation rule employed by non-selfish clients, it is consistently a better choice for selfish clients to use FedAvg.
K Discussion and Limitations
Utility preserving of SetaishAttack: SelfishAttack's utility goal requires selfish clients learn more accurate local models than they would by training only with other selfish clients. According to [ SelfishAttack's MTAS usually surpasses that of Two Coalitions, achieving this goal. Al- though sometimes selfish clients' model performance declines, we argue that this decrease is accept- able for two reasons. First, while MTAS shows a noticeable drop in some cases (e.g.. FedAvg and Median on CIFAR-10) compared to No attack, the difference is usually within 6%. This drop could be attributed the high degree of non-iid data in our CIFAR-10 10 setup. Notably, in some cases (e.g., FedAvg and Trimmed-men mennn on Sent 40), SelfishAtack's ' MTAS even exceeds No attack. Second, this performance drop compensated by greater competitive advantage, as the Gap is consistently larger than the MTAS decline, meaning selfish clients sacrifice some model performance for more competitive gain.
Defending against SelfisAAttack: Byzantine- aggregation rules are defenses against "out- lier" shared models, which can be applied to defend against SelfishAttack. However, theoreti- cally show that Median and Trimmed-ment cannot defend against our SelfishAttack, as the selfish clients can derive the optimal shared models to minimize weighted sum of the two loss terms that quantify the two attack goals respectively. Moreover, we empirically show that other more advanced aggregation rules such as Krum, FLfrust, FLDetector, RFA, and FLAME cannot defend against SelfishAttack as well. is an interesting future work to explore new defense mechanisms to defend against SelfishAttack. In Attaksh selfish client sends different shared models dif- ferent non-selfish clients. Therefore, one possible direction is to explore cryptographic techniques to enforce that selfish client sends the same shared model to all clients. We expect such defense can reduce the attack effectiveness, though may not completely climinate the attack since a selfish client can still send the same carefully crafted shared model all non-selfish clients. Another direction for defense is to use trusted execution environment, e.g., NVIDIA H100 GPU. In particular, the local training and model sharing of each client performed in a trusted execution environment, whose remote attestation capability enables a non-selfish client to verify that the shared models from other clients are genuine.
Approximating with previous round models: A potential concern of our formulation is the in- formation asymmetry in the model-sharing process. Specifically, the algorithm assumes that at each communication round, selfish clients can first obtain the shared models from all non-selfish clients before sending out their own models, which may be less realistic in practical decentralized or asynchronous federated learning systems. To examine whether this asymmetry affects the attack's 's effectiveness, conduct an additional experiment where each selfish client instead uses the models received from each non-selfish client in the previous round as estimates of their current round mod- els when constructing its selfish update. Table 9 reports the results CIFAR-10. The results very close to those obtained under the original assumption where selfish clients access the current round models. This indicates that the attack remains effective even when selfish clients rely on ap- proximate, delayed information, suggesting that the method is robust to communication asymmetry and applicable to more realistic settings.
Partial client participation: In practical FL. systems, only a subset of clients may be active in each communication round due to resource or connectivity constraints. To examine the impact of such
29

---

Table 10: Results when only 50% of clients participate in each communication round.
Aggregation Rule
MTAS
MTANS
Gap
FedAvg
0.502
0.353
0.149
Median
0.583
0.465
0.118
Trimmed-mean
0.596
0.506
0.090
Table 11: Results under a partially connected client graph, where each client connects to 10 others.
Aggregation Rule
MTAS
MTANS
Gap
FedAvg
0.602
0.569
0.073
Median
0.505
0.388
0.117
Trimmed-mean
0.589
0.503
0.086
partial participation, we conduct experiment where only 50% of the clients participate in each round, while keeping all other parameters unchanged. As shown Table [O] our method continues to exhibit strong competitive advantage under this setting. We further observe that using only half of the clients delays the manifestation of selfish behavior by about 20-30 rounds compared using all clients, likely due to the slower convergence of the system when fewer participants are involved.
Partially connected topology: We further examine the robustness of Selfish under decen- tralized setting where the client network is not fully connected. Specifically, we randomly generate a communication graph which each client connects only 10 other clients (out of 20 in total). In this configuration, selfish clients do not have access to the full connectivity structure of the system. That is, they are unaware of which non-selfish clients are interconnected, and thus cannot directly apply the attack strategies proposed for the fully connected case. To approximate this scenario, we design an attack based on the local models of all non-selfish clients that are accessible each selfish client, and apply the same attack strategy originally designed for FedAvg to all three aggregation rules (FedAvg, Median, and Trimmed-mean) As shown in Table [T] SelfishAttack still achieves clear competitive advantage across all settings, indicating that the attack strategy generalizes effec- tively even when the system connectivity is partial.
