Gaming and Cooperation in Federated Learning: What Can Happen and How to Monitor It
Authors: Dongseok Kim
Hyoungsun Choi
Mohamed Jismy Aashik Rasool
Gisung Oh
Venue: Accepted by TMLR ()

Abstract: The success of federated learning (FL) ultimately depends on how strategic participants behave
under partial observability, yet most formulations still treat FL as a static optimization
problem. We instead view FL deployments as governed strategic systems and develop an analytical
framework that separates welfare-improving behavior from metric gaming. Within
this framework, we introduce indices that quantify manipulability, the price of gaming, and
the price of cooperation, and we use them to study how rules, information disclosure, evaluation
metrics, and aggregator-switching policies reshape incentives and cooperation patterns.
We derive threshold conditions for deterring harmful gaming while preserving benign cooperation,
and for triggering auto-switch rules when early-warning indicators become critical.
Building on these results, we construct a design toolkit including a governance checklist and
a simple audit-budget allocation algorithm with a provable performance guarantee. Simulations
across diverse stylized environments and a federated learning case study consistently
match the qualitative and quantitative patterns predicted by our framework. Taken together,
our results provide design principles and operational guidelines for reducing metric
gaming while sustaining stable, high-welfare cooperation in FL platforms.

Published in Transactions on Machine Learning Research (03/2026)
Gaming and Cooperation in Federated Learning: What Can Happen and How to Monitor It
Dongseok Kim
Jed33920@ggchnn..cckk
Deportment of Computer Engineering
Gochon University
Hyoungsun Choi"
hschoi@@achon..cmm ac.
Department Computer Engineering Gochon University
Mohamed Jismy Aashik Rasool
aushikkaasoll@ggchon..ccco
Department of Computer Engineering Gochon University
Gisung Oh
eustia@gachon.oc..
Department of Computer Engineering Gochon Universily
Reviewed on OpenReview: https: // openrevie.. net/ forum? id= Ck3qqYdWTo
Abstract
The success of federated learning (FL) ultimately depends on how strategic participants be- have under partial observability, yet most formulations still treat. FL static optimization problem. We instead view FL deployments governed strategic systems and develop alytical framework that separates wellare-improving behavior from metric gaming. Within this framework, we introduce indices that quantify manipulability, the price of gaming, and the price of cooperation, and we use them to study how rules, information disclosure, evalua- tion metrics, and sggregator-switching policies reshape incentives and cooperation patterns. We derive threshold condit ions for deterring harmful gaming while preserving benign coop- eration, and for triggering auto-switch rules when early- early-warning indicators become critical. Building these results, construct design toolkit including governance chocklist and simple audit-budgei allocation algorithm with a provable performance guarantee. Simula- tions across diverse stylized environments and federated learning case study consistently match the qualitative and quantitative patterns predicted by our framework. Taken to- gether, our results provide design principles and operational guidelines for reducing metric gaming while sustaining stable, high-welfare cooperation FI, platforms.
1 Introduction
1.1 Motivation
Federated lcarning (FL) enables multiple organizations to train a shared model without moving data, and adoption has been growing through consortia and platform- collaborations. As cross-organizational data collaboration expands, keeping data. local while jointly training models has become leading alternative traditional data pooling, especially when privacy, confidentiality, and regulatory constraints rule out centralization. In this setting, FL naturally supports emerging data and AI services in which participants
"These authors contributed equally.
i "oorreppondigg author.

---

Published in Transactions on Machine Learning Research (03/2026)
retain control over their local data while contributing to shared intelligence that is monetized or governed through metrics, contracts, and service-leeel guaraniees.
At the same time, the surrounding governance has not matured at the same pace. Many organizations are still in early stages of formalizing procedures for Al-enabled services, clarifying accountability, and embedding risk mitigation into day-to-day operations. In FT,, these gaps are particularly consequential: joint outcomes depend on the actions of multiple parties whose internal processes are opaque to one another, yet whose rewards and reputation are coupled through shared metries. When rewards, rankings, access rights depend these metrics, participants face incentives not only to improve gemuine performance but also to target the metrics themselves, potentially drifting toward high-metric, low-welfare regimes.
This (ension is amplified by the combination of privacy and limited observability. Privacy-enhancingg tech- nologies such as FL, differential privacy, and secure computation restrict what can be inspected or audited, and information design around metrics and scores further shapes what participants see and react to. Strong protections are desirable, but they also reduce the visibility of individual behavior and may unintentionally make harmful manipulation harder to detect. Designing FL systems therefore requires more than choosing optimizer aggregation rule: it requires coordinated view of evaluation, information disclosure, rewards, audits, and participation, and of how these choices jointly shape incentives, cooperation, and stability.
This paper aims to provide such a view. We treat FL as a governed strategic system and develop three-layer framework that (i) quantifies how design choices create room for metric gaming and cooperation, (ii) links these quantities to participation dynamics and tipping points, and (iii) maps them to practical levers such mixed publie-private evaluation, audit allocation, sanction calibration, and auto-switch rules. Our goal is not to propose yet another FL algorithm, but to offer compact language and toolkit that helps designers reason about metric gaming, cooperation, and governance in federated environments.
1.2 Contributions
We view federated learning not merely as a distributed optimization problem but as a governed strategic system in which evaluation rules, information disclosure, reward and sanction mechanisms, and audit capacity jointly shape participants' incentives. Our contributions are to provide a formal language for this system, to connect that language to simple indices and thresholds that can be estimated from data, and to distill resulting design principles into an actionable toolkit.
Strategic formalization of federated lcarning. We formalize a generic Gual-Info-Rewwe Audil architecture for federated learning platforms (Section 3 specilying welfare, public and private metrics, participation choices, and cooperative actions (e.g., coalition formation, data sharing) within a single game-theoretic environment. This provides a common backbone on which existing robust aggregation, incentive, and privacy mechanisms can be placed.
Indices for manipulability, gaming, and cooperation. three indices that summarize how a design policy trades off metric performance and welfare: a manipulability index M(T) that captures the best achievable metric gain per unit welfare loss under unilateral deviations, a Price of Gaming PoG(T) that measures welfare loss when a fraction of clients adopt gaming behaviors, and a Price of Cooperation PoC that quantifics the net welfare effect of coalitions (Section 4p. We establish basic properties of these indices, show how they interact with simple penalty schemes, and use them to define design- time thresholds (amin abengga) that harmful gaming regimes, and over-enforcement that discourages benign
On top of this backbone, we introduce
separate cooperation.
Participation dynamics, resilience, and tipping thresholds. We couple the metric layer to a stylized participation dynamics model, defining an aggregate participation map F(x; X) and a resilience indicator R(T)) that summarize how participation responds to policy changes (Section 5 Under this model, we characterize tipping points and domino-style exits, and show how the indices above bound the regions in which small changes in sanction strength or public-metric weight can trigger large shifts in participation. This yields interpretable thresholds and heuristic rules for maintaining participation stability while suppressing high-PoG equilibria.
2

---

Published in Transactions on Machine Learning Research (03/2026)
Design toolkit for evaluation, audits, and governance. Building these indices and dy- namics, we propose set of design patterns for federated platforms (Section D including mixed public/private evaluation schemes, audit-budget allocation rules with (1-1/e) approximation guar- antees for detecting high-mannpulabiiityy clients, and a governance checklist that links observable diagnostics (e.g., gaming incident rales, participation responses, coalition structures) to concrete levers (metric choice, disclosure policy, sanction strength, and audit allocation).
Empirical illustrations in stylized and federated scttings. Finally, we instantiate the frame- work in a stylized simulator and a federated Mishion-MNIST experiment (Section 7). showing how high-metric/ mewetric/loowwellarr equílibria, participation tipping, and benign versus harmful cooperation patterns arise under different design policies. We demonstrate that our indices can be approximated using simple scenario-based experiments and log- based diagnostics, and that the proposed toolkit can detect and mitigate high-PoG regimes without collapsing participation.
2 Related Work
2.1 FL Attacks, Defenses, and Robust Aggregation
Early work on robustness in federated and distributed learning asked whether a small mumber of malicious or corrupted updates can derail training, leading robust aggregation rules such as Krum, coordinate- wise median and trimmed mean, Bulyan, and Robust Federated Aggregation (RFA) (Blanchard
al. 2017 Yin et al. 2018 Guerraoui et. al. 2018 Pillutla al.] 2022), along with convergence analyses under Byzantine noise and coding-based based defenses (Alistarh et al. 2018 Bernstein et al. 2018 Chen et al. 2018 Subsequent studies implemented these mechanisms under realistic constraints and exposed their limits via model-poisoning, backdoor, and tail-group allacks, and proposed collusion- and Sybil-aware defenses such
as FoolsGold and FLTrust (Damaskinos et al. 2019 Xie et al.) 2020 Baruch et al. 2019: Fang et al 2020;
Bagdasaryan et al. 2020 Wang et al. 2020 Fung et al., 2018 Cao et al. 2020). Our work does not add another aggregation or poisoning defense; instead, we ask how the choice rules, metrics, and audits shapes incentives for manipulation and cooperation, and how these incentives affect aggregate performance and participation even when the underlying optimization dynamics well behaved.
2.2 Incentive Design and Differential Client Contribution
Differential contribution and reward design often start from data valuation: Shapley--allu--bssed methods, influence functions, and learned value estimators seek fair allocations by tracing marginal contributions of data or clients (Ghorbani & Zou 2019: Jia et al. 2019 Koh & Liang 2017 Yoon et al.. 2020 Liu et al.,
2022b Chen et al.) 2023 2024
Tastan al. 2024). Direct incentive schemes use reputation, contracts, auctions, and blockchain-based mechanisms to induce participation and effort, while parallel work folds contribution weighting into learning and aggregation to target fairness, robustness, resource-aware client
selection (Kang ct al.] 2019
Zhang et al. 2021a Tang et al.) 2024 Zhang et al. 2021b Liu et al. 2020:
Mohri et al. 2019 Li et al.
2019 Lai et al. 2021 Nishio & Yonetani 2019 Lin el al. 2023 Kim el al.
2024 Ouyang & Kuang 2025
These approaches typically treat incentives as reward-allocatio functions on
fixed metrics or as modified aggregation rules; in contrast, we focus on the strategic environment induced by evaluation and audit design itself and introduce indices that quantify when such designs incentivize gaming versus genuine improvement.
2.3 Game Theory of Federated Learning and Participation Dynamics
Game-theoretic treatments of FL have emphasized coalition formation, stability, and free-riding, using hedo- nic games, coalition models, and cooperative-ganee valuat ions to study gaps between individually stable and
globally optimal outcomes (Donalue & Kleinberg] 2021a Hasan 2021 Nagalapatti & Narayanam 2021). Repeated-game and leader-followe analyses show how punishment strategics, contract-theorcee mecha- nisms, and Stackelberg formulations can deter free-riding and align server-client incentives under private
information, including collusion- and Sybil-aware variants (Zhang et al.] 2022 Sagduyu 2022 Luo et. al.
3

---

Published in Transactions on Machine Learning Research (03/2026)
2023
Sarikaya & Ercetin
2019
Hu & Gong 2020
Le et al. 2021 Ding et al. 2020 Liu et al. 2022a Huang
et al. 2024 Byrd et al. 2022 Xiong et al. 2024). Our work shares the strategic perspective but shifts
focus from specific mechanism equilibria to a metric- language and threshold results for participation stability, tipping points, and domino exits under generic rule sets.
2.4 Metric Gaming and the Goodhart Phenomenon
Metric gaming is often summarized by Goodhart's observation that once a measure becomes a target, it oeases to be a good mcasure. Prior work has categorized mochanisms behind this phenomenon and docu- mented failure modes such as reward hacking, non-scalable oversight, and goal misgeneralization (Manheim & Garrabrant 2018 Amodei et al., 2016; [kkals et. al., 2022 Everitt et. al. 2021 Di Langosco al. 2022). When metrics drive decisions and thereby change the data, the problem becomes strategic: models of strate- gic classification, Stackelberg interactions, and performative prediction analyze how agents respond to public classifiers and how repeated retraining interacts with distrriuttinal shifts (Hardt et al. 2016a Brückner & Scheffor 2011 Perdomo et al.) 2020 Mendler-Dünner et al., 2020 Miller et al.] 2020). We build on these insights but specialize them to FL, focusing on how evaluation metrics, disclosure policies, and audits induce client-level incentives for metric targeting and introducing explicit indices and thresholds that distinguish welfare-improving behavior from gaming.
2.5 Design of Evaluation Information, Audits, and Sanctions
Information design around metrics and scores has been proposed a primary tool against overfitting and gaming, via staircase leaderboards, reusable holdouts, and adaptive-data-analysi bounds for safe repeated evaluation (Blum & Hardt 2015 Dwork et al. 2015b a
Bassily et al. 2016). From the audit side, work on fairness, documentatiin, behavior-based testing, and distribution-shif benchmarks has developed pro-
cedures and artifacts that surface vulnerabilities beyond single scalar metrics (Kearns et al., 2018 Hardt
ct al.
2018 Kusner et al.) 2017 Mitchell et al., 2019 Gebru et al., 2021 Ribeiro et al. 22000 Kiela et al.) 2021 Koh et al. 2002 Croce et al.] 2020). Privacy and memo-
2016b Kim et al., 2019 Agarwal ct al.
rization ceclits-inccudinng membership inference, memorization measures, data extraction, and backdoor
detection further highlight the role of audits and sanctions in deployed systems (Shokri et al. 2017 Car-
lini et al. 2019 2021 Tran et al. 2018 Wang et al., 2019: Rabanser et al.) 2019 Dressel & Farid 2018)
These strands provide building blocks for evaluation and auditing but are usually studied separately from incentives and participation; our contribution to integrate evaluation information design, audit allocation,
and sanction triggers into a single FL framework with indices and thresholds linked to gaming incentives
and cooperation stability.
2.6 Trade-offs Between Privacy and Incentives
Privacy in FL is commonly enforced through client-level differential privacy and secure aggregation, often combined with distillation or selective-sharing protocols to limit exposure of sensitive data (Abadi et al.) 2016
McMahan et al. 2018 Geyer et al. 2017 Bonawitz et al.
2017
Erlingsson et al. 2019 Papernot et al. 2017
2018 Shokri & Shmatikov 2015 Gilad- Bachrach et al. 2016 Refined attack models, including gradient
inversion, attribute inference, backdoor and membership attacks, have clarified the limits of these protections and the tension between strong privacy, visibility of malicious behavior, and group-level performance and
fairness (Melis et al., 2019: Zhu et al.] 2019 Bagdasaryan et al., (2000: Wang al., 2020 Bagdasaryan et al. 2019: Jagielski et al. 2019 Tramer & Boneh, (020)). Recent work on proofs of correct training and bidirectional verification protocols aims to restore some auditability under privacy constraints (Jin et al,
2021 Zhang & Yu 2022. , but typically remains orthogonal to incentive design. Our framework explicitly
foregrounds the trade-offs between privacy, audit signals, and incentives, and proposes design patterns-sun as randomized evaluation, limited disclosure, and connectivity-basee alarms that help maintain incentive alignment and sanctionability under realistic privacy and legal constraints. While prior work typically focuses on individual mochanisms, attacks, or defenses, our contribution to provide a platform-level framework that jointly links metric gaming, welfare loss, participation dynamics, and governance levers through explicit indices and design thresholds.
4

---

Published in Transactions on Machine Learning Research (03/2026)
3 Federated Learning as a Strategic System: Setup and Notation
In this section we formalize federated learning (FL) as strategic system. The goal is not fully realistic economic model, but a minimal structure that (1) makes precise what clients can do strategically, (fi) separates true welfare from observable metrics, and (ii) allows design choices in evaluation, information, rewards, and audits to be treated as policy variables. Our aim is to isolate the FL-specific sources of strategic tension: (i) repeated, round-based interaction; (ii) aggregation, where each reported updale affects a shared global model; and (iii) partial observability, where rewards and sanctions are functions of evaluation pipelines rather than direct welfare. Concretely, we treat evaluation, information disclosure, rewards, and audits as explicit policy components (Eval, Info, Reward, Audit) that are coupled to the learning protocol through Agg, and the induced metric process (Mr)-
3.1 Federated environment and timing
We consider a cross-silo FL environment with a finite set of clients
I= (1,...., n
and a coordinating server. Time is discrete,
t 1,2.....
where T may be finite or infinite. At each round L, the server maintains a global model
0, E Rdd
and each client i holds local dataset D; drawn from unknown distribution P. We write p= (Pi for the collection of client distributions and p* for the target population distribution of interest.
A generic round proceeds as follows:
1. Broadcast: the server broadcasts 0g to eligible clients.
2. Participation and action: each client chooses participation Pia {0, 1) and, if participating, local training/reporting behavior.
3. Local computation: participating client computes an internal update und e Rd from (Di, Oc). int 4. Reporting: client reports update Wa, E Rd, which may equal o (honest), be perturbed (privacy/obfuscatioon) or be strategically chosen.
5. Aggregation and evaluation: the server aggregates updates from Iç = {i: Pt, = 1} via Agg, and evaluates via Eval, to produce observable signals.
the server assigns rewards, selects audits, and applies sanctions based on observable signals and history.
Rewards, audits, sanctions:
This timing highlights the key FL dependence: the designer does not observe client-side behavior directly, but only the outputs of Eval, applied to aggrogated models and challenge data. Thus, incentives operate through a mediated channel (scores, disclosures, and audits) rather than through welfare itself, and stralegic behavior targets whatever components of O, are disclosed and rewarded.
The tuple
E = (I,P, (P,P*,(D))) (D.)iez, (0che2 (Agg))21)
specifies the algorithmic FL environment. Strategic behavior is determined by how actions, metrics, rewards, and audits are defined on top of E.
5

---

Published in Transactions on Machine Learning Research (03/2026)
3.2 Actions, strategies, metrics, and welfare
Actions and strategy space. At each round i, client i chooses an action
0i, A.,
where As is feasible action set. We model aie encoding: (i) participation Pi, {0, 1), (ii) local training
effort/poe /ooort/y that determines wig and (iii) a reporting/ manipulation policy that maps (0,, Vit Di, history) to reported update Wi,t and auxiliary reports.
reporting/maniipaatiion
Let h denote the public history up to and including round t (e.g. disclosed scores, sanctions, aggregate statistics). A (behavioral) strategy for client i is a mapping
0, 14-1 + Oi,t-
Let Σ, denote the set of admissible strategies for client i, and define the ambient strategy space
Σ II E
SEZ
Reference classes (threat models). Some of our indices restrict attention to a subset of feasible devia- tions, such as bounded gaming intensity, bounded coalition size, or actions compatible with a given protocol. Definition 3.1 (Reference class). A reference class subset F S Σ specifying the deviations (or strategy profiles) deemed feasible in the deployment under study. Indices defined via worst-case deviations are interpreted as restricted to ref
True outcomes and welfare. Given a strategy profile a E E and environment E, the induced model trajectory {0:} yields time-dependent true welfare on P
Wi(a) = ((,;; P*),
where W is task-dependent welfare functional. We summarize long-run welfare by an aggrogate functional W :(o):==<(MM ((W(()()((
such steady-state value discounted average.
Metrics and proxy performance. Rewards, sanctions, and policy changes depend on metrics computed from finite evaluation sets and partial information. Let
Mí(a) E R
denote a vector of observable metrics at round t and
M(a) ((M((()))))
aggregate metric used for decision-making behavior is driven by how M enters payoffs, not by W directly.
In general, M(a) need not coincide with W(a); strategic
In federated deployments, this misalignment is structural: M, is computed on finite, possibly public bench- marks and challenge sets, while W, is defined on the deployment distribution p* and may emphasize tail groups or operational constraints not fully captured by evaluation. Our indices therefore quantify gaps that arise becouse FL platforms must rely on proxy measurements under limited observability and audit budgets.
Client payoffs. Each client receives cumulative payoff
U,(o) E Σ 8" (Baolo)
where R,, is the and the expectation is over randomness in seaniing/vvalaatonn /audits..
C,,, denotes costs (computation, communication privacy loss, sanctions),