L Broader Impact
Our work reveals type of insider threat in DFL systems, where subset of selfish clients can manipulate the training process to gain competitive advantage without disrupting overall model performance. By exposing this vulnerability, our research highlights the risks of trusting all partici- pants in collaborative learning without strong assumptions or safeguards.
We believe this work will have positive societal impact by raising awareness of subtle collusion threats in DFL and encouraging the development of more robust aggregation rules and detection mechanisms. At the same time, acknowledge that malicious actors could potentially misuse insights to harm collaborative learning systems in sensitive domains, such as healthcare or finance. To mitigate such risks, in Appendix K, we also discuss possible defenses against SelfishAttack. By highlighting both the threat and defense directions, we aim to facilitate the development more secure and trustworthy decentralized learning systems.
30


Reviews:
[{"review_id": "petOwaWWHk", "reviewer": "Reviewer_2QD8", "summary": "SelfishAttack is a collaborative attack in which a group of malicious clients send corrupt updates to (i) enhance their own final models beyond what they could achieve independently and (ii) widen the performance gap. The attack uses a competitive-advantage term to push towards suboptimal regions. Closed-form solutions are derived for standard aggregation rules like FedAvg, Median, and Trimmed-mean. Additionally, a transferable FedAvg-based attack strategy proves effective against more sophisticated defenses, including Krum, FLTrust, FLDetector, RFA, and FLAME. Experiments on CIFAR-10, FEMNIST, and Sent140.", "questions": "1.) Is the proposed method permutation invariant? Karimireddi et.al showed that permutation methods cannot be strongly robust from byzantine attacks.\n2. Shouldn't attacks be benchmarked against defenses instead of with just other attacks?\n3. Can the problem be written as a game? That is, if defenders start randomizing aggregation weights or tracking per‐round variance or use an advanced defense, could the colluding clients dynamically adjust their optimization to preserve their advantage? Modeling this game and reporting the performance trade-offs would be of greater practical usage.", "limitations": "Weaker performance in non-iid data is a prominent limitation of this approach.\nThe method is not effective during early rounds of local training.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Detailed derivations for FedAvg, Median, and Trimmed-mean provide a first-principles based application.\nThe per-coordinate re-parameterization yields clean closed-form optimal updates. The ablations are in good detail.\n\nWeaknesses:\ni) The experiments compared with simple robust aggregation such as median and trimmed mean. There has been a lot of progress beyond this with say the CenteredClip Aggregation (Karimireddi et.al), Karimireddy, S. P., He, L., and Jaggi, M. (2021b). Learning from history for byzantine robust optimization. In International Conference on Machine Learning. It is good to compare against it.\nii) That said, the number of clients considered is small and the datasets used are fairly simple.\n\nSimilarly on the attack side, do contrast the setting considered from those of label flipping attacks, sign flipping attacks, inner-product manipulation attacks and alie attacks that have been quite popular.", "was_revised": true, "final_justification": "Based on the concerns raised by rest of the reviewers, the strong rebuttals, and backing up of the threat model, flexibility to connectedness level of graph, I revised and raised my score.", "rebuttal": "Thank you for your comments and feedback. Please find our responses below.  \n\nW1: **Simple robust aggregation**: In Table 3, we present results for other aggregation rules. We also conduct experiments on complex CenteredClip aggregation rule. Similar to the attacks against other aggregation rules in Table 3, we apply the attack originally designed for FedAvg to CenteredClip. The corresponding MTAS/MTANS/Gap are **0.527/0.437/0.090**, respectively. These results indicate that our attack successfully achieves both attack goals even under the CenteredClip defense.  \n\nW2: **Few clients**: To further evaluate the effectiveness of our approach, we conduct experiments on CIFAR-10 with 100 clients. The corresponding MTAS/MTANS/Gap results are: \n\n|||\n|-|-|\n|FedAvg|0.238/0.167/0.071| \n|Median|0.394/0.239/0.155|  \n|Trimmed-mean|0.425/0.301/0.124|     \n\nW3: **More attacks**: We further add label flipping and sign flipping attacks to our baseline. The results are: \n\n||Label Flipping|Sign Flipping|\n|-|-|-|\n|FedAvg|0.597/0.553/0.044 | 0.565/0.563/0.002 |\n|Median| 0.616/0.601/0.015 | 0.597/0.589/0.008 |\n|Trimmed-Mean| 0.610/0.591/0.019 | 0.585/0.579/0.006 |\n\nThese results indicate that the two attacks fail to obtain a significant competitive advantage.