---

Published in Transactions on Machine Learning Research (03/2026)
3.3 Observation, information, rewards, and audits
Design choices in our framework are expressed through coupled channels: what is measured, what is disclosed, and how enforcement responds.
Evaluation and observation. At each round 4, Eval, maps the current and candidate models (and internal evaluation data) to raw observations, e-g., a global score Selob, local/per-group scores Sie and private/randomized challenge outcomes Ci We collect these into
O2 (Splob, ( (Crthez).
Information disclosure. The information mechanism Info, selects which components of Ot to disclose (and at what gramularity) to each client. We denote the disclosed signal to client by
Zi = Infor Ot, ht-1).
Clients condition actions on Z, (and history), not on the full Oz.
Rewards and sanctions. Rewards and penalties respond to disclosed signals and history:
Rat Reward, Zi,t. h4-1).
The audit-sanctian sanction mechanism selects an audited subset A, under a budget constraint and assigns sanctions P.
Audit; : (0-)))11)0 + (Aes (Pachee).
Design policies and induced game. For many results, it is convenient to treat
π (Eval, Info, Reward, Audit)
as a design policy chosen by the server. A policy together with the environment & induces a strategic system (game) in which clients choose o, E Σj to maximize U,(o), while the designer evaluates welfare (()) and metric behavior M(a).
Definition 3.2 (Federated strategic system). A federated strategic system is the tuple ((x) (E, (2)
which induces the payoff functions {U,(-) and welfare/metric functionals (W(,,, over E.
Where our theoretical statements later appear game- theoethe,retic, their content is tied to the FL design surface: Agg, determines how participation and reporting affect future models, Eval, determines which metric com- ponents
measurable, Info; determines what clients can condition on, and Audit, determines which deviations become detectable and sanctionable. These are precisely the elements that distinguish federated systems from standard principal-agent abstractions without learning-and-evalatttn pipeline.
In the next section, we define indices such as manipulability and the Prices of Gaming and Cooperation, which quantify how a policy π shapes the gap between observable metrics and true welfare and how strongly incentivizes gaming versus cooperation.
4 Metric Layer: Indices for Gaming and Cooperation
Building the strategic formulation in Section 3 we now introduce indices that quantify (1) how much room a design policy leaves for metric gaming and (ii) how costly gaming and cooperation are for collective welfare. These indices form the metric layer of our framework: they ignore the precise structure of training and aggregation and focus on how evaluation, information, and incentives shape the relationship between metric performance and true welfare.
Throughout this section, we fix an environment and a design policy π (Eval, Info, Reward, Audit), and write ((T) for the induced federated strategic system (Section 3.2

---

Published in Transactions on Machine Learning Research (03/2026)
4.1 Decomposing welfare and metric responses
We first formalize how unilateral deviations by single client affect welfare and metrics. Definition 4.1 (Local welfare and metric responses). Let o be a strategy profile in ((T), and let of be an alternative strategy for client i. We define
(W | o= W(o - W()),
AM 1o) == M(d), M(o),
the change in true welfare and in the aggregate metric induced by client i deviating from o; to of while all other clients keep --i.
We interpret AW; > 0 as welfare improving and AW, < 0 as welfare- harming, with an analogous interpreta- tion for AM, Our primary interest is in deviations that improve the metric while leaving welfare unchanged or worse.
Definition 4.2 (Metric-gaming deviation). A deviation of + o, profile a is a metric-gaming deviation if (M о) >
and AW 1)) s.
It is strongly gaming if (W (0) < 0.
For equilibria, we often focus on steady-state profile of (e.g., stationary or long-run equilibria) of ((T), but the indices below apply equally to transient profiles.
4.2 Manipulability index
Intuitively, the manipulability of a design policy æ measures how much a client can improve the metric without improving welfare, relative the scale of attainable welfare improvements.
Definition 4.3 (Local manipulability at profile). Let a be strategy profile in G(T). The local manipu- lability at is
| [0] (W |0]] +
M(a; x) == sup sup iEZ deA;
where [z]+ = max 0} and s > 0 is a small normalization constant that prevents division by zero when no inproviiimppooingg deviation exists.
The numerator is the largest metric gain client can obtain by deviating from o, and the denominator normalizes by the scale of possible welfare improvements. Heuristically, small M(a; m) means metric gains are only available when accompanied by comparable welfare gains, while large M(a; means the metric can move substantially in directions that barely move welfare. The additive malters near welfare optima, where no strictly peeffar-iimpoving deviations exist.
Definition 4.4 (Manipulability index of a design policy). For a design policy a and a reference class of profiles ref (e.g,, steady-state equilibria), the manipulability inder
M(T) = sup M(a;T). aEFI
When Stref consists of equilibria, M(T) measures how much the metric can be locally moved without com- mensurate welfare improvement around points actually induced by the policy.
Proposition 4.5 (Zero manipulability and local alignment). Suppose that for design policy and reference class gref we have M(T) = 0. Then for every E gref every client i, and every deviation of E Ai,
AM |0 + AW.(o) ()) > 0.
In particular, there are no metric-gaming deviations at any profile in gfe
Remark 4.6. Large values of M(T) do not by themsclves guarantee harmful gaming, but they quantify the capacity of the metric to move independently of welfare. In later sections we combine M(T) with audit and sanction rules to reason about when this capacity is actually exploited.
8

---

Published in Transactions on Machine Learning Research (03/2026)
4.3 Price of Gaming
Manipulability describes local capacity for gaming; we next quantify the realized welfare loss when gaming occurs under given policy. Inspired by the Price of Anarchy, we define the Price of Gaming as the welfare gap between an idcalized aligned behavior and a gaming equilibrium, normalized by the aligned welfare.
We distinguish two benchmark profiles:
welfare-aligned benchmark galign, representing the best outcome achievable under и when clients are constrained to actions Anlign C A: that exclude metric-gaming behaviors (e.g., truthful reporting and genuine effort).
A gamning equilibrium o representing an equilibrium of (TT) when clients may use the full action scts A;, including manipulative bohavior.
Definition 4.7 (Price Gaming). Let galign and gamme be as above, and suppose W ((aalign) > The Price of Gaming under design policy æ
PoG(T) (( (oRamme) ((ouligu)
By construction, PTG(TT) E [0, 1] when ((asame) 2 0. A value of PoG(()) = O indicates that gaming does not reduce welfare relative to the aligned benchmark, while PoG(T) 1 indicates that almost all of the potential welfare has been destroyed by gaming.
When multiple gaming equilibria exist, we define worst-case Price of Gaming
Poo (x)
sup
PoG(T),
d E
where Egame (T) is the set of gaming equilibria under n.
Proposition 4.8 (Manipulabilitty and Price of Gaming). Consider two design policies and T' on the same environment E, with comparable aligned benchmarks (oollign) z (o Under mild regularity conditions on best responses, reducing manipulability shrinks the worst-case. Price of Gaming:
M(T')
=
PoG (x') PoGmax(T)) (T)+A.
where A captures equltbrium-selcction effects and vanishes when gaming equilibria depend continuuusly on feasible metric-gaming directions.
We provide a detailed statement and proof in the supplementary material; the main takeaway that reducing M(T) shrinks the space along which equilibria can drift away from the aligned benchmark, constraining the welfare gap.
4.4 Price of Cooperation
Not all coordinated deviations are harmful: some forms of cooperation (e.g,, sharing calibration signals, pooling audits, or forming stable participation coalitions) can improve welfare even when they alter the metric. To distinguish such benign cooperation from harmful collusion, we introduce Price of Cooperation.
Consider a bascline profile g base (c.g., a non-cooperative equilibrium) and a coalition C' C that jointly deviates to a cooperative strategy profile TO, yielding
coop (TC, a-)--
Definition 4.9 (Price of Cooperation). Given (o hase, ronp) with W babban)) # O, the Price of Cooperation is
W (oop)) W base
PoC(o base
σ coop) =
W base
9

---

Published in Transactions on Machine Learning Research (03/2026)
We interpret PoC 0 benign cooperation that raises welfare and PoC 0 harmful cooperation collusion that reduces welfare. Aggregating over coalitions and equilibria, yields policy-level indices
Po (T) =
sup PoCla gooop), PoC (T) = inf PoC(o base o (oO)).
base C,
abuse C,re
Remark 4.10. The Price of Gaming captures the cost of metric targeting relative aligned behavior; the Price of Cooperation separates cooperative structures into two regimes: benign cooperation with PoC > that ought to be encouraged, and harmful cooperation with PoC < 0 that ought to be deterred. In Section we connect these regimes to participation dynamics and coalition stability.
4.5 Penalty design and critical thresholds
Design policies typically expose a control parameter that adjusts the strength of penaltics and sanctions. We denote such a parameter by 2 0 and consider family of policies x(a) that differ only in the severity frequency of sanctions, holding evaluation and aggregation fixed.
Stylized one-shot model. Let Σ, be the (possibly mixed) trrateyy/action space of client i, and let (-i, E I1: Eg denote strategy profile. Under policy T(a), client i obtains expected payoff
O)) = Vi(ona-i) - Di(o
where Vi is the umpenalized component and D; 0 is an expected detected rate (or penalty exposure).
Assumption 4.11 (Regularity and attainability in penalty scaling). For each and each faxed a (i) Vi(:a-i) and D=(:a-s) continuous on Ej; (ii) E, is compact, so U1(30-1,0) atlains marimizer for every 0.
covers schemnes where sanctions scale linearly in risk score violation measure, while the umpenalized part of the payoff is unaffected by
Assumption 4.11
Rationality notions. We make explicit two standard notions used later.
Definition 4.12 (Individual rationality (TR) relative to baseline). Fix a baseline profile E E (e.g., an aligned benchmark). A profile a individually rational (IR) relative to under ((a)
U((0aa-i;a) 2 ū for all i.
Definition 4.13 (Coalition-rationalityy relative baseline). Fix a bascline E. A profile o is coalition- rational relative to wnder =(a) if there exists a nonemply coalition C C [m] such that (i) a-c δ-c (only coalition members deviate), and (ii) for all i C, U.(an;--,,a) U,(ā (11,)) a), with strict inequality for least one i E C.
Where FL enters. In FL, the penalty exposure term D&(-) is induced by platform-side enforcement channels, such as audit triggers from Eval (e.g., challenge failures, inconsistency tests) and the audit selection rule in Audit. The baseline utility Vi(-) aggregates the policy-mediated benefits from participation (e.g.. credits or rewards computed from disclosed scores Zz,) minus compute/privare costs. Thus, the sanction parameter a is not an abstract knob: it corresponds to a concrcte cudit-sanction lever that scales platform- enforced consequences of delected deviations.
Why the assumptions are FL-realistic. Linear (or approximately linear) penalty scaling captures com- mon enforcement patterns: penalties proportional to a risk score, accumulated violations, or repeated audit flags, with a tuned by the operator. The separability requirement (harmful gaming having strictly higher de- tection exposure than an aligned alternative) corresponds to the practical goal of designing audits/ andit//challenges that "pure metric-targeting" leaves traces in private tests even when public metrics improve.
10

---

Published in Transactions on Machine Learning Research (03/2026)
Technical challenge. The substantive difficulty is not the affine comparison itself but establishing regime where D; meaningfully separates harmful gaming from aligned behavior under partial observability and noisy evaluation. In FL, both V; and D, depend on protocol details (aggregation, disclosure granularity, audit budget), so the proposition serves as a calibration statement: once enforcement signals distinguish behaviors, a finite sanction band exists, but its magnitude is policy- and protocol-dependent.
Harmful gaming vs. benign cooperation. Let (o) denote (tail) welfare and let M() denote the server-visible metric.
Definition 4.14 (Harmful gaming and benign cooperation (relative to a baseline)). Fix a baseline profile 0.
A unilateral deviation o; (with others fixed at σ-4) is harmfully gaming (relative ((, (()) and W(a, ō-; < (ō).
A coalition deviation a is benignly cooperative (relative to σ) if it is coalition-rational relative to o at a = and improves welfare, i.c., ((o) > (ō)).
Two critical thresholds. We focus (i) minimal sanction level Omin above which harmful gaming is no longer a best response against the baseline; and (ii) cooperation boundary @benigu above which even benign cooperation ceases to be coalition-rationall
Definition 4.15 (Critical thresholds (relative to a)). Fix baseline ã.
The minimal sanction level is
Omin = inf 2 0:
Vi, arg max ()) o.E
where Gz(o) is the set of harmfully gaming deviations by relative to (Definition 4.14
The benign cooperation boundary is
Obenign == sup {a 2 0: a that is benignly cooperative relative to and coalition-rational under r(a)).
Finite thresholds require separable penalty exposure. If a harmful deviation and aligned action ineur identical penalty exposure, then scaling cannot flip their payoff ordering. We therefore impose a mild separability condition.
(Penalty separability for harmful deviations). Fir baseline o. For every i and every harmful deviation g E Gō),), there exists some allernative action E E; (interpretable welfare-aligned) such that D.(g; - > D.(a;o-.).
Assumption 4.16
Proposition 4.17 (Existence and ordering of thresholds). Fix baseline o and suppose Assumptions 4.11 and 4.10 hold. Assume additionally that: (i) for each i, Ga(ā) is nonempty (harmful gaming deviations cxist); (i8) there exists at least one benignly cooperative profile at a = 0 (Definition 4.14
Then amin and Chenign are finite and satisfy
0 H Omin S O'beniga
Proof. We prove finiteness and ordering in turn.
Step 1: Ounn < xc. Fix and a harmful deviation g E G,(ō). By Assumption 4.16 choose a E E, such that d > D:). Consider the payoff difference
Aag.(()) = U,(1; a) - U,(a; (a;;0,,,)) = (Vi6g5ō Vila; -a (DD Di(a;ō
11

---

Published in Transactions on Machine Learning Research (03/2026)
This is affine and strictly decreasing in since the coefficient of a is positive. Hence, for all [(gg;-:) - Vi(a;
a 2 i.a = D.(riā-.) Ō=))
we have (a) S 0, i.e, 9 is not strictly better than Define
at
sup SEG,(O) a: (((g)>D((a)
inf dig.
Compactness and continuity (Assumption 4.11 ensure the relevant sup/inf are well-defined and finite in the stylized sctting | Then for any a of no harmful deviation g E G((ō) can be a strict maximizer of U,(;5-1,,)) Taking Omin max; aj yields Omin < and matches Definition 4.15
Step 2:
Obenign <0. Take any benignly cooperative profile relative to ã. By Definition 4.13 there
exists coalition C such that each E C weakly prefers or to o. at = 0. For each E C, define the (a (alfine) gain from participating in the coalition deviation:
G,(a) == -,00000000000)))0000000000000000 -V(0::--)-Vo;.0--)) (Di((or=-))
D.(o;:oi)). -Dioo::-----)
If for some i C we have Ō=(a;;--i)>> D,(ō;;-á)) and the unpenalized gain is finite, then Gi(a) becomes negative for sufficiently large Thus there exists finite upper bound o, such that for all a > 0a is not coalition-rational. Taking the supremum over all benignly cooperative gives finite Obenign-
Step 3: ordering Omin S Obenign- By construction, for any 2 Omin no harmful gaming deviation is individually optimal against σ. Moreover, benignly cooperative deviations are defined to be welfare- improving relative and (by assumption) exist at = 0. Since increasing a can only roduce incentives for actions with higher penalty exposure, there (possibly empty) interval of a for which benign cooperation remains coalition-rational while harmful gaming is deterred. Therefore the largest supporting benign cooperation cannot lie below the minimal that eliminates harmful gaming best responses, i.e., Omin Obenign
Remark 4.18. In practice, (amin Obenign) provide calibration band for sanction strength relative to chosen bascling ō. Choosing a < ammi risks leaving harmful gaming individually profitable, while choosing a Ohenign risks deterring productive cooperation. Exact computation may be infeasible in complex FI, systems, but our indices and experiments in Section 7 show that these thresholds can be approximated or bounded using observable quantitics such as detected incident rates and participation responses.
Taken together, the manipulability index M(T) and the prices PoG and PoC provide compact language for describing how a design policy shapes the space of metric-largeting behaviors and their welfare consequences. In the next section, we move from this static metric layer to the dynamic layer, where we analyze how these quantitics interact with participation, exit, coalition formation, and tipping points over time.
4.6 Practical estimation of M, PoG, and PoC
The indices introduced this section are defined in terms of deviations, equilibria, and suprema over strategy sets. In deployed foderated systems, we do not expect to compute these objects exactly. Instead, we view ((),, PoG( and PoC(7) as latent properties of design policy æ that can be approzimated or bounded using combination of controlled experiments and retrospective log analysis. We briefly outline practical routes.
Scenario-based estimation in sandboxes. direct approach is to instantiate explicit aligned, gaming, and cooperative behaviors and measure their effects on metrics and welfare. Concretely, one may:
When a simulator or internal testbed is available, the most
In the simplest presentation, one may assume E, finite, which finiteness immediate and the sup/inf /mnina/
12