\n\nQ1: **Permutation invariant**: Permutation invariance is an important property for FL aggregation rules. However, since our method is an attack in the DFL setting, the concept of 'permutation invariance' may not be applicable to our method.\n\nQ2: **Attacks should be benchmarked against defenses**:  In addition to comparing the performance of our attack with other attacks, we also benchmarked against defenses. Tables 1 and 3 report the results of SelfishAttack against various robust aggregation rules. Moreover, comparing our attack with other baseline attacks better highlights its effectiveness, which is also a common practice in many attack papers (e.g., [1]).\n\n[1] Fang et al. \"Local model poisoning attacks to Byzantine-Robust federated learning.\" In USENIX security symposium 2020.\n\nQ3: **Modeling as a game**: This is a very interesting suggestion. In Table 3, we have already included several advanced defenses, such as FLTrust, FLAME, and RFA, which modify aggregation weights, as well as FLDetector, which tracks per-round variance. To further verify that attackers can still be effective even when defenders adopt random aggregation rules, we conduct the following experiment: in each round, each non-selfish client randomly selects an aggregation rule from those listed in Tables 1 and 3, while the selfish clients consistently apply the attack strategy designed for FedAvg. The results are **0.573/0.480/0.093**. While an attacker could potentially adapt its strategy based on the specific aggregation rule used by the defender, it needs the selfish clients to know the exact aggregation rules used by non-selfish clients, which is impractical.  Therefore, we believe modeling games goes beyond the scope of the current paper and would be better positioned as a new line of attack. We believe it is a promising future work.\n\nL1: **Weaker performance in non-iid**: We clarify that all our results, except for the iid case in Figure 4 (i.e., degree of non-iid=0.1), are conducted under non-iid scenarios. We will make this setting more clear. \n\nL2: **Not effective during early rounds**: We argue that in early rounds, all clients have poorly performing local models, and a more meaningful attack goal is to prevent them from obtaining high-performance models later on. Our algorithm includes a component that determines when to start the attack. In practice, the attack typically begins between 1/6 and 1/3 of the total training rounds, meaning that selfish clients can gain a significant competitive advantage for the majority of the training process."}, {"review_id": "NRqMgNZi6l", "reviewer": "Reviewer_iRFS", "summary": "This paper introduces a novel attack in the decentralized federated learning paradigm, called SelfishAttack, in which a subset of selfish clients aim to gain a competitive advantage over the remaining non-selfish clients while maintaining the performance of their own trained models. The authors propose specific selfish attack algorithms tailored to different aggregation rules and demonstrate their effectiveness through numerical experiments.", "questions": "**Q1:**\n\nIf the selfish agents do not know the aggregation rule in advance, which selfish attack strategy should they adopt? Among the attack strategies designed for FedAvg, Median, and Trimmed-Mean, is there one that performs better on average when the aggregation rule is unknown?\n\n---\n\n**Q2:**\n\nIn each communication round, if only a random subset of agents is selected to participate in the model update, how does this affect the effectiveness of the SelfishAttack algorithms? How does it influence the optimal timing for initiating the attack?\n\n---\n\n**Q3:**\n\nIt seems to me that the aggregation rule proposed in [1] might be able to defend against the SelfishAttack. Specifically, in that work, the authors suggest that each agent $i$ assigns weights to received models based on their relative performance on the agent's local dataset compared to agent's own model. This could potentially help distinguish between models from selfish and non-selfish agents . It would be helpful if the authors could comment on this point.\n\n[1] Zhang, Michael, et al. \"Personalized Federated Learning with First Order Model Optimization.\" International Conference on Learning Representations.\n\n**Q4:**\n\nWhile I understand this may not be the main focus of the paper, could the authors comment on how the proposed method could potentially be generalized to scenarios where the network topology of DFL is not a fully connected graph?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "### **Strengths**\n\n1. The paper proposes a new type of attack in the setting of decentralized federated learning, which is both a reasonable threat to consider and, to the best of my knowledge, novel.\n\n2. The proposed algorithms successfully achieve the goals of the selfish attack under various robust aggregation rules, demonstrating their effectiveness.\n\n### **Weaknesses**\n\n1. The proposed algorithm seems impractical in some respects. In particular, at each communication round, the selfish agents are assumed to first obtain the shared models from all the non-selfish agents before sharing their own models. This asymmetry—where selfish agents receive others’ models before sending theirs—may not be realistic in real-world decentralized systems.\n\n2. The algorithm assumes that the selfish agents know in advance which aggregation rule is being used by the non-selfish agents. In practice, this information may not be available. It is also unclear what would happen if, for example, the attack designed for Median aggregation were applied when the non-selfish agents were actually using Trimmed-mean aggregation. While I saw that the authors mentioned this part in the future work, but I think Including experiments to evaluate such cases would strengthen the work.\n\n3. The proposed algorithm assumes that all agents participate in every communication round. However, in practice, participation is often partial, with only a subset of agents active in each round. While it seems plausible that the algorithm could still be effective under partial participation, it would strengthen the paper to include experiments under this more realistic scenario. Such experiments could also shed light on how participation randomness impacts the effectiveness of the attack and the choice of hyperparameters, such as the timing of when to initiate the attack.", "was_revised": true, "final_justification": "I have read all the reviewers’ comments and the corresponding replies from the authors (including my own). The experiments presented in the paper, together with the additional experiments in the rebuttal period, suggest that the proposed Selfish Attacks can successfully attack many existing DFL algorithms. In my view, this will be of interest to the community. Accordingly, I recommend borderline acceptance.", "rebuttal": "We thank you for your constructive feedback and for recognizing the contributions of our work. Our point-by-point responses are as follows.\n\nW1: **Asymmetry**: Regarding the 'asymmetry' concern, we experiment with using the models received from each non-selfish client in the previous round, as estimates of their current-round sent models, when computing the selfish model to be sent by selfish clients. The results (CIFAR-10, MTAS/MTANS/Gap) are as follows: \n\n|||\n|-|-|\n|FedAvg|0.475/0.327/0.148|\n|Median|0.545/0.427/0.118|\n|Trimmed-mean|0.594/0.483/0.111|\n\nThese results are very close to those obtained using the actual current-round models. We will consider updating our algorithm to use the previous-round models to address this concern.\n\nW2: **Aggregation rules are unknown**: We include several advanced aggregation rules (e.g., FLTrust, RFA, FLDetector) in Table 3. These experiments do not require prior knowledge of which aggregation rule the clients are using, as we apply a unified attack strategy rather than adapting it based on the specific aggregation rule. Of course, if the attacker knows in advance which aggregation rule the non-selfish clients are using, it is possible to launch more targeted and effective attacks (as we did for FedAvg, Median, and Trimmed-mean). We also attempt to attack Trimmed-mean using the strategy designed for Median as suggested, resulting in MTAS/MTANS/Gap of **0.583/0.512/0.071**, demonstrating a certain degree of transferability. \n\nW3: **A subset of agents active in each round**: We conduct an experiment where only 50% of the clients participate in each round, while keeping other parameters unchanged (e.g., $\\lambda$). The results are as follows:\n\n|||\n|-|-|\n|FedAvg|0.502/0.353/0.149|\n|Median|0.583/0.465/0.118|\n|Trimed-mean|0.596/0.506/0.090|\n\nThe results still demonstrate that our method achieves a strong competitive advantage. In addition, using only 50% of the clients delays the attack by 20-30 rounds compared to using all clients, which may be due to the slower convergence of the system with fewer participants.\n\nQ1: **Aggregation rules are unknown**: If the aggregation rules are not known in advance, using the attack strategies designed for FedAvg is the most effective approach. This is also consistent with our experiments on most other aggregation rules in Table 3. Under the same parameter settings, applying the FedAvg-based attack against Median and Trimmed-mean yields the following results:\n\n|||\n|-|-|\n|Median|0.571/0.464/0.107|\n|Trimmed-mean|0.579/0.495/0.084|\n\nQ2: **A subset of agents active in each round**: Please refer to the responses to W3 above.