---

Published in Transactions on Machine Learning Research (03/2026)
1. Fix an environment E and bascline design policy n, and implement simple aligned local policy (e.g., honest empirical risk minimization on the welfare distribution) together with a family of syn- thetic gaming policies that target the public metric while ignoring some welfare-relevant components.
For cach client and candidate deviation df, run the system to (approximate) steady state and record the realized changes
AM | (o),
AW ())
relative to the aligned profile a. The local manipulability M(; can then be approximated by the largest observed ratio
M(an)) Re max i, AW.(o) o)4 +e²
where is small numerical constant.
3. To estimate the Price of Gaming, instantiate an aligned configuration (all clients follow the aligned policy) and a mired configuration with fixed fraction of gaming clients, and compare the resulting steady-state welfare:
PoG((T) Ro
W Waligned (T) W mixed (T),
normalized if desired by W Waligned (T).
4. Similarly, to probe the Price of Cooperation, introduce explicit coalitions C' that share updates, pool data, or coordinate abstentions. Comparing welfare before and after enabling such cooperation yields empirical counterparts of PoC(Obase + &coop), which can be aggregated into benign and harmful
regimes as in Definition 4.9
Our stylized simulation and Fashion-MNIST experiments in Section 7 follow this template: we fix simple aligned and gaming behaviors, vary design levers such penalty strength and public-metric weight, and report steady-state averages of (W, x)) together with an empirical Price of Gaming obtained by comparing aligned and mixed-type configurations.
Retrospective and log-based cstimation. When red-tcaming or explicit simulators are not available, existing logs still provide partial information about the indices. Two siluations are particularly informative:
Incidents and suspected gaming episodes. If past investigations have identified periods in which certain clients cohorts engaged in metric gaming (e.g., by overfitting to public leaderboard, under-reporting adverse events, selectively participating), one can compare observed metric and welfare trajectories during these episodes against nearby aligned periods. The largest observed metric gains with negligible or negative welfare changes provide a lower bound on M(T,, while the associated drop in welfare relative to a counterfactual aligned run yiclds a lower bound on PoG(TT).
Policy and environment shifts. Changes the evaluation, disclosure, or sanctioning rules (for instance, increasing audit intensity or reducing public-metric weight) create natural experiments. By tracking how head metries, tail welfare, and participation respond before and after such shifts, operators can approximate how far the system moves along the gaming and cooperation directions defined in Section A For example, if stricter audit regime is followed by modest reduction in the public metric but a substantial improvement in welfare and participation stability, this suggests that the previous policy was operating in a high-PoG, high-manipulabiltyy regime.
In both cases, the goal is not to pin down precise point estimates but to obtain diagnostic bands: rough lower bounds on ((T) and PoG(T), and qualitative evidence on whether observed cooperative structures are benign (PoC > 0) or harmful (PoC < 0). These diagnostics are sufficient to calibrate the penalty thresholds (Aminn Obeniga) in Remark 4.18 and inform the andit-allocation and governance patterns developed in
Sections 6.3 6.4
13

---

Published in Transactions on Machine Learning Research (03/2026)
5 Dynamics Layer: Participation, Thresholds, and Tipping Points
The metric layer in Section f describes how a fixed design policy л shapes gaming and cooperation directions and their welfare impact. The dynamics layer focuses on how these incentives interact with participation over time: when participation is stable, when small shocks trigger domino exils, and how cooperation or collusion moves the system between regimes.
Throughout, fix environment & and design policy n, and consider aggregate participation dynamics induced by myopic or boundedly rational best responses.
In doing so, we deliberately work with a stylized mean-field model. We assume that the incremental utility (U r) of participating versus abstaining is homogeneous across clients with the same observable state æ, and that participation thresholds {0:} are ii.d draws from an underlying distribution Fe. This setup is not mcant to capture the full heterogencity and bounded rationality of real federated participants; rather, it serves as minimal scaffold for identifying qualitative phenomena such tipping points, resilience, and domino exits. In deployed systems, operators will not know AU x) Fe exactly, but they can still use the same formalism as diagnostic lens: the observable aggregate participation curve (2z)220 and its responses to policy changes (e.g., stronger penalties, different disclosure rules) act as proxies for the slope and fixed points of F(x; T) and for the resilience indicator R(x)) introduced below.
5.1 Best responses and local participation stability
We use simplified, mean-field representation of participation. At the end of round i, the platform observes the aggregate participation rate zz. Given (Ze, π), each client then decides whether to participate in the next round (Pi,++1 1) or abstain (Pi,411 = 0), in addition to choosing an in-round action (c.g., training effort, naming/cooperationn intensity) when participating. To isolate participation, we model non-partieipatioo yielding fixed outside option, while participation yields expected net gain that depends the current environment summarized by Ie and the fixed policy n.
One-step net gain from participation. Let xa E [0, 1] denote the aggregate participation rate in round (defined below). Under a fixed policy n, define the one-step net gain for client from participating round t+1 (given the observed state xx)) as
AU (2g)) = E[U.(1, aj (2); Ie, r) U.(0) Ft, m)
(5.1)
where -),,,.) is the (one-step) payofl from participating with an in-round action, U.(0) is the payofl from abstaining, and
(xa E arg max B[U,(1, m1,
aEA:
is the client's myopic best response conditional on participating. The expectation in equation 5.1 is taken over evaluation randomness, audits, and other clients' stochastic actions, conditional on (Iz,
Population heterogeneity via participation thresholds. We model heterogeneity in participation costs/preeerencos through an idiosyncratic threshold (type) 0,,
Assumption 5.1 (Threshold-basce) participation with i.i.d. types). Each client i has type 02 E IR drawn i..dd from a continuous distribution with CDF Fe. Given the observed aggregale parlicipation ie al the end of round t, client participates in round t+1 if and only if
Pr,+1 =1
- (U((41(6G7) 2 6,.
(5.2)
Assumption 5.1 is a feluced-form model noisy threshold rules: clients participate when the expected net gain exceeds an idiosyneratic cutoff capturing private costs, device constraints, privacy preferences, and opportunity costs.
Definition 5.2 (Aggregate participation rate).
The aggregate participation rale in round L is
1
Σ
H(ps 1} E [0.
24 =
n
1E
14

---

Published in Transactions on Machine Learning Research (03/2026)
A deterministic mean-field closure. To obtain one-dimensional participation dynamics, we impose standard symmetry / /mean-field closure: conditional on (2,, the net gain equation 5.1 is the same across clients and depends on 2t only through a deterministic function.
Assumption 5.3 (Representative net gain). For a given policy T, there exists deterministic function AU(:T): : [0, 1] + R such that
(Us = (U; for all and b.
Proposition 5.4 (Aggregate participation map). Under Assumptions 5.1 and 5.5
the expected aggregate
participation evolves according to the one-dimensional map
Et+1 F(F = Pr[ AU(x)))]] (
(5.3)
Proof. By Assumption 5.1 and the representative net-gain closure (Assumption 5.3
Pr(pac+1 = Iz. T) Pr(0, s AU(x)))) Fe (AU((A
Taking expectation over i.i.d. types and averaging across clients yields
T++1
E
1pp4+11 = Ne = Pr(pr,41 Fe; = (o(AU();))
71
which is exactly equation 5.3
Where FL enters. The dependence of (2; on the aggregate participation level x is induced by FL feedback loops: the quality of the aggregated model (and thus the expected benefit from participating) depends on how many and which clients contribute updates, while evaluation and reward signals depend on Eval and Info applied to aggregated outcomes. Audit selection and sanction risk can also vary with a through workload constraints and risk-based auditing. Hence, F(I; = Fe (a(AU(a;;) ()) is a reduced-form representation of the FL platform's particiaatio--aggeeetionn
coupling.
Why the assumptions are Fl-realistic. Threshold heterogeneity models widely observed client-side constraints in federated deployments: device availability, energy budgets, privacy preferences, and oppor- tunity costs. The representative net-gain closure approximates cross-silo large-population settings where clients face similar platform rules and the dominant variation is captured by idiosyneratic thresholds, while the aggregate state summarizes system load and expected model utility.
Technical challenge. The mapping itself is elementary; the nontrivial aspect is that AU' T) is an equi- librium object: it depends on best-response behavior conditional on participation and on policy-mediated signals. Making explicit the threshold structure and the mean-field closure isolates the minimal FT. ingredi- ents needed for a one-dimensional dynamics that can exhibit multiple fixed points and tipping phenomena studied in the next subsection.
Remark 5.5 (Interpreting the participation map from data). In deployed federated systems, the map F(x; x) and threshold distribution Fe are not directly observable. However, the same structure can be probed indirectly using the aggregate participation trajectory (z1)22- When design policy æ is held fixed over a sufficiently long period, the empirical update
(()a)) 2 Je+1
provides noisy evaluations of F at the observed states z,. Policy shifts, such as increasing sanction strength or changing disclosure rules, create perturbations that reveal how the curve 2e4 = F(x;;) moves. In practice, operators can therefore treat as a latent response surface summarized by: (i) the location of approximate fixed points x* to which (x:) tends to return, and (ii) the steepness of the empirical relationship between x, and r++1 around those points. These observables act as surrogates for the theoretical slope F' (=*:T) and resilience diagnostics in Section 7 without requiring explicit estimation of individual thresholds.
15

---

Published in Transactions on Machine Learning Research (03/2026)
Fixed points and local stability. A participation level x [0, 1] is fized point if
x² =((;;)))
When F is differentiable at xx, it is locally stable if | (ar";);)) < and locally unstable if [F'("*;; > 1.
Multiple fixed points may exist, corresponding to high-participation, low-participation, and intermediate unstable regimes. The unstable fixed points act as tipping points separating basins of attraction, as formalized in Section
5.2 Participation dynamics, tipping points, and domino exit
Participation state and update map. Let 24 E [0, 1] denote the fraction (or probability mass) of clients that participate at round under a design policy æ. We model participation as a deterministic mean-field update
I++1 F(zgT))
(5.4)
where F(;x)) [0 + [0, is the participation map induced by (i) client payoffs under and (ii) the population heterogeneity.
A canonical FL interpretation. A standard reduced-form instantiation is a threshold (quantal) partic- ipation rule: each client has a type (capturing private costs, device constraints, privacy preferences, etc.) distributed as Fe. Given current participation level and policy n, the net gain from participating is
(U,,
AB(r;)
C(O: π
benefit from FL outcome/credit
post/privacyy// /effort
and the type participates iff AU(O, 2; 2 0. Then
F(r;)) x) P=(AU(O, 2;) 2 20.
(5.5)
This form makes explicit how FL enters: AB(x;) depends on the quality/ /utility of the aggregated model and on the policy's
aattiion//ddt//saaaa rules, all of which respond to the participating population.
Fixed points and local stability. A fixed point x* satisfies F(x"; m) x². When F is differentiable 2", the standard 1D stability criterion applies: x* is locally stable if [=*::))) < 1 and locally unstable if
[((a::)) >> 1.
Definition 5.6 (Tipping point). A fixed point x E (0, 1) of F(:T) is tipping point if it is locally unstable and separates two locally stable fixed points x < xt < x such that, for all initial conditions za in a sulficiently small neighborhood around xt,
To < xt F
To
2t xt.
Definition 5.7 (Domino exit). Given a tipping point af and stable fixed points (x=,xt) with x- < x+, a trajectory {æ.} exhibits a domino exit if there exists time 7 such that
F--1 xt,
Ir < at, and It + x as + 0o.
A contraction condition for resilience. rules out tipping points and domino exits.
The following result provides a clean sufficient condition that
Definition 5.8 (Contraction on [0, 1]). A map F(;T): [0, 1] + [0, contraction (in the absolute-value metric) if there exists a constant L E j0, 1) such that.
F(z=)) F(): < L|x- vl for all x, [0.
The smallest such L is the (global) Lipschitz constant of F(::)) [0, 1].
16

---

Published in Transactions on Machine Learning Research (03/2026)
Proposition 5.9 (Sufficient condition for resilience (contraction regime)). Assume F(; :0, - [0,
a contraction with conslant I. E (0, (Definilion 5.8 Then:
there erists a unique fixed point rhigh E (0, 1] such that Fl TT) = hhighh
2. for any initial condition zo [0, 1], the iterates of equation 5.4 satisfy 2t high 0o;
3. in particular, there are no tipping points (Definition 5.0 and no domino erits (Definition 5.7)
Proof. Consider the complete metric space ((0, 1),d) d) with d(x, v) |r - y/. By Definition 5.8 F(:: is a contraction mapping on this space with constant L 1. By the Banach fixed-point theorem, F admits unique fixed point high [0, 1] and, moreover, for any æo E [0, 1], the sequence defined by 2 (() converges to highh Since there is only one fixed point, there cannot exist an unstable fixed point separating two stable fixed points; hence no tipping points exist, and consequently domino exits are impossible.
Where FL enters. In FL, the participation map F(;T) is not arbitrary: it induced by how aggrega- tion quality, disclosed feedback, and enforcement risk change with the participating population. The slope (or Lipschitz modulus) of F captures how strongly one round's participation shocks propagate through the learning-and-evaluae pipeline into the next round's participation incentives. Thus the contraction con- dition an interpretable design target: policies that dampen the sensitivity rewards and sanctions to short-run participation fluctuations make the system resilient to cascade effects.
Why the assumptions are FL-realistic. Global contraction is a sufficient (not necessary) regime and can be approximated in practice by design choices that smooth incentives: shaping that discounts short-term metric spikes, and audit policies that avoid strongly state-dependent punishment near the margin. These standard operational controls in federated platforms when stability and retention are priorities.
disclosure, reward
Technical challenge. While Banach fixed-point arguments are standard, the FL-specific difficulty lies in reasoning about (or empirically bounding) the slope of the induced map F under partial observability and strategic responses. Our contribution is to translate qualitative platform choices (disclosure, reward curvature, audit sensitivity) into a dynamical stability lens via F and its slope proxy, enabling diagnostics even when F only observed through noisy participation trajectories.
A differentiable sufficient. condition. A convenient checkable condition is via derivatives. Corollary 5.10 (Derivative-based contraction criterion). If F(5t)) is continuously differentiable on [0. 1]
and
sup F( 11
zE(0.1]
then F(G:)) is a contraction (Defmiition 5.8 and Proposition 5.9 applies.
Proof. By the mean value theorem, for any 2,y E [0.1] there exists e between & and such that [F(x;)) F(y: m) = (c; |z - yl < (suuueeona) [F [F; ((u;))]] I)) x - y). Taking L = sup (u: 1 proves contraction.
Resilience indicator. To quantify proximity to the contraction regime, define the (global) Lipschitz modulus
L(T)) = inf L E [0, oc): [F(2; TT) Fly +) S L yl Va, y E (0, 11). When F is differentiable, L(T) < sup, [F;))) (and equality holds under mild regularity).
Definition 5.11 (Resilience indicator). The resilience indicator is
R(T) = 1- I(xx)
17

---

Published in Transactions on Machine Learning Research (03/2026)
Large positive values of R(x) indicate strong contraction and high resilience. Values near zero indicate proximity to a bifurcation where small design changes may create or remove tipping points. Negative values (i.e., L(T) > 1) indicate that the system is outside the contraction regime and may admit locally unstable behavior.
Remark 5.12 (Link to the metric layer). Under the threshold form equation 5.5 the slope (a; T) (or more generally [(=)) is governed by how sensitively the net participation gain A ( IT) responds to Policies with high manipulability
large Price of Gaming lend to amplify the dependence of payoff's on the participating population (e.g., via greater exposure to others' gaming or heavier reliance on public metric), which can increase L(x) and reduce R(T).
5.3 Cooperation, collusion, and coalition effects
Participants may form coalitions that share information, coordinate strategies, or collude. We model this at a coarse level via a coalition-inee ientiioo-indued participation map.
Consider coalition C I that coordinates acts and participation while treating the rest of the population mcan-field environment. Let Ia denote aggregate participation and IC, the coalition's participation rate.
Definition 5.13 (Coalition-indueed participation map). Given a coalition C and coalition strategy de, the conlition-induced participation map is
11+1 = (e( oc) == xc.41 (oc, (;; n n- Ol F-o(aa;),
[C| n
n
is the coalition's next-round participation rate and F-o is the participation map of where T0,441(00, J4 r)) non-members.
Coalitions can either stabilize participation (e.g., through mutual guarantees or shared information that reduces perceived gaming incentives) undermine it (e.g., via coordinated exits or collusive gaming). The Price of Cooperation from Section 4.4 lets us classify these effects.
Definition 5.14 (Benign vs harmful coalition effects). Let hase be a bascline profile with participation trajectory (abase), ), and let soop be the profile induced by coalition strategy oc, yielding trajectory {x, soop) Then:
The coalition has benign participation effect if PoC - 0oo0p) > 0 and R(T) weakly increases under coop.
The coalition has harmful participation effect if PoC(g + rooo)) < 0 and R(T) strictly de- creases, if it creates new tipping points that did not exist under o busee
5.4 Early warning signals and auto-switch rules
Given participation map and possible coalition effects, designer needs tools for detecting when the system approaches tipping point and for intervening automatically. We describe two such tools: early warning signals and anto-switch rules.
Early warning signals.
We consider observable summary statistics over sliding window L-L++, (t-,+
Recent participation trend
Ar = (I+-1--- zz-k),
k=1
which captures average first. differences in participation.
18

---

Published in Transactions on Machine Learning Research (03/2026)
Short-term volatility
1
T++1-A - Zx) x,)² 2, == L
1
Var, =
11+1-K
k=1
k=1
which reflects fluctuations that may signal unstable dynamics.
Connectiviiy--basee alarm it, which aggregates the structure of recent gaming incidents and audits (e.g., via a graph whose nodes are clients and whose edges represent correlated anomalies, with T₃ measuring the size of the largest connected component).
Definition 5.15 (Early warning regime). Given thresholds 7/a < 0, 1/ar > 0, and yr > 0, the system is in an early warning regime at time t if
AZ, S NA.
Var,
Wazz
r m/.
Negative trends, high volatility, and rising connectivity in gaming incidents jointly indicate that the system may be approaching an unstable region or tipping point.
Auto-switch rules. When carly warning conditions are met, the designer may switch from the current design policy to more conservative policy *', for example by strenghhening audits, reducing metric disclosure, switching to more robust evaluation schemes.
Definition 5.16 (Auto-switch rule). An aulo-swilch rule is specified by:
pair of design policies noroma safe);
an early warning predicate Warn, defined in terms of observable statistics;
hysteresis mechanism that prevents rapid oscillation between policies.
The induced policy at time
safe
if Warn, = true,
normal
otherwise, subject hysteresis.
n
Under suitable conditions, auto-switch rules can keep the system within the attraction basin of high- participation equilibrium.
Proposition 5.17 (Auto-switch and basin preservation). Suppose there exist design policies normal and n safe such that:
Under N normal F(:; normal) admils high-poorlicipation stable fired point high and lipping point x!, with nhgghh > x!.
2. Under sale, 7aae)) is a contraction with unique fixed point sale 2 x².
3. The auto-switch rule triggers mate whenever It S xl +e for some small > 0, and reverts to x normal only when 2, 2 high c.
Then any Irajectory starting with 3o x + remains in [xr 1] for all and converges to participation level in [xl, J.ghh. In particular, domino erits to low-participation equilibria below x² avoided.
Proof. Consider any trajectory with x1 + If S xt + the auto-switch rule activates stafe hence Z++1 = #sfffe Under saate F(::75afe)) is contraction with unique fixed point =aae 2 xt, so iterates converge to saaee and in particular cannot cross below æf once the safe mode is active. If instead x > at +e, the system either remains in the current mode or follows x nnormal, in all cases the state stays within the participation domain and, by the hysteresis rule, switching back to normal can occur only after recovery 2, 2 high e, preventing rapid oscillations. Therefore the trajectory remains in [xt, 1] for all and avoids low-participation equilibria below æt. A detailed proof is given in Appendix A.2
19