\n\nQ3: **Potential defense**: We evaluate the aggregation rule FedFomo proposed in [1]. Similar to how we attacked other aggregation rules in Table 3, we apply the attack strategy designed for FedAvg to FedFomo. In our experiments, each non-selfish client uses its entire training dataset to evaluate the models from other clients. The results are **0.474/0.323/0.151**. This outcome may be due to the fact that, under our attack on FedAvg, most selfish clients send models identical to the local models of the non-selfish clients. Since FedFomo assigns higher weights to models that are similar to a client’s own local model, the models from selfish clients receive relatively high weights. As a result, the final aggregated model essentially becomes the non-selfish client's own model. This explains why the attack results on FedFomo are very close to those on FedAvg.\n\nQ4:**Not fully connect graph**:  We conduct an experiment under a not fully connected setting. Specifically, we randomly generate a graph structure where each client is connected to only 10 other clients (20 clients in total). In this case, selfish clients do not have access to the full connectivity structure of the DFL system, that is, they do not know which clients each non-selfish client is collaborating with. Therefore, it is difficult to directly apply the attack strategies proposed in the paper for FedAvg, Median, and Trimmed-mean in this setting. However, we can still construct an attack based on all the local models of non-selfish clients that are accessible to selfish clients. Therefore, we use the same attack strategy designed for FedAvg to attack FedAvg, Median, and Trimmed-mean. The results are as follows:\n\n\n|||\n|-|-|\n|FedAvg|0.602/0.569/0.073|\n|Median|0.505/0.388/0.117|\n|Trimmed-mean|0.589/0.503/0.086|\n\nThese results demonstrate that SelfishAttack can still achieve a clear competitive advantage even in a not fully connected setting. Therefore, we believe that the attack strategy designed for FedAvg can be generalized to the not fully connected setting."}, {"review_id": "bhq7iArMRV", "reviewer": "Reviewer_F5dV", "summary": "This paper introduces SelfishAttack which is a new family of attacks in decentralized FL where a subset of clients are selfish and collude to improve their own local model performance with respect to the non-selfish clients (competitive advantage goal) without disrupting overall training (utility goal). The attack is formulated as an optimization problem to achieve the dual objectives. The paper also provides closed-form optimal attack solutions for popular aggregation rules - fedavg, trimmed mean, and median. Results on CIFAR-10, FEMNIST, and Sent140 show that the selfish clients reach upto 10-13% higher accuracy than non-selfish clients without getting filtered out by robust aggregators.", "questions": "The attack is started late as starting it early could poison the non-selfish nodes from the beginning and utility goal would not be reached. When is the training process stopped? It feels like early stopping would result in a dip in non-selfish accuracy (as desired) but continuing with the training could spread the attack infection, reducing the utility goal. Does the selfish accuracy keep on increasing even after starting the attack? How does the final selfish accuracy compare with the highest selfish/ non-selfish accuracy achieved over the training rounds. I ask this because it feels that if you just run the attack over the last few training rounds while not letting the selfish nodes learn from non-selfish models, you could easily achieve the competitive goal regardless of the actual attack method as long as the non-selfish models are being poisoned. Does the described attack reach a steady state in terms of the accuracy gap or does the gap keep increasing if the attack is continued?\n\nIn Table 2, why does selfish defense not improve selfish accuracy in selfish attack? The conclusion from Table 2 that the best strategy is to aggregate from all clients is based on just one experiment and cannot be generalized.\n\nFor the parameter settings described in Line 250 - approximately how many training rounds were benign and how many were attacked?\n\nWhy is \\lambda set to 0 for FedAvg? How is competitive advantage still observed in Table 1 after setting it to 0?\n\nWhy does Trim attack have no impact on FedAvg training of Sent140?\n\nWhat dataset is used in the results mentioned in Table 3? \n\nHow does the attacker control the post-aggregation models in Krum where only one model is chosen for aggregation, how is Krum fooled?", "limitations": "Yes, they have, but this point is also worth mentioning if true - \nThe attack requires knowledge of current model updates across all the nodes to be successful. It would have been impressive if the selfish models can leverage the past updates of the non-selfish nodes to estimate and craft the attacked models. Working on the current update leads to a lag between receiving honest updates and sending back crafted models to a neighbor in the DFL setting increasing suspicion of foul play.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths - \n\nThis novel attack does not poison the entire system, rather achieves competitive advantage over other nodes while maintaining utility.\n\nSection 4 and Figure 2 are impressive and provide the methodology details very clearly, providing mathematical guarantees wherever possible.\n\nResults in Table 1 are impressive showing unambiguous competitive advantage.\n\nThey compare both - individual and ‘two coalitions’ methods with the attack. The evaluation is sound. The utility goal is better confirmed with the ‘two coalitions’.\n\nWeaknesses - \n\nThe greatest weakness in the attack method is that there are too many unsaid assumptions in the framework - it seems to be assumed that the communication graph is fully connected, or that the selfish clients have access to the gradients generated by all non-selfish clients. Line 24 says that all clients converge to identical models after each round - this is not true in a decentralized setting unless all nodes are connected and are using the exact same mixing weights as all other nodes. The fully connected graph seems to be an implicit assumption which may not hold in general decentralized settings (as can be even seen in Fig 1). The attack seems more appropriate in FL where a server has actual access to all client models, than in DFL. Knowledge of all non-selfish models makes the threat model very weak and thus the attack impact high.\n\nIn addition to the full view of the system and all client gradients, the attacker also needs to set the right \\lambda value and the right ‘r’ value for good results. Together, these make the uncertainties too high, and without full knowledge of the system (which is unavailable in a DFL setting), the attack could not be as successful.\n\nIt appears that the selfish clients first receive the benign gradients from the non-selfish clients, process the received data to craft malicious models and then send the crafted models to them. This is not practical in a decentralized gossip setting. This delay is suspicious and would be indicative of an attack during the gossip stage itself. \n\nFig 4 shows that SelfishAttack outperforms other attacks but the attack baselines chosen are weak. The Fang attack mentioned in the FLTrust paper can be a stronger baseline to compare against.", "was_revised": true, "final_justification": "The biggest concern were two assumptions made in the original paper - malicious nodes having access to the full view of the system that is fully connected, and asymmetry in communication in the sense that the malicious nodes first receive the being updates, craft the attack and send the poisoned updates to the non-selfish nodes. \n\nI had suggested the authors to consider partially connected communication graph and symmetry in communication by making use of the past updates from the non-selfish clients. They performed the experiments in the rebuttal and the results are positive.\n\nI had further asked them to make changes in the threat model and the math accordingly with the changes in assumption, and they have done the hard work and made the changes, accepting that the new solution is a heuristic and not truly optimal in a more practical threat model, as suggested by me. \n\nAll concerns have hence been addressed. Therefore, I am increasing my score from 3 to 5.", "rebuttal": "Thank you for acknowledging our work and for your insightful comments. Our responses are provided below.\n\nW1: **Unsaid assumptions**: We conduct an experiment under a not fully connected setting. Specifically, we randomly generate a graph structure where each client is connected to only 10 other clients (20 clients in total). In this case, selfish clients do not have access to the full connectivity structure of the DFL system, that is, they do not know which clients each non-selfish client is collaborating with. Therefore, it is difficult to directly apply the attack strategies proposed in the paper for FedAvg, Median, and Trimmed-mean in this setting. However, we can still construct an attack based on all the local models of non-selfish clients that are accessible to selfish clients. Therefore, we use the same attack strategy designed for FedAvg to attack FedAvg, Median, and Trimmed-mean. The results are as follows:\n\n\n|||\n|-|-|\n|FedAvg|0.602/0.569/0.073|\n|Median|0.505/0.388/0.117|\n|Trimmed-mean|0.589/0.503/0.086|\n\nThese results demonstrate that SelfishAttack can still achieve a clear competitive advantage even in a not fully connected setting. Therefore, we believe that the attack strategy designed for FedAvg can be generalized to the not fully connected setting.\n\nW2: **Uncertainties**: For the different attack strategies proposed in our paper (FedAvg-based, Median-based, and Trimmed-mean-based), we use a fixed value of $\\lambda$. Specifically, $\\lambda$ is set to 0.0 for the FedAvg-based attack, and 0.5 or 1.0 for the Median- and Trimmed-mean-based attacks. This does not require full knowledge of the system and remains constant regardless of any other factors. Figure 3 is only intended to illustrate the motivation behind our choice of $\\lambda$ for these three strategies. Table 3 presents results of attacks against other aggregation rules. In these experiments, we adopted the FedAvg-based attack, and thus $\\lambda$ is fixed at 0.0 accordingly.