---

Published in Transactions on Machine Learning Research (03/2026)
The dynamics layer connects the static indices of the metric layer to operational design: manipulability, Prices of Gaming and Cooperation, and sanction thresholds translate into participation stability, tipping points, coalition effects, and the need for early warning signals and auto-switch rules. In the next section, we use these insights to design concrete evaluation, audit, and incentive toolkits for real federated learning systems.
6 Design Toolkit Layer: Evaluation, Audits, and Incentives
The metric and dynamics layers describe what go wrong right in federated learning under fixed design policy how much room the policy leaves for metric gaming, how costly gaming and cooperation are for welfare, and when participation is stable or prone to domino exits. The design toolkit layer treats
π = (Eval, Info, Reward, Audit)
as set of configurable design components that can be tuned steer our indices favorable directions.
Rather than prescribing single optimal policy, we provide (i) a decomposed view of design parameters and their qualitative effect M(T), PoG(T), PoC(T), and R(x); (ii) patterns for mixing public and private evaluation; (iii) an audit-budget allocation algorithm with approximation guarantoes; and (iv) governance checklist for federated deployments.
6.1 Design levers and their impact on indices
Design levers. We parameterize a design policy π by (possibly higl-dimensional) vector
A = (Aeval iinoo rreaard xandit Aprivacy,... ....)
whose coordinates control evaluation, information disclosure, incentives, audits, and privacy.
Definition 6.1 (Design lever). A design lever is any coordinate (or low-dinensional block) of X that can be adjusted by the system designer while holding the environment (clients, data, and protocol) fixed. We write T (A)) for the policy obtained by setting the lever vector to A.
Typical examples include:
Evaluation levers Xeval, choice of metrics (global vs group vs client-level), holdout composition, evaluation frequency, randomized challenges.
Information levers Xinoo ceamulaity/timiing of disclosure (full scores vs bands vs delays), which components remain private.
Reward levers Areward reward curve shape (linear thresholded tournament). short-term long-term weighting, coupling to participation commitments.
Audit levers audit, audit budget and allocation, selection rules (random vs risk-based), sanction modality and severity.
Privacy levers Xprivacy noise/secure aggregation strength and whether protections apply symmet- rically to reward vs audit signals.
Reference classes for strategic deviations. Several indices in the metric layer (e.g., manipulability) depend on which deviations are considered leasible or relevant in a given deployment.
Definition 6.2 (Reference class). A reference class yref is a specified subset of strategy profiles (or devia- tions) deemed feasible in the deployment under study. Formally, E C Σ, where Σ the ambient strategy space introduced in Section
3 When index involves supremum over deviations, interpret it restricted to re and write, c.g., Fref)
Intuitively, Ife plays the role of threat model: it can encode constraints such as bounded gaming intensity, admissible coalition sizes, limitations from privacy mechanisms, or the action space induced by a specific FL protocol.
20

---

Published in Transactions on Machine Learning Research (03/2026)
Indices as functions of levers. where relevant, a reference class):
The indices introduced carlier can be viewed as functions of levers (and,
M(A; E")), (A) PoC (A), PoCharm (A), R(A).
In realistic systems these functions are not analytically tractable, but qualitative monotonicities often hold. For example:
Reducing the gramularity Seamulartyy/requeeeyy of public disclosure, or mixing it with private evaluation, tends to reduce M(}; E'ef) by shrinking the set of deviations that can reliably improve reported metrics without improving welfare.
Increasing sanction strength above amin tends to docrease (AG at the risk of suppressing benign cooperation if' a exceeds Obenign-
Strengthening privacy can reduce audit signal resolution, which may increase M and PoG unless compensated by alternative verification.
Reward curves that heavily weight short-term public metrics can amplify participation sensitivity and reduce R(A); smoothing or discounting these effects can stabilize participation.
We now make these relationships concrete via three classes tools: mixed challenges and information disclosure, audit-budget allocation, and a governance checklist.
6.2 Mixed challenges and information disclosure
We formalize evaluation designs that combine public and private signals to reduce manipulability while prescrving incentives for genuine improvement.
Mixed challenge structure. At each round i, the evaluation mechanism can generate multiple types of tosts:
Public benchmark tests (PB): performance widely known datasets/bencchmarks, whose aggregate statistics are disclosed to all clients.
Private challenge tests (PC): tests drawn from hidden or randomized distributions, whose outcomes revealed only to the server (and optionally privately to the tested client).
Connectivity tests (CT): challenges involving pairs/groups of clients, designed to detect correlated anomalies (e.g., collusion patterns).
Let M,th and M denote the public and private components of the metric vector Me, and let Ppub [0, 1] be the fraction of total evaluation weight placed on public benchmarks. We write
M, Ppub MPub + (1 (1- Ppub) Mptiy
where Mfriv may itsclf include PC and CT components. The information mechanism Info, then discloses all or part of Mpd and selectively discloses Mpriv_
Definition 6.3 (Mixed challenge policy). A mixed challenge policy is specified by: (i) weighting parameter Ppub E [0, 1]; (ii) sampling rules for PB/PC/CT, and (iii) a disclosure rule determining which components are revealed to whom and when.
Proposition 6.4 (Effect of mixed challenges on manipulability). Consider two design policies and n' that differ only in the chaled-c weight, with Pras < Ppub (all other levers fized). Assume:
(Reward dependence) The reward depends on the reported metric only through a monotone func- lion of the scalar aggregate r(Mi).
21

---

Published in Transactions on Machine Learning Research (03/2026)
2. (Non-gameabilin of private component) For any deviation within E changes in Me de- pend on client actions only through their effect on welfare (equiualently, there is no direct metric- targeting control over MP holding welfare fixed).
Then, for any reference class Dtet
M(T S M(T;;
Moreover, the reduction is weakly increasing in the shift of weight (Pyuh - Ppub) from public to private components.
Where FL enters. The design variables this section correspond to concrete platform controls: evalua- tion composition (public vs private challenges), disclosure rules, reward mapping from disclosed signals, and audit allocation under a budget. The role of the reference class y is FL-specific: it encodes the deployment threat model induced by the protocol and governance constraints (c.g., admissible reporting manipulations under secure aggregation/DD bounded gaming intensity, bounded coalition size, and feasible coordination given limited observability).
Why the assumptions are FL-realistic. Federated platforms routinely combine public benchmarks with hidden or randomized challenges, and disclose leedback asymmetrically (server-only vs per-client vs public). Likewise, threat models are unavoidable in practice: what clients can manipulate depends on the training stack, privacy mechanism, and logging/aute interfaces. Making Eref explicit separates what is property of the platform from what is an assumption about attacker capabilities.
Technical challenge. The key difficulty is not establishing a qualitative monotonicity under a lever change, but ensuring that the private components used for governance are non-largelable except through genuine welfare improvements, despite strategic adaptation and information leakage. The reference-class formaliza- tion makes the scope of the guarantoe precise: it states what manipulability roductions (or approximation bounds) hold under the deployment's feasible deviation set, rather than claiming unconditional robustness.
Proof. Fix a baseline behavior and consider any feasible deviation in gre Under assumption (2), deviation that does not improve welfare cannot increase MP except through welfare. Therefore the only directly targetable component of the reported metric MPub, Since M, a convex combination of Mf and M decreasing Ppub weakly reduces the maximal achievable change in M, (and hence in r(M)) by monotonicity of r) obtainable via purely public metric-targeting deviations at fixed welfare. Because M(+; gref is defined as supremum over such fcasible deviations, its value cannot increase when Ppub decreasos.
In practice, mixed challenge policies provide a tunable handle: designers can increase the weight on pri- vate, welfare-aligned evaluation components until estimated M(T; grd) and PoG(T) fall below acceptable thresholds, while monitoring participation and cooperation through R(TT) and PoC(TT).
Information disclosure patterns. Beyond the composition of Mj, the granularity and timing of disclo- sure strongly affect gaming incentives:
Full disclosure: detailed per-client per-group metrics cach round.
disclose score bands or ranks rather than exact values.
Delayed disclosure: release statistics after multiple rounds.
Asymmetric disclosure: private per-client feedback while restricting cross-client comparisons.
6.3 Audit budget allocation with approximation guarantees
We next consider the allocation of limited audit resources, modeled as budget-constrainet set selection problem. Given a finite audit budget, the designer must choose which clients or events to audit in order maximally reduce gaming and harmful cooperation.
22

---

Published in Transactions on Machine Learning Research (03/2026)
Audit allocation as submodular maximization. Let I be the set of clients. An audit policy chooses subset S S I to audit in a given period, subject to |S] s B. For each candidate audit set S, define the audit utility
S(S) = expected reduction in Price of Gaming violation risk induced by auditing S.
This utility can be instantiated in multiple ways, for example as:
expected decrease in a surrogale risk score for gaming incidents;
approximate reduction in (z under a local model of deterrence and adaptation;
a weighted sum of predicted deterrence effects across clients.
In many natural monitoring and deterrence models, / exhibits diminishing relurns: auditing additional clients remains beneficial, but its marginal benefit decreases as more audits are already performed.
Assumption 6.5 (Submodularity of audit utility). The audit ulilily f: 2 - R20 normalized (f(0) = 0), monotone (if TT then f(S) S f(T)), and submodular: for all S CT _ and TT
((S - S(S) 2 ((TU(i)-
Under Assumption 6.5 the audit allocation problem
max ((S) SCI
subject to |S| S
is the classical problem of maximizzngg a monotone submodular set function under a cardinality const
Theorem 6.6 (Greedy audit allocation). Under Assumption 6.5 the greedy algorithm that iteratively adds the client with the largest marginal gain,
i E arg max (1)) f(S.)) S = St (tt). SEIYS,
until |S,] B, achicves a (1 - 1-))///apprzziiaalinn
[(Sgrenth) 2 (1-1/e)
where S* is an optimal audit set with | < B.
Proof. The approximation guarantee is the classical result for monotone submodular maximization under cardinality constraint; see, e.g., Nemhauser et al. (1978). For completeness, let S, denote the greedy set after t additions and let A(i S) =
By submodularity and monotonicity, for any optimal set S* with |S*| < B we have
S(S*) - ((8)))(($))+ s Σ S.
S...BBB.. B. max A(i S.) = B (I(S41)) - -(S.))
VETAS.
iES
so (S(*)) ((S.)). Letting = f(S*) f(S.), this yields ge+1 S (1 119,, hence
gB S (1
1 B
9o S E
9o-
B
Therefore,
f(SB) = f(S*) gB 2 f(SS) e -o- Since go =(S*) f(S)) and typically So Ø (so f(So) 2 0 by monotonicity), we obtain
f(SB) 2 (1- )
claimed. A slightly more detailed derivation is provided in Appendix
A.3
23

---

Published in Transactions on Machine Learning Research (03/2026)
Linking f(S) to indices. instance, we may define
Although f(S) is defined abstractly, it can be grounded using our indices. For
f(S) ~ A S) := PoG(T) PPG((Ts)
where is is the policy that applies targeted audits to S, or
f(S)
Σ w. AS)), iEZ
where (S,(S) is the predicted reduction in client i's probability of metric gaming when S is audited, and wy are importance weights. Under standard peteerrenne/ooverrae models, these instantiations naturally exhibit monotonicity and diminishing returns: adding audits does not reduce the expected reduction in gaming risk, while the marginal risk reduction typically shrinks after the highest-risk clients are already covered.
6.4 Governance checklist and policy patterns
We conclude by summarizing the design toolkit. into a governance checklist and outlining policy palterns for common federated environments.
Checklist for configuring a design policy. Given intended deployment, designer proceed follows:
1. Clarify welfare and metrics: specify the primary welfare functional W (e.g,, target risk, fair- ness constraints, stability criteria) and the metrics M used for rewards, monitoring, and external reporting. Identify where M only a proxy for W.
Assess manipulability: qualitatively or empirically estimate M(T) under a baseline policy by probing how much metrics can be improved without clear welfare gains (c.g., red-tcaming or controlled simulations).
3. Estimate Prices of Gaming and Cooperation: construct aligned and gaming benchmarks approximate PoG(2), and identify cooperative schemes to estimate PoCbenign (T) and PoCharm (T).
4. Calibrate penalties and sanctions: choose penalty scaling parameter and estimate (Amin, Obenign), aiming to place in band where harmful gaming is deterred but benign coop- eration is preserved.
5. Configure mixed challenges and disclosure: select Ppub and design PB/PC/CT tests that private, welfare-aligned components carry sufficient weight to reduce M(T), while public feedback remains informative for learning.
6. Design audit allocation:
specify an audit utility S(S) tied to reductions in PoG(T)) or violation risk, and implement a greedy or improved submodular allocation algorithm under the available budget.
Monitor participation dynamics: track participation rates, volatility, and come alarms estimate R(T) and detect proximity to tipping points.
Implement auto-switch rules: define early warning predicates and hysteresis- based switches between normal and safe policies, as in Proposition 5.17 to prevent domino exits.
Policy patterns for common environments. Different deployment contexts lead to different priorities among these steps. We briefly outline three stylized patterns.
Low-trust, high-prioacy consortia: Privacy and legal constraints severely limit direct audits and gramular disclosure. Design should emphasize strong mixed challenges with small Ppub, conservative reward curves that downwcight short-term metrics, and heavy reliance on private challenges and comnectivity-based alarms. Audit allocation may focus on aggregate or randomized audits, with post proofs of compliance supplementing limited direct inspection.
24

---

Published in Transactions on Machine Learning Research (03/2026)
High-stakes, regulated services: External regulators require auditability and clear sanction mech- anisms. Here, designers can afford more intrusive audits and detailed documentation, pushing a safely above amin while monitoring Obenign- Mixed challenges help detect subtle gaming, and auto- switch rules can be tied to regulatory thresholds (c.g., mandatory safe modes when participation or performance cross certain bounds).
Commumity- driveeen participalory systems: Participation is voluntary and sensitive to perceived fair- ness. The main objective is to foster benign cooperation and stable participation. Reward curves can explicitly favor long-term consistency and collaborative behaviors, penalties should be calibrated be- low Obenign to avoid chilling effects, and information disclosure should emphasize transparency about evaluation and audits without enabling targeted gaming. Governance checklists can be co-designed with participants to increase legitimacy.
Across these patterns, our framework provides common language for reasoning about trade-offs: changes in evaluation, disclosure, and audits can be interpreted through their effects on manipulability, Prices of Gaming and Cooperation, resilience, and thresholds. In the next section, we instantiate these design choices in stylized simulators to illustrate how the indices and dynamics behave under different, policies and to validate the qualitative patterns predicted by our theory.
7 Simulation Studies
7.1 Summary of Stylized Simulation Results
We first examine how the proposed indices behave in a stylized but internally consistent environment. Table [ compares fully aligned scenario (no gaming participants) with mixed scenario where 30% of clients follow gaming strategy, reporting steady-state averages over post bust-burniin rounds. In the aligned case, welfare, metric, and participation all concentrate near W & M R I R 0.95, indicating that almost all clients cooperate and that the metric tracks welfare closely. When gaming types are introduced, welfare drops to W s 0.33 while the metric remains inflated at M R 0.36 and participation stays relatively high at T 0.64. The resulting metric welfare gap of M W ss 0.03 corresponds to a Price of Gaming of PoG 0.66, meaning that roughly two thirds of the welfare achievable under full cooperation is lost even though surface-level indicators (metric and participation) still look healthy. In terms of our framework, this configuration is high-manipulabiliy, regime in which self-interested best responses sustain low-welfare, high-metric equilibrium.
Table 2 then visualizes the effect of sanction strength Opennalty while keeping other design choices fixed. Over Openalty E [0.3, 1.5). the curves for Zgame remain remarkably flat around 0.63-0.64, suggosting that benign cooperation is not significantly discouraged in this range. By contrast, the W game curve drifts upward from es 0.32 to as 0.34, and the PoG curve decreases from about 0.67 to 0.64. This pattern is consistent with the threshold picture in Section 4.5 in this band, increasing Openalty moves the system toward the minimal effective sanction level Auuin needed to meaningfully reduce gaming, while still lying below the benign threshold Obenign at which sanctions would begin to erode participation.
Table 3 exxllores the trade-offs induced by the public-metric weight Ppub. As Ppub decreases from 1.0 to 0.2, the curve for the metric-welfare gap shrinks from about 0.06 to roughly 0.01, confirming that downweighting fully visible metrics and relying more on private or mixed evaluations does curb overt metric inflation. However, the other curves reveal that this is not a free improvement: the average welfare under gaming gradually declines from W game 0.34 to W game R 0.31, participation falls from Fgame 0.67 to Fgame 0.60, and PoG increases from roughly 0.64 to 0.68. Information design alone thus narrows the metric-welfare gap but can weaken the perceived payoff from genuine contribution for all participants, and even exacerbate the welfare loss relative to the fully aligned benchmark unless complemented by suitable reward alignment and audit mechanisms.
Taken together, Tables I
2 and 3 highlight three core messages of our framework a controlled environment. First, even under fixed aggregation and reward rules, introducing gaming types can push the system into low-welfare but high-metric equilibrium that is difficult to diagnose from metrics alone. Second, there
25

---

Published in Transactions on Machine Learning Research (03/2026)
is benign band of sanction strengths where modest increases in Opeenatty reduce PoG without materially harming participation. Third, information design that reduces the visibility of public metrics successfully narrows the metric welfare gap but does not by itself guarantee a lower PoG, and may worsen welfare unless jointly tuned with incentives and audits. These patterns are robust across random seeds in our simulator and match the qualitative comparative statics predicted by the metric, dynamics, and design layers.
Table 1: Baseline aligned versus gaming scenarios (steady-state averages over post burn-in rounds).
Scenario
W
Ø
M
M
W
PoG
Aligned
0.952
0.952
0.952
0.000
Gaming
0.325
0.638
0.358
0.033
0.658
Table 2: Effect of sanction strength Opennlly on gaming scenarios (steady-state averages), showing welfare W games participation Tgame; and Price of Gaming (PoG) as a function of Oppenalty-
Opennaty
W game
I gamm
PoG
0.3
0.316
0.637
0.668
0.5
0.319
0.636
0.665
0.7
0.325
0.638
0.658
1.0
0.332
0.636
0.651
1.5
0.340
0.632
0.643
Table 3: Effect of public-metric weight Ppub on gaming scenarios (steady-state averages), showing welfare
W games participation Tgame, PoG, the public metric level M game, and the metric-welfan gap M game W game functions of Ppub.
Ppub
W
Fgame
PoG
M game
M ggame
W
game
1.0
0.341
0.673
0.642
0.399
0.058
0.8
0.331
0.652
0.652
0.376
0.045
0.6
0.325
0.638
0.658
0.358
0.033
0.4
0.317
0.621
0.667
0.339
0.021
0.2
0.309
0.603
0.675
0.320
0.011
7.2 Real-World Federated Learning Experiment
To complement the stylized experiments, conducted small-scale Federated Learning experiment Fashion-MNIST with 30 clients, 40 rounds, and 30% of clients following gaming strategy that discards tail classes in local training and overfits to head-only public validation split. Table summarizes stcady-state averages over the last. ten rounds in an aligned scenario (no gaming clients) and in a mixed scenario with gaming clients.
From the perspective of the publicly visible head metric, the gaming scenario appears markedly superior: accuracy on head classes 0-4 increases from Mhead x 0.868 under alignment Mead 0.972 under gaming, Overall test accuracy Auull also increases slightly from 0.877 to 0.888, quantities would reasonably conclude that the revised policy is an improvement.
operator monitoring only these
Evaluating welfare on the tail classes 5-9 reveals the opposite trend. Tail welfare drops from W tall 2 0.898 in the aligned scenario to W. tail R 0.862 in the gaming scenario, corresponding to a Price of Gaming of
PoG 0.898 0.862
= 0.040,
0.898
26