\nAs for r in Equation 8, it is computed directly and does not require manual selection. Therefore, our experimental parameters are fixed and do not rely on any specific knowledge of the dataset or DFL system.\n\nW3: **Delay is suspicious**: We experiment with using the models received from each non-selfish client in the previous round, as estimates of their current-round sent models, when computing the selfish model to be sent by selfish clients. The results (CIFAR-10, MTAS/MTANS/Gap) are as follows: \n\n|||\n|-|-|\n|FedAvg|0.475/0.327/0.148|\n|Median|0.545/0.427/0.118|\n|Trimmed-mean|0.594/0.483/0.111|\n\nThese results are very close to those obtained using the actual current-round models. We will consider updating our algorithm to use the previous-round models to address this concern.\n\nW4: **Stronger Baseline**: In fact, the Fang attack is equivalent to the TrimAttack described in our paper. We further include its Krum-based variant, referred to as the Krum Attack. The results are as follows:\n\n||KrumAttack|\n|-|-|\n|FedAvg|0.103/0.100/0.003|\n|Median|0.598/0.589/0.009|\n|Trimmed-mean|0.611/0.609/0.002|\n\nQ1: **The attack is started late…**: In fact, for CIFAR-10, the attack typically begins around round 200, and once initiated, selfish clients can achieve a clear competitive advantage within just 10 rounds. After that point, the average accuracy of both selfish and non-selfish clients increases slightly (by about 0.05), and the Gap tends to stabilize until training ends (at 600 rounds). Therefore, neither early stopping nor continuing training significantly affects the effectiveness of SelfishAttack. As long as the attack is launched after a certain round, selfish clients can consistently gain a stable competitive advantage. \n\nWe test the effectiveness of SelfishAttack when launched during the final 50 rounds of training, while also preventing selfish clients from learning from non-selfish clients. The resulting Gaps are 0.132 for FedAvg, 0.116 for Median, and 0.110 for Trimmed-mean, which are relatively close to the results in Table 1. However, 'early stopping' can be an effective defense against such 'last-round attacks,' especially in settings where the model is continuously updated and the end of training is uncertain.\n\nQ2: **Selfish defense does not improve selfish accuracy**: Here, the 'Selfish' entry under the 'Info' column does not refer to a defense mechanism, but rather indicates whether the model used during aggregation by selfish clients comes from all clients or only from selfish clients. The reason why 'All' outperforms 'Selfish' is that selfish clients can still gain some useful information from the models of non-selfish clients. In addition, we add experiments where non-selfish clients use Median, selfish clients perform a Median-based attack, and use FedAvg to aggregate the selfish clients' local models. The results are as follows:\n\n|Info.|TrimAttack|GaussianAttack|SelfishAttack|\n|-|-|-|-|\n|All|0.524/0.513/0.011| 0.619/0.617/0.001|0.543/0.425/0.119|\n|Selfish|0.510/0.513/-0.003|0.510/0.617/-0.107|0.510/0.425/0.085|\n\nThis further supports the conclusion that models from all clients should be used for aggregation, rather than relying solely on those from the selfish clients.\nQ3: **Number of benign and malicious training rounds**: Roughly, on CIFAR-10, the first 200 rounds are benign, and the later 400 rounds are attacked.\n\nQ4: **Why is \\lambda set to 0 for FedAvg**: Because FedAvg is not a robust aggregation rule, using a large value of $\\lambda$ would cause the model aggregated by non-selfish clients to deviate significantly from the model aggregated solely from all non-selfish clients' models. This would lead to poor performance for the non-selfish clients, preventing the selfish clients from benefiting from them. For the impact of different $\\lambda$ values on performance, please refer to Figure 3.\n\nQ5: **Trim attack has no impact on Sent140**: This may be because Sent140 is a binary classification task, where the worst-case performance (i.e., random guessing) is 0.5. In addition, the TrimAttack also has some impact, causing the average accuracy of non-selfish clients to drop by around 0.08.\n\nQ6: **Dataset used in Table 3**: It’s CIFAR-10, which is our default setting.  We mentioned our default settings in line 251.\n\nQ7: **How krum is fooled**: Because Krum selects the model that has the smallest sum of Euclidean distances to its closest (n+m)−m−2 neighbors, and most selfish clients send models that are identical to the local model of the targeted non-selfish client, the distances between these models are nearly 0. As a result, Krum is highly likely to select the model sent by a selfish client.\n\nL1: **Leverage the past updates**: Thank you for your suggestion. We experiment with using the past models received from each non-selfish client. Please see the response to W3 for more details."