---

Published in Transactions on Machine Learning Research (03/2026)
4% loss of attainable tail welfare. The gap between the public head metric and tail welfare also flips sign and widens: in the aligned case head - Waill R -0.03, whereas in the gaming case it is R 0.11, indicating that the disclosed metric is now substantially inflated relative to the outcome of interest.
Table thus illustrates a realistic form of metric gaming in Federated Learning. Introducing gaming clients yields a policy that looks better under the disclosed head metric and even slightly improves overall test accuracy, yet quietly degrades performance on the tail distribution that defines welfare. This aligns with the qualitative pattern predicted by our framework: when rewards and disclosure focus on narrow slice of performance, self- inffeseteeeteed responses drive the system toward high-metric, low- wow-relfare equilibrium for the true objective, even in real FI. setting.
Table 4: Federated Learning experiment on Fashion-MNIST: aligned versus gaming scenarios. Head metric is accuracy on head classes (0-4) using the public validation split; tail welfare is accuracy on tail classes (5-9) 9) using the hidden test split. Values are steady-state averages over the last ten rounds.
Scenario W tail
M head
ffull
M head
W tail
PoG
Aligned
0.898
0.868
0.877
-0.030
Gaming
0.862
0.972
0.888
0.110
0.040
Estimator reliability under partial audits. Table 5 evaluates whether a budget-limited auditor can recover welfare loss reliably when only a fraction b of clients is audited. For each gaming profile, we run the same FL sctting and treat the mean tail accuracy across all clients' held-out tail subsets as the ground- truth welfare signal used to compute PoGGT (relative the aligned baseline). To model partial audits, we re-sample an audited client set of size [6N] and estimate welfare from the audited clients only, yielding PoG; we repeat this re-sampling over multiple trials and summarize variability via PPo We summarize rank consistency via p and estimation variability via Poo alongside threshold-level robustness (FP/FN) at = 0.05. Across six gaming profiles, the estimator preserves the ground-truth ordering with highest rank consistency at b = 0.25, while the remaining false positives occur in borderline regimes where PoGer lies close to т. As expected, increasing audit coverage reduces sampling variability, with PPG decreasing from 0.0222 at 0.10 to 0.0060 b 0.50.
Table 5: Reliability of audit- based estimation under partial audits. Here denotes the audited client fraction, is Spearman's rank correlation between PoGer and PoG, and PPG summarizes estimation variability across audit re-sampling trials (mean of per-profile trial standard deviations; aggregated over 6 gaming profiles) under the risk threshold 7 = 0.05.
b
P
PoG
FP
6
FN
0.10
0.771
0.0222
0
0.25
0.943
0.0106
1
0
0.50
0.771
0.0060
0
Noise (privacy) and auditability: persistent metric welfare separation. Table D studies a simple privacy/ /oise stress test which each transmitted client update l2-clipped (at C = 1) and then perturbed with Gaussian noise using noise multiplier E (0, 0.05, 0.10). We implement this as a DP-like perturbation at transmission: each client sends A scale- (ftocal Oglobal), apply global fa-clipping to A at C, and add i..dd. Gaussian noise (000, (vC)?) before aggregation. We keep the federated setup fixed across (same client partitions and training hyperparameters), and compare aligned profile (no gaming) against gaming profile (g) 0.30) under identical conditions, reporting tail-means over the last K rounds. Across all noise levels, gaming consistently inflates the public head metric M while reducing lail welfare W, producing a positive and growing separation between what the server observes and what matters operationally. We quantify this separation through the additional welfare loss AW Waligned W Wamming and the additional gap increase Agap = (M W) gaaming (M - W) Jaligued at the same v. Notably, at 0.10 the gaming- induced welfare loss increases and the risk indicator PoG(ref) rises substantially, suggesting that even moderate
27

---

Published in Transactions on Machine Learning Research (03/2026)
privacy noise can exacerbate welfare impacts of strategic behavior by weakening the effective signal available for governance.
Table 6: Noise/privade trade-off under DP-like update perturbations. We sweep the noise multiplier " and compare aligned (no gaming) versus gaming (gf = 0.30). M is the public head metric and W is tail welfare (tail-mean over the last K rounds). We report the additional welfare loss at the same AW = W Waligned W gaaming, and the additional metric-welfare separation Agap. PoG(ref) is computed using the fixed reference welfare from the aligned, v = run (consistent with the main definition).
V
Maligned
W Waligned
M Mgaming
W gaaming
AW
Agap
PoG((re)gaming
0.00
0.8656
0.8831
0.9046
0.8289
0.0542
0.0932
0.0545
0.05
0.8419
0.8802
0.9101
0.8290
0.0513
0.1195
0.0544
0.10
0.8018
0.8440
0.8592
0.7807
0.0633
0.1207
0.1095
High-alignment metrics: diminishing but persistent welric-welfare separation. Table 7 evalu- ates whether the metric metric-welfare welfare separation persists when the server-visible metric is made more aligned with tail welfare. We use the same Fashion-MNIST FL setup as in Table 6 (same client count, non-IID Dirichlet partitioning, mopee//ptimizee, rounds, and gaming mix with gf 0.30), and measure welfare using client- side tail evaluation while the server observes only the public metric computed on a held-out validation split. We define mixed public metric
M(A) = (1 X) Mhedd + À Muil:
and sweep À E 0.3,0.6), where larger X increases alignment between what the server observes and what matters operationally. For each A, we compare an aligned profile (no gaming) against a gaming profile (g) = 0.30) and report lail-means over the last K rounds. As alignment increases, gaming induces smaller additional welfare loss AW Waligned Wgaming and a smaller additional gap increase Agap = (M g)mmiing - (M Waligned, consistent with reduced incentives for metric manipulation under better-aligned scoring. However, the separation does not vanish: even at X 0.6, gaming still yields positive metric- welfare gap and measurable welfare loss, indicating that partial alignment mitigates but does not eliminate governance-relevant risk.
Table 7: High-alignment stress lest via mixed public metrics. We sweep the alignment parameter À in (A) = (1- (1-A) + AMalil and compare aligned (no gaming) versus gaming (gr = 0.30). M is the public metric (tail-mcan over the last K rounds under (A)) and W is tail welfare (tail-mean over the last K rounds). We report the additional welfare loss at the same X, AW = Waligned - W Waamings and the additional metric-welfaree separation Agap (M W)amming - (M W) )aligned. For completeness, (oGrred) reports metric welfare
the paired welfare loss ratio at the same X, (oGiiaared) (Waligned W Wggamin)/ / Wallgnee (distinct from PoG(ref) used in Table G
Maligned
W Valigned
Meaming
W ygaming
AW
Agap
PoG(paired)gaminn
0.00
0.8633
0.8917
0.9101
0.8396
0.0521
0.0989
0.0585
0.30
0.8730
0.8863
0.8913
0.8470
0.0393
0.0575
0.0443
0.60
0.8755
0.8800
0.8740
0.8511
0.0289
0.0274
0.0329
Modern attack-defense replication: metric-welfare separation under contemporary threats. Table 8 tests whether the metric welfare separation observed in earlier stress tests persists under a more contemporary FL threat model on FEMNIST. We run FedAvg with partial participation (n=32 clients, 12 per round) for 100 rounds and define head classes as digits (server-visible) and tail classes letters (deployment- relevant). Clients are sampled uniformly each round, with a fixed malicious fraction (g/ = 0.30) activated after a short warm-up (attack start round = 5). We use the same lightweight. CNN and optimization setup across conditions (one local epoch per round with SGD; batch size 64; learning rate 0.02; momentum 0.9), and we evaluate using fixed public head/tai validation sets dligits/lottene alongside per-client tail evaluation to compute welfare. We consider two modern attacks: PoisonedFL-styyl model-poisoning variant with adaptive magnitude and a lightweight multi-round consistency term, and a backdoor/men mmodel-replacemment
28

---

Published in Transactions on Machine Learning Research (03/2026)
variant using fixed trigger and replacement scaling. We compare two defenses: FedCC (representation- similarity filtering) and Attack-Adapting Aggregation (attack-aware reweighting). For each condition, we report tail-means over the last K rounds of the public head metric Mhead, tail welfare W (mean client tail accuracy), and their separation gap = Mhead - W. We also report a same-defense welfare loss ratio, PoG baseline WV)//baseline Across defenses, the gap remains positive and sizable, and PoisonedFI. under FedCC exhibits a marked welfare drop alongside an enlarged separation, illustrating that modern attack attack/defense settings still admit governance-relevant divergence between what the server observes and what clients experience.
Table 8: Modern attack-defense replication on FEMNIST (digits as head, letters as tail). We run FedAvg for 100 rounds with partial participation and compare two attacks [PoisonedFL-styyle poisoning; backdoor/ model replacement) under two defenses (FedCC; Attack- Adaptive Aggregation). Entries are tail-means over the last K rounds: Mhead (public head metric), W (tail welfare), and gap Mhead relative to the baseline under the same defense: PoG (Wbaselims W //
W. PoG is computed
H0t/Wbasehing baseline
FedCC
Allack-Adaplas Aggregation
Attack
Mhead
W
gap
PoG
Mhead
W
gap
PoG
None Po
0.7532
0.5091
0.2441
0.6394
0.3819
0.2575
0.6605
0.3246
0.3359
0.3623
0.
0.5024
0.2868
-0.3154
Backdoor / Model Rep.
0.6900
0.4310
0.2591
0.1534
0.6962
0.4196
0.2766
-0.0986
8
Discussion and Limitations
8.1
Discussion
8.1.1
From optimization governed strategic systems
Our results support viewing Federated Learning (FL) as stralegic system rather than purely statistical optimization procedure. Instead of asking only how to minimize empirical risk under heterogeneity, our framework asks which behaviors are incentivized by observable metrics and contracts, and how far these behaviors can deviate from genuine welfare improvements. The metric layer captures these tensions through indices such as the Manipulability Index and the Price of Gaming (PoG); the dynamics layer links them participation stability and tipping points; and the design toolkit layer maps them concrete levers in evaluation, audits, sanctions, information disclosure, and aggregation.
8.1.2 Empirical instantiations of the three-layer view
Both the stylized simulations and the real FL experiment instantiate this three-layer view. In the simulator, we can directly control alignment between metric and welfare and observe regimes where identical operational rules admit both high-welfare and low-welfare equilibria depending on the fraction of gaming agents; the associated PoG values make explicit how much welfare is structurally at risk under each policy. In the Fashion-MNIST experiment (Table the publicly visible head metric and even overall test accuracy improvee under the gaming scenario, yet tail-class welfare deteriorates and PoG becomes strictly positive. This is precisely the high-metric, low-welfare pattern that the metric layer is designed to detect, now appearing in concrete FL training setup.
8.1.3 Interpreting PoG (including negative values): reference dependence and regime signals
PoG is a relative welfare gap with respect to reference policy and observational regime; it is therefore not an intrinsic, context-free property of a dataset or model. In particular, PoG can be negative when the chosen reference policy yields lower welfare than an alternative regime due to interactions among (i) aggreaation/afens-iidieee suppression of benign updates, (ii) audit targeting, and (iii) selection effects in participation. A negative PoG should not be read as 'gaming beneficial'; rather, signals that the reference baseline itself may be welfare-suboptimal under the given observability and participation conditions.
29

---

Published in Transactions on Machine Learning Research (03/2026)
(i) monotonic trends of PoG and manipulability as gaming intensity increases, (ii) concurrent changes in the metrie- welfare gap, and (iii) decision stability under threshold-base baade governance (false positives/negaativs)) which directly reflect governance risk.
Accordingly, our recommended interpretation is to emphasize patterns over isolated signs:
8.1.4 Estimator reliability as governance evidence
A central concern in realistic deployments is that indices such as manipulability and PoG are difficult to com- pute exactly, motivating retrospective and log-based estimation. We therefore validate estimator reliability in controlled settings where ground-truth indices are available (Table 5). Beyond pointwise error, we report rank consistency and thresholded decision outcomes (FP/EN), because governance acts on comparative risk signals and discrete triggers (e.g., audit escalation, sanction activation). These results provide evidence that, under the logging and observability assumptions stated in subsection (7.2 the proposed estimators can serve as actionable monitoring signals rather than purely illustrraivve constructs.
8.1.5 Privac--uudttabiltyy-ccmntte observability as design constraint
Our framework emphasizes that evaluation, audits, and incentives should be treated as a coupled system. Information design directly shapes manipulability; audit strength and targeting determine whether gaming yields sustained gains is neutralized by sanctions; reward aligument translates metric design into individ- ual payoff gradients; and participation rules determine how clients react to perceived gains and risks. The coise/observability experiments (Table 6 illustrate key mechanism: audit signals become less informa- tive, the effective cost of gaming can decrease, increasing governance difficulty and raising welfare risk. This does not imply that privacy is undesirable; rather, it implies that privacy budgets and audit designs must be co-calibrated to control FP /FFN risk and avoid both under-enforcement and over-detereence.
8.1.6 Robustness across regimes: alignment shifts and modern threats/defenses
A natural question is whether the indices remain informative when metric and welfare are more aligned and gaming is subtler. The alignment-shift experiments (Table 7 show that, even as the metric-welfro correlation increases, the indices retain discriminative power, though effect sizes may shrink as expected. Moreover, under adaptive multi-round attacks and contemporary defenses defenses/aggreeattoon aggregation variants (Table S the monitoring signals remain consistent with governance intuition: risks reflected welfare degradation and participation instability are accompanied by increased ToG/manipulabilityy while effective defenses reduce both welfare loss and risk signals. Importantly, these experiments are not presented 'leaderboard;; they stress-test whether governance signals remain stable across realistic threat and defense regimes.
performance
8.1.7 A practical reading guide: how to use the indices and levers
The indices suggest. a complementary evaluation style for FL mechanisms. Beyond reporting single aggre- gate performance number under fixed threat model, one can stress-test candidate policies against families of behavioral profiles and measure how PoG, manipulability, and participation resilience respond.
Monitoring and triggers. Rather than reacting to single-round spikes, operators should monitor sus- tained trends and use calibrated triggers. For example, a joint pattern of increasing manipulability and widening metric welfare gaps indicates rising incentive misalignment, motivating targeted audits or changes in metric disclosure.
Design combinations rather than single levers. Our simulations suggest. that moderate increases in sanction strength can reduce PoG without materially harming participation in a benign regime, whereas changes in public metric weight alone can reduce metric inflation the cost of welfare and participation. Rather than proposing a single lever as sufficient, the framework points toward combined designs that mix private or randomized evaluations, targeted audits, calibrated sanctions, and robust aggregation.
30

---

Published in Transactions on Machine Learning Research (03/2026)
Beyond FL. Although we focus FL, the same language applies to other collaborative AI settings- moddel marketplaces, leaderboards, and crossarganizational data collaborations where performance is mediated by metrics and contracts and where high-metric, low-welfare equilibria are concern.
8.2
Limitations
8.2.1
Behavioral model simplicity and strategic richness
Our work has several limitations. First, the behavioral and participation models are intentionally simple. We consider two archetypal client types (honest and gaming) with fixed strategies and a threshold-basee participation rule, and we do not capture richer heterogeneity in costs, risk attitudes, coalition formation, Sybil behavior, adaptive strategy learning. Consequently, our thresholds and comparative statics are best read qualitative descriptions for stylized populations rather than precise predictions for arbitrary agent mixtures.
8.2.2 Normative welfare/metric definitions and reference dependence
Second, our definition of welfare and our choice of metrics are normative. We work with scalar welfare quantity and
more proxy metrics, but real deployments may larget multiple, sometimes conflicting objectives (e.g., subgroup performance, fairness, latency, cost). In the FL experiment, treat tail-class accu- racy as welfare and head-class accuracy the public metric. This choice reflects settings where safety-critical or minority performance is the primary concern while public reporting emphasizes headline performance. Accordingly, PoG depends on how welfare and metries are defined, and it should be interpreted via regime comparisons and decision stability rather than as an absolute score.
8.2.3 Scope of empirical validation and scalability
Third, the empirical scope is limited. The simulator abstracts away from model architecture, data modality, and system constraints to isolate strategic effects. The real FL experiment uses single dataset, a standard convolutional model, and a FedAAv-style protocol with modest number of clients on a single machine. We do not claim exhaustive coverage of large-scale production deployments, highly heterogeneous networks, or all classes of adaptive adversarics. The experiments should therefore be viewed as evidence for predicted patterns and signal robustness, not a complete empirical audit across real-world FL workloads.
8.2.4 Observability assumptions and cryptographic/privacy mechanisms
Fourth, several important dimensions are only treated at a high level. While we empirically study the effect of reduced auditability via noise/observabiln shifts, we do not fully model end-to-end differential privacy accounting, secure aggregation protocols, or cryptographic allestations that may constrain what logs and andits can reveal. A complete integration of these mechanisms would require system-level cost and threat model that jointly captures privacy guarantees, audit resolution, and incentive compatibility.
8.2.5 Organizational and cost frictions in audits and sanctions
Fifth, our audit allocation procedures rely on submodularity assumptions and abstract away from com- putational, communication, and organizational costs. In real deployments, these frictions may constrain how aggressively audits, aulo-switch rules, and comeetivity--based alarms can be implemented. Incorporat- ing explicit cost models for audits and sanctions an important direction for translating the toolkit into domain-specific operating policies.
8.2.6
No single optimal design: calibration and governance risk
Finally, we do not offer a single 'optimal' design or algorithm. The framework provides indices, thresh- olds, and levers, but seleeting an operating point still requires domain-speciffc judgment about acceptable trade-offs between metric informativeness, gaming risk, audit cost, privacy, and participation stability. In particular, miscalibrated thresholds overzealous enforcement deter benign participation and reduce
31

---

Published in Transactions on Machine Learning Research (03/2026)
welfare; ancert calibration and FP/ /FN-aware governance therefore essential for responsible deployment. We view this work a starting point for future research that refines behavioral models, spe- cializes the design space to particular domains, and integrates additional constraints from privacy, fairness, and governance.
9 Conclusion
We have presented a framework that treats Federated Learning as a governed strategic system shaped by metrics, incentives, and oversight rather than as a purely statistical optimization problem. At the metric layer, indices such as the Manipulability Index and the Price of Gaming quantity how strongly a design invites metric-targeting behavior and how costly such behavior is in terms of welfare loss; at the dynamics layer, these quantities are linked to participation stability, tipping points, and domino exits; and at the design voolkit layer, they translate into concrele levers in evaluation, information disclosure, rewards, audits, and sanctions. Stylized simulations and a real FL experiment on Fashion-MNIST jointly illustrate that high-metric, low-welfare regimes can arisc under plausible settings when incentives and disclosure focus on a narrow slice performance, and that calibrated combinations mixed or private evaluation, targeted audits, and moderate sanstions can reduce manipulability and the Price of Gaming without collapsing participation, whereas information design alone, while narrowing metric- welfare gaps, is not sufficient to guarantee welfare improvements. We view this framework not as a final solution but as a compact language and toolkit for rea- soning about metric gaming and cooperation in Federated Learning, and as a basis for future work on richer behavioral models (including heterogeneous and coalition- caaition-forming agents), multi-objective and fairness- welfare definitions, and deployments that must satisfy strong privacy and regulatory constraints.
Broader Impact Statement
This work aims to improve the governance of federated learning (FI.) systems by making incentives, gaming opportumities, and cooperation incentives explicit and measurable. In high-stakes domains such as healthcare, finance, or public services, better-aligned evaluation and reward rules, together with appropriately designed audits, can reduce metric gaming and unintended Goodhart effects, and can support more stable cooperation among organizations that cannot share raw data.
At the same lime, the framework has dual-use risk. A stralegic actor could exploit the indices and design patterns to craft more effective gaming strategies against poorly governed FL platforms, In addition, oper- ators could misuse the analysis to justify excessive surveillance or punitive enforcement, disproportionately burdening weaker participants and entrenching power asymmetries rather than improving welfare.
A central risk is miscalibration: governance thresholds or aggressive sanctions that are not uncertainty- aware may unintentionally deter benign cooperation, reduce participation, and degrade overall welfare. To mitigate this risk, our recommendations emphasize uncertainty-awar calibration and proportionality. In particular, operators should (i) treat estimated risk scores and welfare-loss estimates as noisy quantities, (ii) choose conservative triggers that control false positives when evidence is borderline, and (iii) monitor downstream participation responses and welfare impacts after policy changes, adjusting thresholds and andit intensity when unintended deterrence observed. Enforcement policies should include remediation and appcal pathways to avoid exclusionary outcomes.
We recommend that the indices and design toolkit introduced in this paper be used as diagnostic inputs within broader governance processes that include human oversight, transparency, and stakeholder consulta- tion. Operationally, exploit-cnabling details (c.g., exact challenge composition, audit triggers, and detection thresholds) should be access-controlled, while diagnostic feedback to participants should be aggregated, de- layed, or coarsened to preserve learning signals without enabling eevrrse-ngiineering Our experiments rely on synthetic simulations and a public benchmark datasct and do not involve sensitive personal data; nev- deployments require additional legal, ethical, and domain-speciffc review beyond the scope of this paper.
ertheless,
32

---

Published in Transactions on Machine Learning Research (03/2026)
Reproducibility
We provide & Jupyter notebook, GCFL_main, miii_maanniippb,,,.. as supplementary material. The notebook reproduces all experiments reported in Section [ inchuding the stylized simulations and the federated experiments on Fashion-MMIST and FEMNIST. It self-contained: running it end-lo-end generales the full set of summary statistics reported in the main paper (including the tables), without relying on any additional scripts. We specify all random seeds, hyperparameters, and software requirements directly within the notebook, and it can be executed on Google Colab.
We also provide public code repository OeenReview camera-ready revision page) that contains the same notebook in a cleaned and documented form, along with auxiliary files (e.g., environment specifications) for convenience.
also linked on the
References
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Nya Mironov, Kunal Talwar, and Li Zhang, Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp. 308 318, 2016.
Alekh Agarwal, Alina Beygelzimer, Miroslav Dudik, John Langford, and Hanna Wallach. A reductions approach to fair classification. In International conference on machine learning, pp. 60 69, PMLR, 2018.
Dan Alistarh, Zeyuan Allen-Zhu. Zhu, and Jerry Li. Byzantine stochastic gradient descent. Advances in neural information processing systems, 31, 2018.
Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané, Concrete problems in ai safety. Xi preprint arXiv:1606. 1666666666666, 2016.
Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy. Advances in neural information processing systems, 32, 2019.
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How backdoor federated learning. In International conference artificial intelligence and statistics, pp. 2938-2948. PMLR, 2020.
Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Cireumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32, 2019.
Raef Bassily, Kobbi Nissim, Adam Smith, Thomas Steinke, Uri Stemmer, and Jonathan Ullman. Algorithmic stability for adaptive data analysis. In Proceedings of the forby-eighth annual ACM symposium Theory of Computing, pp. 1046-1059, 2016.
Jeremy Bernstein, Jiawei Zhao, Kamyar Azizuadenesheli, and Anima Anandkumar. signsgd with majority
vote is communication efficient and fault tolerant. arXiv preprint arXie: rrXic:1810.05211, 2018.
Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with
adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017.
Avrim Blum and Moritz Hardt. The ladder: A reliable leaderboard for machine learning compelitions. In International Conference on Machine Learning, pp. 1006-1014. PMLR, 2015.
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, machine
Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1175-1191, 2017.
Michael Brückner and Tobias Scheffer. Stackelberg games for adversarial prediction problems. In Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 547-555, 2011.
33

---

Published in Transactions on Machine Learning Research (03/2026)
David Byrd, Vaikkunth Mugunthan, Antigoni Polychroniadou, and Tucker Balch. Collusion resistant feder- ated learning with oblivious distributed differential privacy. In Proceedings of the Third ACM International Conference on Al in Finance, pp. 114 122, 2022.
Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. ar preprint or urxiv:2012 2. 13995, 2020.
Nicholas Carlini, Chang Liu, Ülfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. In 28th USENIX security sympostum (USENIX security 19), pp. 267-284, 2019.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Hlerbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21), pp. 2633-2666600 2021.
Lingjiao Chen, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Draco: Byzantine- resiiien distributed training via rodundant gradients. In International Conference on Machine Learning, pp. 903- 912. PMLR, 2018.
Yi-Chung Chen, Hsi- Wen Chen, Shun-Gui Wang, and King-Syan Chen. Space: Single-round participant amalgamation for contribution evaluation federated learning. Advances in Neural Information Processing Systems, 36:6422 6441, 2023.
Yiwei Chen, Kaiyu Li, Guoliang Li, and Yong Wang. Contributions estimation in federated learning: A comprehensive experimental evaluation. Proceedings of the VLDB Endowment, 17(8):2077-2090, 2024.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint Xix::200 09670, 2020.
Georgios Damaskinos, El-Mahdi El-Mhamdi, Rachid Guerraoui, Arsany Guirguis, and Sébastien Rouault. Aggregathor: Byzantine machine learning via robust gradient aggregation. Proceedings of Machine Learn- ing and Systems, 1:81-106, 2019.
Lauro Langosco Di Langosco, Jack Koch, Lee D Sharkey, Jacob Pfau, and David Krueger. Goal misgeneral- ization in deep reinforcement learning. In International Conference on Machine Learning, pp. 12004-12019. PMLR, 2022.
Ninguing Ding, Zhixuan Fang, and Jianwei Huang. Optimal contract design for efficient federated learning with multi-dimensional private information. IEEE Journal on Selected Areos in Communications, 39(1): 186 200, 2020.
Kate Donahue and Jon Kleinberg, Model-sharing games: Analyzing federated learning under voluntary participation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 5303- 5311, 2021a.
Kate Donahue and Jon Kleinberg. Optimality and stability in federated learning: A game-theoretic approach. Advances in Neural Information Processing Systems, 34:1287-1298, 2021b.
Julia Dressel and Hany Farid. The accuracy, fairness, and limits of predicting recidivism. Science advances, 4 ((1)sea0,5500 2018.
Cynthia Dwork, Vitaly Feldman, Moritz Hardt, Toni Pitassi, Omer Reingold, and Aaron Roth. Generaliza- tion in adaptive data analysis and holdout reuse. Advances in neural information processing systems, 28, 2015a.
Cynthia Dwork, Vitaly Feldman, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Aaron Roth. The reusable holdout: Preserving validity in adaptive data analysis. Seience, 349(8)))) 638, 2015b.
34

---

Published in Transactions on Machine Learning Research (03/2026)
Cynthia Dwork, Vitaly Feldman, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Aaron Leon Roth. Preserving statistical validity in adaptive data analysis. In Proceedings of the forty-seventh annual ACM symposium on Theory of computing, pp. 117 126, 2015c.
Üfrr Erlingsson, Vitaly Feldman, Nya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. Amplification by shuffling; From local to central differential privacy via anonymity. In Pro- ceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms, pp. 2019.
SIAM,
Tom Everitt, Marcus Hutter, Ramana Kumar, and Victoria Krakovna. Reward tampering problems and solutions in reinforcement. learning: A causal influence diagram perspective. Synthese, 198(Suppl 27): 6435 6467, 2021.
Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to (Byzantine- Robust} federated learning. In 29th USENIX security symposium (USENIX Security 20); pp. 1605 1622, 2020.
Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. Mitigating sybils in federated learning poisoning. arXiv preprint Xrv: 04866, 2018.
Timnit Gebru, Jamie Morgenstern, Briana Vecchione, Jennifer Wortman Vaughan, Hanna Wallach, Hal Daumé Tii, and Kate Crawford. Datasheets for datascts. Communications of the ACM, 64(12):
86 92, 2021.
Robin C Geyer, Tassilo Klein, and Moin Nabi. Differentially private federated learning: A client level perspective. arXie preprint Xiv: 1012. 2.0557,777755 2017.
Amirata Ghorbani and James Zou. Data shapley: Equitable valuation of data for machine learning. In Internaiional conference on machine learning, pp. 2242 2251. PMLR, 2019.
Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing, Cryplonets: Applying neural networks to encrypted data with high throughpul and accuracy. In Interna- tional conference on machine learning, pp. 201-210. PMLR, 2016.
Rachid Guerraoui, Sébastien Rouanlt, et al. The hidden vulnerability of distributed learning in byzantium. In International conference on machine learning, pp. 3521 1-3330. PMLR, 2018.
Moritz Hardt, Nimrod Megiddo, Christos Papadimitriou, and Mary Wootters. Strategic classification, In Proceedings of the 2016 ACM conference on inmovations in theoretical computer science, pp. 111 122, 2016a.
Moritz Hardt, Eric Price, and Nati Srebro. Equality of opportunity in supervised learning. Advances in neural information processing systems, 29, 2016b.
Cengis Hasan. Incentive mechanism design for federated learning: Hedonic game approach. orXiv preprint arXiv:2101.09673, 2021.
Rui Hu and Yanmin Gong. Trading data for learning: Incentive mechanism for on-device federated learning. In GLOBECOM 2020-2020 IEEE Global Communications Conference, pp. 1 1-6. IEEE, 2020.
Jiwei Huang, Bowen Ma, Yuan Wu, Ying Chen, and Xuemin Shen. A hierarchical incentive mechanism for federated learning. IEEE Trunsactions Mobile Computing, 23(11):11731111277 2024.
Matthew Jagielski, Michael Kearns, Jieming Mao, Alina Oprea, Aaron Roth, Saeed Sharifi-Malvajpe Malvajerdi, and Jonathan Ullman. Differentially private fair learning. In International Conference on Machine Learning, pp. 3000-3008. PMLR, 2019.
Hengrui Jia, Mohammad Yaghini, Christopher A Choquette-Chon Choo, Natalic Dullerud, Anvith Thudi, Varun Chandrasekaran, and Nicolas Papernot. oroof-f--laaringg Definitions and practice. In 2021 IEEE Sym- posium on Securily and Privacy (SP), pp. 1039-1055 IEFF, 2021.
35

---

Published in Transactions on Machine Learning Research (03/2026)
Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nick Hynes, Nezihe Merve Gürel, Bo Li, Ce Zhang, Dawn Song, and Costas J Spanos. Towards efficient data valuation based on the shapley value. In The 22nd International Conference on Artificial Intelligence and Statistics, pp. 1167 1176. PMLR, 2019.
Jiawen Kang, Zehui Xiong, Dusit Niyato, Shengli Xie, and Junshan Zhang. Incentive mechanism for reliable federated learning: A joint optimization approach to combining reputation and contract theory. IEEE Internet of Things Journal, 6(6):10700-107)) 2019.
Michael Kearns, Seth Neel, Aaron Roth, and Zhiwei Steven Wu. Preventing fairness gerrymandering: Audit- ing and learning for subgroup fairness. In International conference on machine learning, pp. 2564-2572. PMLR, 2018.
Douwe Kiela, Max Bartolo, Yixin Nie, Divyansh Kaushik, Atticus Geiger, Zhengxuan Wu, Bertie Vidgen, Grusha Prasad, Amanprect Singh, Pratik Ringshia, et al. Dynabench: Rethinking benchmarking in nlp. In Proceedings of the 2021 Conference of the North American Chapler of the Associalion for Compulational Linguistics: Human Language Technologies, pp. 4110-4124, 2021.
Dong Seok Kim, Shabir Ahmad, and Taeg Keun Whangbo. Federated regressive learning: Adaptive weight updates through statistical information of clients. Applied Soft Computing, 166:112043, 2024.
Michael P Kim, Amirata Ghorbani, and James Zou. Multiaccuracy: Black-box post-processing for fairness in classification. In Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society, pp. 247-247-444 2019.
Pang Wei Koh and Percy Liang. Understanding black- box predictions via influence functions. In International conference on machine learning, pp. 1885 1894. PMLR, 2017.
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, et al. Wilds: A benchmark of in-the-wild distribution shifts. In International conference on machine learning, pp. 5637 5664. PMLR, 2021.
Matt Kusner, Joshua Loftus, Chris Russell, and Ricardo Silva. Counterfactual fairness. Advances in neural information processing systems, 30, 2017.
Fan Lai, Xiangfeng Zhu, Harsha V Madhyastha, and Mosharaf Chowdhury. Oort: Efficient federated learn- ing via guided participant selection. In 15th {USENIX} Symposium on Operating Systems Design and Implementation ((OSDT) 21), pp. 19-35, 2021.
Tra Huong Thi Lc, Nguyen H Tran, Yan Kyaw Tun, Minh NH Nguyen, Shashi Raj Pandcy, Zhu Han, and Choong Scon Hong. An incentive mechanism for federated learning in wireless cellular networks: An auction approach. IEFE Transactions on Wireless Communications, 20(8):4844-4887, 2021.
Tian Li, Maziar Sanjabi, Ahmad Beirami, and Virginia Smith. Fair resource allocation in federated learning. arXiv preprint ar Xic: 10497, 2019.
Xiaoqiang Lin, Xinyi Xu, See-Kiong Ng, Chuan-Sheng Foo, and Bryan Kian Hsiang Low. Fair yet asymptoi- ically equal collaborative learning. In International Conference on Machine Learning, pp. 21223-2222221 222299. PMLR, 2023.
Yuan Liu, Zhengpeng Ai, Shuai Sun, Shuangfeng Zhang, Zelei Liu, and Han Yu. Fedcoin: A peer-to-peer payment system for federated learning. In Federated learning: privacy and incentive, pp. 125-138. Springer, 2020.
Yuan Liu, Mengmeng Tian, Yuxin Chen, Zehui Xiong, Cyril Loung, and Chunyan Miao. A contract theory based incentive mechanism for federated learning. In Federated and Transfer Learning, pp. 117-137. Springer, 2022a.
36

---

Published in Transactions on Machine Learning Research (03/2026)
Zelei Liu, Yuanyuan Chen, Han Yu, Yang Liu, and Lizhen Cui. Gtg-shapley: Efficient and accurate par- ticipant contribution evaluation in federated learning. ACM Transactions on intelligent Systems and Technology (TIST), 13(4):1 21, 2022b.
Bing Luo, Yutong Feng, Shiqiang Wang, Jianwei Huang, and Leandros Tassiulas. Incentive mechanism design for unbiased federated learning with randomized client participation. In 2023 IEEE 43rd International Conference Distribuled Compuling Systems (ICDCS), pp. 545 555. IEEE, 2023.
David Manheim and Scott Garrabrant. Categorizing variants of goodhart's law. arXiv preprint arXiv:1803.0450 2018.
H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially privale recurrent language models. In International Conference on Learning Representations, 2018.
Luca Melis, Congzheng Song, Emiliano De Cristolaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE symposium on security and privacy (SP), pp. 691-706. IEEE, 2019.
Celestine Mendler-Dinner, Juan Perdomo, Tijana Zrnie, and Moritz Hardt. Stochastic optimization for performative prediction. Advances in Neural Information Processing Systems, 33:4929-4999 2020.
John Miller, Smitha Milli, and Moritz Hardt. Strategic classification is causal modeling in disguise. International Conference on Machine Learning, pp. 6917-6926 PMLR, 2020.
Margaret Mitchell, Simone Wu, Andrew Zaldivar, Parker Barnes, Lucy Vasserman, Ben Hutchinson, Elena Spitzer, Inioluwa Deborah Raji, and Timnit Gebru. Model cards for model reporting. In Proceedings of the conference on fairness, accountability, and transparency, pp. 220 229, 2019.
Mehryar Mohri, Gary Sivek, and Ananda Theertha Suresh. Agnostic federated learning. In International conference on machine learning, pp. 4615-4625. PMLR, 2019.
Lokesh Nagalapatti and Ramasuri Narayanam. Game of gradients: Mitigating irrelevant clients in federated learning. In Proceedings of the AAAI Conference Artificial Intelligence, volume 35, pp. 9046-9054, 2021.
George I, Nemhauser, Laurence Wolsey, and Marshall L, Fisher. analysis of approximations for maxi- mizing submodular set functions i. Mathematical programming, 14(1):265 294, 1978.
Takayuki Nishio and Ryo Yonetani. Client selection for federated learning with heterogeneous resources in mobile odge. In ICC 2019-2019 IEEE international conference on communications (ICC), pp. 1-7. IEEE, 2019.
Jianquan Ouyang and Liyuan Kuang. Frifl: A fair and robust incentive mechanism for heterogencous federated learning. In International Conference on Intelligent Computing, pp. 338-350. Springer, 2025.
Nicolas Papernot, Martín Abadi, Úlfar Erlingsson, Ian Goodfellow, and Kunal Talwar. Semi-superviseed knowledge transfer for deep learning from private training data. In International Conference on Learning Representations, 2017.
Nicolas Papernot, Shuang Song, Tyy Mironov, Ananth Raghunathan, Kunal Talwar, and Úlfar Frlingsson. Scalable private learning with pate. arXiv preprint #xXf::8802008003 2018.
Juan Perdomo, Tijana Zrnic, Celestine Mendler-Dinner, and Moritz Hardt. Performative prodiction. International Conference on Machine Learning, pp. 7599-7609. PMLR, 2020.
Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. IEEE Transactions on Signal Processing, 70:1142-1154, 2022.
Stephan Rabanser, Stephan Günnemann, and Zachary Lipton. Failing loudly: An empirical study of methods for detecting dataset. shift. Advances in Neural Information Processing Systems, 32, 2019.
37