}, {"review_id": "yxrWKmuXj8", "reviewer": "Reviewer_3xSU", "summary": "This paper introduces SelfishAttack, a novel family of attacks targeting decentralized federated learning (DFL) systems. Selfish clients collude to manipulate shared models, aiming to achieve both a utility goal (improving their own model accuracy beyond standalone training) and a competitive-advantage goal (outperforming non-selfish clients).", "questions": "See above", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "Overall, this paper's idea is novel and interesting.\n\nStrength: \n1. This paper presents a novel approach with a sound and insightful underlying intuition, contributing meaningfully to the field of federated learning.;\n2. The manuscript is well-written, clearly structured, and easy to follow.\n3. The attack’s optimality is proven for FedAvg, Median, and Trimmed-mean, providing a solid foundation for its effectiveness.\n\nWeakness:\n1. The proposed attack can also be interpreted as an attempt to degrade the utility of other participants. Therefore, the paper should explicitly discuss the distinction between its approach and existing Byzantine or collusion-based attacks, such as those presented in [1, 2]. A clearer comparison would help situate the contribution within the broader landscape of adversarial strategies in federated learning.\n\n[1] Fang M, Cao X, Jia J, et al. Local model poisoning attacks to {Byzantine-Robust} federated learning[C]//29th USENIX security symposium (USENIX Security 20). 2020: 1605-1622.\n\n[2] Gu H, Fan L, Tang X, et al. Fedcut: a spectral analysis framework for reliable detection of byzantine colluders[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024.\n\n2. Given that the advantage of the proposed method is closely tied to fairness issues in federated learning, it is important that the paper includes a discussion of related work on fairness-aware FL algorithms. This would help clarify how the proposed method impacts or aligns with fairness goals in collaborative learning settings.\n\n3. Current Byzantine-robust rules (e.g., Median, Trimmed-mean) cannot fully mitigate the attack, necessitating new defense mechanisms.", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your recognition of our work and your valuable feedback. Please find our responses below.\n\nW1: **A clearer comparison to existing attacks**: Thank you for your positive feedback on our work. We discuss the \"Comparison with poisoning attacks\" of SelfishAttack in the Threat Model section. Overall, the differences between SelfishAttack and existing attacks are:\n\n1). Adversary type: Byzantine or collusion-based attacks are typically launched by external adversaries or internal clients, while SelfishAttack is conducted by internal, coordinated clients within the system.\n\n2). Objective: Byzantine or collusion-based attacks aim to indiscriminately degrade overall model performance, often harming even the compromised clients. SelfishAttack, on the other hand, aims to degrade non-selfish clients’ performance while improving or preserving the performance of selfish clients, thereby gaining a competitive advantage.\n\nW2: **Discussion of related work on fairness-aware FL**: We will consider incorporating some related works about fairness into our paper, such as [1, 2, 3].\n\n[1] Mohri, Mehryar, Gary Sivek, and Ananda Theertha Suresh. \"Agnostic federated learning.\" International conference on machine learning. PMLR, 2019.\n\n[2] Shi, Yuxin, Han Yu, and Cyril Leung. \"Towards fairness-aware federated learning.\" IEEE Transactions on Neural Networks and Learning Systems 35.9 (2023): 11922-11938.\n\n[3] Ezzeldin, Yahya H., et al. \"Fairfed: Enabling group fairness in federated learning.\" Proceedings of the AAAI conference on artificial intelligence. Vol. 37. No. 6. 2023.\n\nW3: **New defenses**: We discussed potential defenses against SelfishAttack in Appendix K. For example, one possible direction is to explore cryptographic techniques to enforce that a selfish client sends the same shared model to all clients."}]

Author rebuttal:

Meta-review: This paper received the following ratings: Accept, Borderline accept, Accept, Accept. The authors present SelfishAttack, an adversarial strategy in decentralized federated learning, where a group of selfish clients collude to improve their own model performance while degrading others non-selfish clients. The attack is mathematically optimized for various aggregation rules (FedAvg, Median, Trimmed-mean) and shows strong results across multiple datasets. This new attack does not poison the entire system, rather achieves competitive advantage over other nodes while maintaining utility, which makes it harder to detect. Most reviewers find the proposed approach novel, with a sound and insightful underlying intuition. Solid mathematical justifications have been provided wherever possible.  AC recommends accepting the paper.
Decision: Accept (poster)