---

Published in Transactions on Machine Learning Research (03/2026)
Marco Tulio Ribeiro, Tongshuang Wu, Carlos Guestrin, and Sameer Singh. Beyond accuracy: Behavioral testing of nlp models with checklist. In Proceedings of the 58th Annual Meeting of the Associalion for Computational Linguistics. Association for Computational Linguistics, 2020.
Yalin E. Sagduyu. Free-rider games for federated learning with selfish clients in nextg wireless networks. Tn
2022 IEEE Conference on Communications and Network Security (CNS), pp. 365-370. IEEE, 2022.
Yunus Sarikaya and Ozgur Ercetin. Motivating workers in federated learning: A stackelberg game perspec- tive. IEEE Networking Letters, 2(1):23 27, 2019.
Reza Shokri and Vitaly Shmatikov. Privacy-preserving deep lcarning. In Proceedings of the 22nd ACM 2015.
SIGSAC conference on compuler and communications securily, pp.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on securily and pricacy (SP), pp- 3-18. IEEE, 2017.
Joar Skalse, Nikolaus Howe, Dmitrii Krasheninnikov, and David Krueger. Defining and characterizing reward gaming, Advances in Neural Information Processing Systems, 35:9460 9471, 2022.
Xiaoli Tang, Han Yu, Xiaoxiao Li, and Sarit Kraus. Intelligent agents for auction- based federated learning: a survey. In Proceedings of the Thirty Third International Joint Conference on Artificial Intelligence, pp. 8253 8261, 2024.
Nurbek Tastan, Samar Fares, Toluwani Aremu, Samuel Horvath, and Karthik Nandakumar. Redefining contributions: shapley-driven federated learning. In Proceedings of the Thirty- Thirty-Third International Joint Conference on Artificial Intelligence, pp. 5017, 2024.
Florian Tramer and Dan Boneh. Differentially private learning needs better features (or much more data).
arXiv preprint ar Xrx:20011. 1. 11660, 2020.
Brandon Tran, Jerry Lå, and Aleksander Madry. Spectral signatures backdoor attacks. Advances in neural information processing systems, 31, 2018
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on securily and privacy (SP), pp. 703.723. IEEE, 2019.
Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated lcarning. Advances in neural information processing systems, 33:16000-16084, 2020.
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Zeno++: Robust fully asynchronous sgd. In International conference on machine learning, pp. 10495-10503. PMLR, 2020.
Ruoting Xiong, Wei Ren, Shenghui Zhao, Jic Hc, Yi Ren, Kim-Kwang Raymond Choo, and Geyong Min. Copifl: A collusion-resistanl and privacy-preserving federated learning crowdsourcing scheme us- ing blockchain and homomorphic encryption. Future Generation Computer Systems, 156:95-1044 2024.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International conference on machine learning, pp. 5650-5659. Pmlr, 2018.
Jinsung Yoon, Sercan Arik, and Tomas Pfister. Data valuation using reinforcement learning. In International Conference on Machine Learning, pp. 10842-10851. PMLR, 2020.
Jingwen Zhang, Yuezhou Wu, and Rong Pan. Incentive mechanism for horizontal federated learning based on reputation and reverse auction. In Proceedings of the Web Conference 2021, pp. 947-956, 2021a.
Ning Zhang, Qian Ma, and Xu Chen. Enabling long-term cooperation in cross-silo federated learning: A repeated game perspective. IEFF Transactions on Mobile Compuling, 22(():3910-330) -9244, 2022.
38

---

Published in Transactions on Machine Learning Research (03/2026)
Yanci Zhang and Han Yu. Towards verifiable federated learning. arXiv preprint arXiv:2202.08310 2022.
Zhebin Zhang, Dajie Dong, Yuhang Ma, Yilong Ying, Dawei Jiang, Ke Chen, Lidan Shou, and Gang Chen. Refiner: A reliable incentive-driven federated learning system powered by blockchain. Proceedings of the VLDB Endowment, 14(12):2659-2660 2021b.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019.
A Additional Proofs and Formal Details
A.1
Metric Layer:
Manipulability and Price of Gaming
Proof of Proposition 4.3 Fix design policy æ and reference class Efef with M(T) 0. By definition,
[M |o)] 0.
M(T)
sup sup sup oe iE ofA:
AW. [00++ +E
so for every a E Dref, every i, and every of E Ai,
[MM 1o)] AW o)) +E
S
Since the denominator is strictly positive, this implies AMi(o o)] = 0 whenever [AWi[o] [0)] = 0. Hence, if (M ()) > 0 then necessarily [aW strictly improve the metric without also strictly improving welfare, and in particular there are no metric- gaming deviations at any Fref
| 0, i.e., (W, (o) > Thus no deviation can
Proof of Proposition 4.8 We compare two design policies л and on the same environment with aligned benchmarks galign and milign such that (oallig)) (o Let geame(T) and geame (r') denote the sets of gaming equilíbria.
Fix policy and consider a local neighborhood U of the aligned benchmark galigu in the profile space. Assume (i) the relevant feasible strategy sets are compact, (ii) W and M are contimuous on U, and (ii) there exists a (single-valued) local equilibrium selection Eq, : U + gaame(T) that is Lipschitz on U. Then the composition W o Eq, is Lipschitz on 4 with constant
Ln = Lip(W; Lip((E,;;)))
so for any E U,
(i - ((Ea,(o)) S Ln ||o الgi
In particular, for any gaming equilibrium ggame E Egame(x)) nul that is reachable from aaligo by devia- tion direction whose welfare gradient is zero nonpositive, we can upper bound the displacement by the maximum posétive metric gain along such feasible deviations, yielding the bound
(Galign) - W (asme)) < sup [AM | )
(A.1)
for some L 0 (take :: I,, after rescaling the local norm so that ||o gallgn is controlled by the maximal achievable positive metric gain in U).
Next, by the definition of the manipulability index M(T) (with slack E), for any client i and deviation of from align we have
[aM a <M(T) (IAWi(o! aaligu)]] }] + +s)
39

---

Published in Transactions on Machine Learning Research (03/2026)
Taking the supremum over (i) gives
sup [o
( } S <M() (A(oalian) + t))
sup AWi(d) A(oalign) sup
galiga)) ]]+
Combining this with equation yiclds, for any such gaming equilibrium,
( W (( (a < L.M(T) (A(o align) +
Normalizing by W (o > 0 and taking the maximum gaming equilibria gives
W(oalign) - ((
L (A(osligu) + 8)
PoG (T) =
sup osaam gf (T))
((oallgg))
W (Galign)
M(T).
(Equivalently, one may write PoG (T) S e M(T) + 02 with 02 = 0g if one prefers to isolate the slack Le
L A(a term, take ei W( and 02 W( M(T).)
Repeating the argument for x' yields the same form with (ci, dQ) evaluated at oflignn If M(T) S M(T). then
Po (x') S ci M(x) & = max (T)+ + A
where the residual
A = - cc)
collects the effect of changing the aligned benchmark and any (local) equilibrium-selettion constants. Tn particular, A + 0 when ofllign - galign and the local constants (L,)(,) W()) vary continuously with the benchnark.
A.2 Dynamics Layer: Participation and Thresholds
client i participates at round 1 if and only if (U 2 6, By symmetry, (2 is the same for all clients and can be written as (U( Hence the probability that a randomly chosen client participates at round t + 1 is
Proof of Proposition 5.4 Under Assumption
5.1
P[p = 1 [. = P S AU(Z;)) x)] = Fe (AU()))))
where Fe the CDF 0,. Taking expectations over clients yields
T++1 1 Σ 1P - NE.T = (a(AU((;;))) =: F(x;;))
which is the claimed participation map.
Proof of Proposition 5.9
Assumption (3) states that supre(o.1] [F r) < 1, so F(::T) is a contraction
mapping on the complete metric space [0, 1] with the usual metric. By the Banach fixed-point theorem, F(;T) has a unique fixed point x² E [0. 1], and for any initial xp E [0, the sequence T(+1 = F(ar m) converges to x*. Since .high is a fixed point by assumption (2), uniqueness implies x² high Thus high is the unique fixed point and globally attractive, and there tipping points.
other stable unstable fixed points
Proof of Proposition 17 Under Assumption 4.11 for fixed σ-; can write the payoff difference between harmfully gaming action game and a welfare-aligned action o. as
== AU(())==U(() ;0.1,0)) - U.(a, align () - - AD;
where AV, and AD, 2 0 do not depend on a. If gaming is profitable al 0, then AV, > 0. Whenever AD, > 0, the affine function (U) crosses zero at
of = AV.ADD
40

---

Published in Transactions on Machine Learning Research (03/2026)
Taking the supremum over all and for all > of the aligned action weakly dominates the gaming action. such harmful deviations and clients gives finite
Omin
sup 0z
2 came
For benignly cooperative profiles, similar comparison with the outside option yields a maximal penalty level beyond which cooperation is no longer rational for some coalition member. Taking the infimmum over such breakpoints yields a finite Obenign- Under the natural requirement that benign cooperation is not penalized more heavily than harmful gaming (i.e., AD; for benign actions is no larger than for harmful ones), these breakpoints satisfy Qmin I Obeiggn- A full proof requires formalizing the coalition-rationality condition and taking appropriate infima/suprees over coalitions and profiles; the argument. a straight.or exlension of the single-agent case.
Proof of Proposition 5.17 By assumption, under norrmall the participation map has a stable high- participation fixed point x high and unstable tipping point at < hhgh Under mafe the map is contraction with unique fixed point sale 2 x².
Consider any trajectory with 2o 2 x² + Whenever enters the interval [xt, + +cl, the auto-switch rule activates gaae Because F(fer)afe) is a contraction with fixed point at or above xt, iterates cannot cross below zt under saafe, Once Iy returns to a neighborhood of hhgg (specifically, above ghigh c), the hysteresis rule allows switching back to normal Thus the trajectory remains in [x 1] for all & and converges limit in [xr, _higg avoiding low-participation equilibria below x!, A formal proof stitches together contraction arguments on the intervals where each policy is active.
A.3 Design Toolkit: Mixed Challenges and Audits
Proof of Proposition 6.4 Let æ and n' be two policies that differ only in the mixed-challenge weight, with
Poub < Ppub. Write
Mi(a) = Ppub M, + (1 - Ppub) M (a),
and similarly for with Ppub. By assumption, the private challenge component M is welfare-aligned in the sense that (in expectation) depends on client actions only through their effect on true welfare W,. Hence, for deviations that change the public benchmark outcomes but do not change welfare, the private component is unaffected in expectation.
Consider deviations that only target public benchmarks and do not change W. For such deviations we have, in expectation,
AM = Ppub AMPub,
AMP' = Ppub AMpub,
with the same A APph. Therefore,
[ 1+
Poub
AMM AW,
[AMT] AW [+ +
AW + Ppub
+
since Pyut/ Ppub 1. Taking suprema over clients, deviations, and reference profiles yields M(T') S M(T). Thus shifting reward weight from public benchmarks to private, welfare-aligned components weakly decreases manipulability.
Proof of Theorem 6.0 Under Assumption 6.5 the audit utility f is normalized, monotone, and submodular.
The audit allocation problem
max S(S) subject to |S| < B SCT
is therefore monotone submodular maximization under a cardinality constraint. Let S be an optimal solution with | < B, and let Sr,... .....,, SB be the greedy sequence, where So and
= = (tt),
i E arg max A A(I = f(Su (0) ((S). EEISS
41

---

Published in Transactions on Machine Learning Research (03/2026)
By submodularity and monotonicity,
f(S)) - f(S))
Σ S.) B. max VEIAS,
A(i = B. (1(141)-f((s))
VES"/S.
where the second inequality uses SSt Rearranging yields
Stl < S < B and the last equality follows from the greedy choice,
1 -
1(S1+1) ( z B
Letting 9: f(5)) - f(S) gives 9++1 $ (1-1/B) hence
f(SB) 2 (1 (1- 1/B) S(S)) 2 (1 - 1/e) f(S"),
as (1- (1- se- This proof standard; see, c.g.: Nemhauser al. 1978
B Modeling Choices and Extensions
This section summarizes key modeling choices behind our framework and sketches extensions that we leave for future work. Throughout, we emphasize how these choices affect the interpretation of our indices and dynamics rather than proposing a single canonical model.
B.1 Behavioral Types and Action Sets
For clarity, the main text adopts a minimal behavioral abstraction with two archetypal client types and simple action sets.
Baseline types. We consider a population in which each client has latent type T (honest, gaming); with fixed fraction of gaming types in simulations and the FT, experiment. Honest types select actions from a constrained set
A aaiggn Ai,
which encode participation, local training, and reporting policies that aim to improve gemuine welfare (e.g., standard local training on D, and truthful reporting of updates). Gaming types select from the full set. A;, which additionally includes actions that target metrics or rewards while holding welfare flat or decreasing (o.g., discarding tail data, overfitting to public validation, perturbing reports to influence leaderboards).
Within each type, the main experiments use simple stationary strategies: honest clients apply fixed local training pipeline and reporting rule; gaming clients apply a fixed metric-targeting rule that is independent of history except through the current model 0,, This allows us to isolate how the design policy æ affects welfare, metrics, and participation even when behavioral complexity is limited.
Extensions in bchavioral richness. Several extensions natural but beyond scope:
Continuous helerogeneily: instead of discrete types, clients could have continuous parameters (e.g., cost of effort, risk aversion, penalty sensitivity), with t drawn from distribution. Best responses and thresholds would then be functions of these parameters.
Adaplive and learning stralegies: clients could update their strategies over time using reinforcement learning or no-regret dynamics, learning how to trade off gaming and cooperation given observed rewards and sanctions.
Coalitions, Sybils, and collusion: richer action sets could explicitly include coalition formation, Sybil identity creation, and coordinated reporting, rather than treating coalition effects only at the aggregate level in the dynamics layer.
Our indices and thresholds are defined at the level of strategy profiles and deviations, so they extend to these richer settings as long as welfare (ar) and metrics M(a) are well defined. The main trade-off is practical: more complex behavioral models make it harder to estimate the indices empirically and connect them concrete design levers.
42

---

Published in Transactions on Machine Learning Research (03/2026)
B.2 Alternative Welfare and Metric Definitions
The framework deliberately separates welfare from metrics, recognizing that real deployments may care about multiple objectives while exposing only subset through observable scores.
Scalar welfare and proxy metrics. In the main text, welfare modeled as scalar functional
W = (10
such accuracy utility on target distribution P that encodes the deployment population and business social objective. In the Fashion-MNIST experiment, we instantiate this as tail-class accuracy classes 5 9, treating performance on these classes the welfare outcome of interest.
Metrics ( are defined as proxy functionals constructed from evaluation pipelines, for example:
head-class accuracy on a public validation split (used as a reward-driving head metric);
overall lest accuracy, which may be monitored but not explicitly rewarded;
auxiliary diagnostics or fairness indicators, which may or may not enter incentives.
The Price of Gaming and Manipulability Index are defined abstractly in terms of (W, M) and therefore apply to any such choices.
Alternative scalarizations. In settings with multiple objectives (c.g., subgroup performance, latency, cost), one can still fit into our scalar framework by using a scalarization of the form
W(a) = UWW w())
where (O) are component- wise objectives and U is designer-chosen aggregator (e.g., weighted sum, min- imum over groups, or constrained utility that assigns -oo to infcasible fairness violations). Different scalarizations correspond to different normative choices and will in general induce different values of PoG and M(Tr) even under the same behavior and metrics.
Similarly, the exposed metric ((r) can vector, with only some coordinates entering rewards. Our formal definitions extend by either focusing on the metric components that are rewarded or by mapping M to scalar proxy m(M) that captures how incentives are actually computed.
B.3 Sketches for Multi-objective and Fairness-aware Welfare
We briefly sketch how the framework can be extended when welfare is explicitly multi-objective or fairness- aware.
Vector-valued welfare. Suppose welfare is vector
W (W) gEg
where 9 indexes groups, clients, or objectives (e.g., accuracy by demographic group, latency, and cost). simple extension is to define group-specific Prices of Gaming
W(s) (galig) (
(asme)
Po
and monitor both the worst-case and average group PoG. This distinguishes regimes where gaming pri- marily harms particular groups from those where losses more evenly spread.
43

---

Published in Transactions on Machine Learning Research (03/2026)
Fairness-aware aggregations. Alternatively, can define fairness-awart scalar welfare, for example:
Min-based: (a)) - minges (o)) emphasizing the worst-off group.
Penalty-basedd W(o) (()) X Disp(o), where W is average welfare, Disp is disparity measure (e.g,, gap between best and worst group), and À 2 0 trades off performance and fairness.
Constraint-basee ((o) is defined only over proflle satisfying fairness constraints (e.g,, equalized error rates), with infeasible profiles treated as having very low undefined welfare.
Our indices then quantify how gaming and cooperation affect both overall performance and fairness, depend- ing on the chosen W.
Implications for design. Multi-objective and fairness-aware welfare primarily affect:
how designers define aligned benchmarks øaliga (e.g., fairness-satisfying equilibria);
which components of W(o) are reflected in metrics and rewards;
how Prices of Gaming and Cooperation are interpreted across groups.
The structural rolc of the indices and dynamics remains unchanged: they still mcasure how far metric- largeting behavior can drift from the chosen welfare definition and how participation responds. A systematic treatment of faire aware incentives in federated settings an important direction for future work and would likely require combining our framework with group-specific constraints and fairness-sensitive audit mechanisms.
C Simulation Setup and Hyperparameters
This appendix summarizes the main modeling and hyperparameter choices for the stylized simulator and for the penalty and information-design sweeps reported in Section 7 The goal make the experiments reproducible a high level without lying the framework specific implementation.
C.1 Stylized Simulator
Environment and population. The stylized simulator instantiates the strategic FL model from Section 3 in a simplified cross-silo setting with a fixed population of n clients. Each client is typed as either honest or gaming, with a fixed fraction of gaming types (sct 30% the bascline experiments). Types remain fixed over time. All clients hold local datasets drawn from heterogeneous but stationary distributions (Pi)iez, and the welfare distribution P is mixture of these P..
At each round the server maintains global model 6 and broadcasts it to all eligible clients. Participating clients apply local training rule (e-g,, a fixed number of SGD steps on D:) to produce an internal update u which is then transformed into a reported update u,,t according to the client's type and strategy. The server aggregates reported updates via fixed aggregation rule (a FodAvg-style weighted mean in our implementation) and evaluates the updated model using a held-out evaluation pipeline.
Behavioral types and actions. Honest clients select actions from A Aliign which in the simulator are implemented as:
participation whenever expected utility is above a client-specific threshold;
standard local training on D; without discarding examples;
truthful reporting 4nt u,, (up to any mandated privacy perturbation).
44

---

Published in Transactions on Machine Learning Research (03/2026)
Gaming clients select from A,, which extends At with simple metric-targeting behaviors. Concretely, the gaming strategy used in the main experiments:
emphasizes subsets of data that are overrepresented in the public evaluation (e.g., 'head" groups);
downweights discards data that primarily contributes to welfare but has little effect on the public metrie;
optionally perturbs updates directions that improve the disclosed metric while leaving welfare flat or reduced.
Both lypes use myopic best responses with respect to the current design policy a and their outside option, as in Section
Welfare, metrics, and participation. For the stylized experiments, welfare W, is instantiated as pected performance the welfare distribution Pt, normalized to [0, The metric M, is scalar proxy constructed from the same family of losses but evaluated on a distinct metric distribution and with a different weighting over clients and groups; this distribution is chosen so that gaming behaviors can move Mr without proportionate changes We. The aggregate participation rate is
It
[p = 1}
T
IET
and we report steady-state averages
M, computed over post burn-in rounds. The Price of Gaming is computed by comparing W under aligned and mixed-type configurations, as described in Section 4.3
Hyperparameters and averaging. Each simulation run procoeds for fixed number of rounds with an initial burn-in period discarded reduce transient effects. Unless otherwise specified, we:
fix the fraction of gaming clients, the aggregation rule, and the local training pipeline across runs;
vary only the design levers under study (e.g., penalty strength or public-metric weight);
average reported quantities over multiple random seeds (affecting client initialization, data sampling, and evaluation noise).
The exact numerical values of n, the number of rounds, and the learning-rate schedule are not critical for interpreting our indices, and were chosen to balance stability with computational cost.
C.2 Penalty and Information-design Sweeps
Penalty-strength sweep. The penalty-strength experiments in Table 2 vary scalar sanction parameter O'penalty while keeping all other components of the design policy æ fixed. For each value in a predefined grid (e.g., Openalty E (0.3, 0.7, 1.0, 1.5)))
we instantiate a policy тI T(apenalty) that scales expected sanctions linearly in a violation score, as in
Assumption 4.11
run the simulator to steady state with fixed fraction of gaming clients;
record W games Fgame, and the resulting PoG relative to the aligned benchmark.
This allows us to trace how increasing penalty strength moves the system toward or beyond the minimal sanction level Omin and the benign boundary Ohenign introduced in Section 4.5
45

---

Published in Transactions on Machine Learning Research (03/2026)
Information-desigan sweep. The information-design experiments in Table 3 vary the public-metric weight Ppub in mixed challenge policy (Section 6.2 while holding other levers fixed. For each Ppub E {1.0, 0.2.:
the overall metric is defined as
M2 Ppub MPub + (1 - Ppub) M.
where Mpuh is fully disclosed and Mp is based on private or randomized challenges;
reward rules depend on Mr through fixed monotone function, so changing Ppub alters the relative importance of public and private signals without changing the reward shape;
audits and sanctions are held constant so that observed changes in W games Igames M game: and PoG can be attributed to information design alone.
Reporting and robustness. For both sweeps, we report steady-state averages over post burn-in rounds and aggregate results across seeds. Individual runs exhibit stochastic variation, but the qualitative patterns in Tables 2 and 8 imppoved welfare and lower PoG in benign penalty band, and narrower metric metric-wellan welfare gaps but potentially higher PoG under aggressive downweighting of public metrics are stable across reasonable choices of simulator hyperparameters.
Fashion-MNIST Federated Experiment Details
This appendix summarizes the setup of the Fashion-MNIST experiment in Section 7 including the parti- tioning scheme, client types, training protocol, and few brief robustness checks. The goal is to provide enough detail to reproduce the qualitative patterns in Table f without tying the framework to particular implementation.
D.1 Partitioning, Heterogeneity, and Client Types
Dataset and head/tail split. We use the standard Fashion-MNIST dataset with 60,000 training and 10,000 test examples across ten classes labeled 0 9. For the experiment, designate classes 0 4 as head classes and classes 5-9 as lail classes. Welfare is defined accuracy on the tail classes, evaluated on held- out test split, while the public head metric is accuracy on the head classes, evaluated on a public validation split (Section
Client partitioning and heterogeneity. The training portion of Fashion-MNIST partitioned across 30 clients. To keep the focus on strategic behavior rather than extreme data skew, use mild label-hetcrogencous partition:
each class is first shuffled and split into 30 shards of approximately equal size;
for each client i, we sample small number of shards per class so that all clients observe both head and tail classes, but with modest. variation in proportions;
this yields client datasets D, with overlapping but non-identical label distributions, avoiding degen- erate clients that only head only tail labels before any gaming behavior.
The public validation split is constructed analogously from head-class examples only; the tail-class test split is kept. hidden from clients and used solely for welfare evaluation the server side.
46

---

Published in Transactions on Machine Learning Research (03/2026)
Client types and gaming behavior. We consider two fixed client types:
Honest cliends follow a standard local training procedure on their full local dataset D; and report their updates truthfully (up to any noise added by the protocol).
Gaming clients follow a head-focused strategy: before local training, they discard or heavily down- weight all examples from tail classes 5-9, train only on head-class data, and implicitly optimize toward performance on the public head-only validation split. They do not inject arbitrary model poisoning and remain consistent over rounds.
In the aligned scenario, all 30 clients are honest. In the gaming scenario, 30% of clients (randomly chosen at initialization and fixed thereafter) are gaming clients. Client types are not observable to the server; they are inferred only through their effect on metrics and welfare.
D.2
Training Protocol and Hyperparameters
FL protocol. We use a standard cross-silo FedAvg-style protocol:
global rounds: T 40;
all 30 clients participate in every round (no client sampling);
the server maintains a single global model 0, and aggregates client updates via weighted average proportional to local data size.
We run the protocol twice, once with all clients honest and once with the mixed population described above, using identical random seeds and hyperparameters except for client behavior.
Model and optimization. The global model is small convolutional network suitable for Fashion-MNIST with two convolutional layers followed by fully connected head and softmax output. We use cross-entropy loss for local training and a standard optimizer (e.g., SGD or Adam) with:
fixed learning rate over rounds;
mini-batch training with a moderate batch size;
small, fixed number of local epochs per round for each client.
Exact layer widths, learning rates, and batch sizes are chosen so that the aligned configuration reaches a test accuracy around 0.88 on the full test set, but otherwise follow standard Fashion-MNIST basclines. They are not critical for the qualitative comparisons reported in Table
Evaluation and metrics. At the end of cach round, the server evaluates the current global model
a public validation split restricted to head classes 0 4, yielding the head metric Mhead,ti
hidden test split restricted to tail classes 5 9, yielding tail welfare W WtalLas
an optional full test split across all ten classes, yielding overall accuracy Atill
The values M Mead, W and Ara reported in Table are averages over the last ten rounds. The Price of Gaming in this experiment is computed as
aligued
Waaming fail algneed
PoG R
tail
W
tail
47

---

Published in Transactions on Machine Learning Research (03/2026)
D.3 Additional Robustness Checks (Brief)
To check that. Table is not an artifact of single configuration, we performed small set of robustness checks:
Varying the fraction gaming clients. We repeated the experiment with 20% and 40% gaming clients. As expected, the metric-welfare gap and PoG increased with higher gaming fraction and decreased when fewer clients gamed, while the qualitative pattern (improved head metric, degraded tail welfare) remained.
Alternative label partitions. We swapped the head and tail roles of certain classes (e.g., using a different subset of five classcs tail) and obscrvod similar bchavior: when clients strategically focus on the classes emphasized by the public metric, performance on de-emphasized classes degrades even if overall accuracy changes little.
Random seeds and mild hyperparameter changes. Across multiple random seeds and modest variations local learning rate and number local epochs, the aligned configuration consistently outperformed the gaming configuration on tail welfare, while the gaming configuration maintained higher head-only public metric.
These checks are not meant to be exhaustive, but they support the claim that the Mishion-MNISS experiment illustrates a robust instance of the high-metric, low-welfare pattern predicted by our framework, rather than a fragile consequence of a particular training run.
48


Reviews:
[{"review_id": "xfr69yZ28V", "reviewer": "Reviewer_AFn6", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper frames federated learning (FL) not merely as a distributed optimization problem, but as a strategic principal-agent system in which clients may cooperatively improve welfare or strategically “game” metrics. The authors propose a **three-layer analytical framework** for understanding (and mitigating) such behavior, and considered mechanism and information design for each of the layers:\n\n1. Layer 1: Metric layer. The authors define manipulability, Price of Gaming (PoG) and Price of Cooperation (PoC), reflecting how misaligned metrics could be gamed to harm social welfare, and cooperation could either help or harm welfare. Threshold arguments are also given to establish when sanctions block harmful gaming without suppressing beneficial cooperation.\n2. Layer 2: Dynamics layer. The authors model the participation of clients as a dynamic process that could be unstable. The authors define tipping point and domino exit, and provide condition for resilience. Coalition effects and warning signals are also studied, and auto-switch rules are proposed to prevent participation collapse.\n3. Layer 3: Design toolkit layer. The authors then propose a set of mechanism design tools through levers of different component that steer different metrics to favorable directions. Governance checklists and audit budget allocation with approximate guarantee are given.\n\nAt last, this framework is validated through simulations and a federated Fashion-MNIST case study, showing divergences between welfare and observed metrics, and illustrating how audit & evaluation design can mitigate gaming.", "claims_and_evidence_yn": "No", "claims_explanation": "I have the following concerns regarding the presentation and soundness of the paper.\n\n1. Many notions in the paper are mentioned but never formally defined. For example, what is the definition of \"individually rational\", and what is \"coalition-rational\" in Section 4.5? What is the \"contraction\" used in the proof sketch of Proposition 5.9? What is a \"lever\" in Section 6? What is a \"reference class\" in the statement of Proposition 6.2? These terminologies may be standard in economics and mechanism design, but I don't think they are necessarily within the context of machine learning community.\n\n2. The model seems new but links from the model towards existing models in federated learning/mechanism design are not discussed. Section 3 presents a model that models federated learning as a strategic system. However, the connection between this model and the models studied by previous works are not discussed. Is it a generalization of previously studied models, or a completely new concept? How does it fit into the specific real-world scenarios of federated learning?\n\n3. Some proofs can be stated more formally and rigorously. For example, only a proof sketch is provided for Proposition 4.13. It seems to me that Proposition 5.4 cannot hold because Assumption 5.2 doesn't give any structure on the dynamics of $x_t$ (or Assumption 5.2 is falsely stated, I assume it should be \"client $i$ participates at round $t+1$ iff...\" ).", "audience_yn": "Yes", "audience_explanation": "This paper presents a model on the strategic model of federated learning. This is a realistic and interesting problem for machine learning researchers.", "requested_changes": "1. Formalize the statement and proofs of the theorems.\n\n2. Discuss the similarities and differences between the proposed model and models studied by other works.\n\n3. The theoretical part of the paper doesn't seem to be related to federated learning. Please specify what aspects of federated learning is required for the theorems to hold (otherwise the same result would hold for a general mechanism design/game theoretic principal-agent framework, and it is unclear how the results apply to federated learning).\n\n4. The theoretical results seem quite straightforward, and the scope of the theoretical results are way more specific than the model itself. Please specify the following: What are the technical challenges on proving the theorems? How to justify that the assumptions are realistic in federated learning?", "broader_impact_concerns": "The framework highlights vulnerabilities in federated learning to strategic manipulation and collusion, which could be exploited in real deployments if detection and governance mechanisms lag behind.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "e7Joy74Umu", "reviewer": "Reviewer_edNK", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper shifts the perspective of Federated Learning (FL) from a standard distributed optimization problem to a governed strategic system. It introduces an analytical framework designed to distinguish between genuine welfare-improving contributions and \"metric gaming,\" where participants manipulate reported updates to maximize rewards without improving actual performance. It introduces three novel indices to measure the health of an FL system: the Manipulability Index (capacity for gaming), the Price of Gaming (welfare loss due to manipulation), and the Price of Cooperation (distinguishing benign collaboration from harmful collusion). The theories are validated through both stylized simulations and a practical Fashion-MNIST experiment demonstrating how high-metric/low-welfare regimes emerge in real-world training.\n\nStrength:\n* The paper is clearly written and easy to follow.\n* The literature review is thorough and well-organized.\n* The proposed framework provides a unified lens for analyzing diverse FL incentive designs under a strategic/governed-system perspective, and offers useful guidance for reducing manipulability and improving federation stability.\n\nWeakness:\n* While the proposed indices are theoretically well-motivated, they may be difficult to compute or estimate in realistic FL deployments. The authors suggest retrospective/log-based estimation as a practical workaround, but the reliability and robustness of these approximations are not sufficiently demonstrated.\n* The Fashion-MNIST experiment provides supportive evidence, but the setup appears somewhat unrealistic. In real-world FL systems, the gap between “metric” and “welfare” may be less pronounced. It is therefore unclear whether the proposed approximate indices remain informative and stable when this gap is small or noisy.\n* The paper argues that stronger privacy mechanisms (e.g., Differential Privacy) may reduce the resolution of audit signals and thus increase manipulability. However, the experiments do not explicitly model this privacy–auditability–incentive trade-off. Even a simple experiment that injects noise into updates or audit signals would strengthen this claim and provide empirical grounding.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The main ideas and theoretical development are clearly presented, and the experiments provide reasonable support for the core claims. Overall, the evidence is consistent with the paper’s conclusions, though additional empirical validation would strengthen the practical relevance of the proposed indices", "audience_yn": "Yes", "audience_explanation": "The paper offers a useful and general perspective on incentive design in federated learning, which complements prior work that often focuses on specific incentive mechanisms or threat models. By formalizing manipulation risks and proposing interpretable indices, the framework can help researchers and practitioners reason about stability and strategic behavior in FL systems.", "requested_changes": "I suggest that the authors to address the weakness, such as:\n\n* Provide a controlled experiment simulation where the ground-truth indices are known, then compare them against the estimates produced by the proposed retrospective/log-based method. This would clarify the reliability and \"false-negative\" rate of using logs for governance.\n\n* Evaluate the framework in a setting where the evaluation metric is a closer proxy for true welfare (i.e., higher correlation than the Head/Tail split used in Table 2). This will demonstrate whether the indices remain informative when gaming is subtle rather than overt.\n\n* Provide an experiment that incorporates controlled noise injection (e.g., Differential Privacy) into client updates. This supports the theoretical claim that privacy-enhancing technologies increase the Price of Gaming by reducing audit signals.", "broader_impact_concerns": "No concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "rTx4AWEO2r", "reviewer": "Reviewer_UD5M", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "**Summary:**\n\nThis paper frames federated learning (FL) as a governed strategic system rather than a static optimization problem, and proposes a compact, game-theoretic language to reason about metric gaming, cooperation, participation dynamics, and governance levers. The core contributions are indices that quantify manipulability (M), the price of gaming (PoG), and the price of cooperation (PoC), along with a resilience indicator for participation dynamics and critical sanction thresholds that separate under-enforcement from over-deterrence. The authors claim threshold conditions, an audit-budget allocation rule with a (1−1/e) guarantee, early-warning indicators, and a design toolkit; stylized simulations and a Fashion-MNIST case study are said to qualitatively and quantitatively validate the framework.\n\n**Strengths:**\n- The paper addresses an important and timely gap: the interplay between privacy, limited observability, incentives, and cooperation/collusion in FL deployments.\n- The authors recast FL as a governed strategic system and introduce a metric-based lens (M, PoG, PoC) that explicitly separates metric performance from welfare, connecting Goodhart-style failures to incentives in FL.\n- They derive interpretable thresholds (α_min, α_benign) and a resilience indicator R(π) that link evaluation/audit design to participation stability and tipping points.\n- They propose a unifying Eval-Info-Reward-Audit architecture that can place diverse existing mechanisms under one umbrella and reason about incentive effects beyond aggregation rules.\n\n\n**Weaknesses:**\n- The indices (especially M(π) and PoG(π)) rely on suprema over strategy sets and equilibria that are hard to characterize; the paper’s practical estimation procedures are heuristic and may be sensitive to modeling choices.\n- Several key claims (e.g., the (1−1/e) audit allocation guarantee) are only mentioned at a high level in the excerpt; formal problem statements, assumptions, and proofs are necessary to assess rigor.\n- Empirical illustrations appear limited to stylized simulations and a Fashion-MNIST case study, which may be insufficient to support strong claims about generality and operational guidance for diverse, large-scale FL deployments.\n- It is unclear how the proposed indices behave under adaptive, multi-round poisoning strategies and advanced defenses prevalent in recent literature; no head-to-head evaluation against state-of-the-art attacks/defenses is described.\n- The definition of welfare $W$ and metrics $M$ in concrete FL contexts (e.g., with privacy, distribution shift, and fairness constraints) could be better operationalized to aid adoption.\n- While the related work section is broad and well-situated, explicit empirical comparisons to recent robust aggregation and poisoning frameworks (e.g., PoisonedFL, FedCC, AdaAggRL) are absent; such comparisons would better position the proposed indices and toolkit in practice.", "claims_and_evidence_yn": "No", "claims_explanation": "While the paper presents substantial empirical results, several claims lack adequate support:\n- **Missing Theoretical Evidence:** Key theoretical claims, such as the audit-budget allocation rule with a $(1-1/e)$ guarantee, are only mentioned at a high level.\n- **Limited Empirical Scope:** The experimental validation is restricted to \"stylized simulations and a Fashion-MNIST case study\".\n- **Lack of Comparative Validation:** The paper lacks head-to-head evaluations against state-of-the-art adaptive attacks (e.g., PoisonedFL) or modern defenses (e.g., FedCC, AdaAggRL). Consequently, it is unclear if the proposed indices actually track true risk under realistic threat models.", "audience_yn": "Yes", "audience_explanation": "The paper addresses an important and timely gap: the interplay between privacy, limited observability, incentives, and cooperation/collusion in FL deployments. The work offers technical novelty by recasting Federated Learning (FL) as a governed strategic system rather than a static optimization problem. This reframing allows for reasoning about incentive effects beyond simple aggregation rules.", "requested_changes": "Refer to the weaknesses above.", "broader_impact_concerns": "The primary concern is that miscalibrated governance thresholds or overzealous enforcement could unintentionally deter benign cooperation and degrade system welfare. Consequently, the work requires more robust guidance on uncertainty-aware calibration to mitigate the risk of suppressing legitimate participation.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)