Layer Free-Riding: Mechanisms & Remedies

• Layer free-riding is a phenomenon where one system component exploits benefits generated by another without a matching contribution, observed in federated learning, P2P networks, and multi-issue voting.
• In federated learning and Forward-Forward networks, free-riding manifests as strategic non-participation and optimization inefficiencies that diminish training signals and overall model robustness.
• Effective defenses include anomaly detection techniques, block-local training adjustments, reputation systems, and incentive redesign to better align contribution with benefit across layers.

Searching arXiv for recent and relevant papers on “layer free-riding” and adjacent usages. arXiv search query: "all:layer free-riding OR all:layer free riding" Layer free-riding denotes a family of phenomena in which value created in one layer, stage, or component of a system is exploited by another layer, stage, or component that does not provide a proportional contribution of its own. In the available literature, the term is used in several distinct but structurally related ways: later blocks in cumulative-goodness Forward-Forward networks inherit already-separated margins from earlier blocks; clients in federated learning benefit from a global model while avoiding local training or contribution cost; application-layer peer-to-peer traffic is repurposed to infer network-layer routing topology; peers attempt to obtain higher-quality enhancement layers in live streaming without earning them through contribution; voters exploit one issue to gain leverage in later issues; and two-layer evolutionary systems exhibit cross-layer feedback in which one layer can benefit from the other while reducing its own cooperative effort (Yousefiramandi, 7 May 2026, Lin et al., 2019, Sagduyu, 2022, Qin et al., 2013, Kushwaha et al., 2024, Lackner et al., 2023, Chen et al., 29 Jan 2026).

1. Domain-specific meanings of the term

The term is not used uniformly across all fields. In some papers it describes dishonest participation, as in federated learning clients that submit constructed model updates without local data. In others it names an optimization pathology, as in Forward-Forward training where later blocks receive diminished direct learning pressure because earlier blocks have already accumulated sufficient “goodness.” In peer-to-peer tomography it is not an attack at all, but a passive reuse of existing application-layer traffic to infer network-layer state. In multi-layer streaming and two-layer evolutionary games it denotes access to layered benefits without matching contribution. In multi-issue voting it refers to a manipulation in which a voter can “free-ride” on a popular outcome in one issue to receive increased consideration in other issues.

This variety indicates that layer free-riding is best understood as a structural relation rather than a single mechanism. A plausible unifying interpretation is that the relevant systems all couple benefits across layers or stages more tightly than they couple verifiable contribution, making it possible for one part of the system to inherit or appropriate value created elsewhere.

Domain	What is free-ridden	Representative papers
Forward-Forward training	Earlier blocks’ accumulated separation	(Yousefiramandi, 7 May 2026)
Federated learning	Global-model benefits and collaborative training rewards	(Lin et al., 2019, Sagduyu, 2022, Meng et al., 2024)
P2P tomography	Application-layer traffic used to infer network-layer topology	(Qin et al., 2013)
P2P live streaming	Enhancement layers and favorable overlay position	(Kushwaha et al., 2024, Kushwaha et al., 2024)
Multi-issue voting	Popular outcomes on one issue to gain later influence	(Lackner et al., 2023)
Two-layer evolutionary games	Cross-layer resource and cooperation feedback	(Chen et al., 29 Jan 2026)

2. Federated learning: dishonest participation, strategic non-contribution, and formation effects

In federated learning, free-riding was introduced as a security and incentive problem in which a client pretends to contribute to collaborative training while actually submitting constructed model updates rather than updates learned from local data. In the standard loop, the server broadcasts a global model $M_j$, clients compute local gradient updates $G_{i,j}$, and the server aggregates them as

$$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$

A free rider $C_i^f$ has no genuine local training data, or avoids compute or privacy cost, but still submits a plausible update to obtain rewards or access to the final model (Lin et al., 2019).

Three attacks were proposed. The random weights attack samples each entry uniformly from $[-R,R]$. The delta weights attack uses consecutive global models and submits

$$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$

The advanced delta weights attack adds Gaussian noise,

$$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$

with $\sigma=10^{-3}$ reported as a strong choice in the MNIST experiments. The paper emphasizes why these attacks are hard to detect: dimensional plausibility, statistical similarity to honest updates, small parameter changes in later rounds, and the fact that simple standard-deviation or angle checks can fail. A notable failure mode is that the Autoencoder detector often reconstructs random free-rider updates better than honest ones, causing misclassification as benign (Lin et al., 2019).

The same paper evaluates anomaly detectors and proposes STD-DAGMM, which augments DAGMM with a standard-deviation feature. The update is flattened, compressed into a latent vector $z_c$, and combined with three handcrafted statistics—standard deviation $z_{std}$, Euclidean reconstruction distance, and cosine reconstruction distance—before a GMM estimation network produces an energy score. In the experiment with 20 free riders among 100 clients, all using advanced delta weights with $G_{i,j}$0, DAGMM achieves AUC $G_{i,j}$1 at round 5 and $G_{i,j}$2 at round 80, whereas STD-DAGMM achieves AUC $G_{i,j}$3 at round 5 and $G_{i,j}$4 at round 80. Under client-level differential privacy with random subsampling, the same study reports that both DAGMM and STD-DAGMM detect all free riders because the attacker only observes more distant global models and the fabricated update becomes less like an honest one (Lin et al., 2019).

A different federated-learning literature treats free-riding as equilibrium behavior under explicit cost. In a NextG wireless setting, each spectrum sensor chooses whether to participate in FL model updates or to free-ride by skipping local training and uploading while still receiving the aggregated global model. The resulting non-cooperative game assigns each client a strategy $G_{i,j}$5, the probability of free-riding, and defines utility as reward minus participation cost. The central result is that the equilibrium free-riding probability increases with participation cost and with the number of clients; the paper reports a maximum optimality loss of 17.87% for two clients and 25.41% for three clients, both at $G_{i,j}$6 (Sagduyu, 2022).

A third line, set in a competitive market, models free-riding as reduced information contribution inside FL rather than complete non-participation. There the key result is asymmetrical: the lower-information firm always prefers FL because it can free ride, while the higher-information firm may reject FL when competition is intense or information asymmetry is large. Yet equilibrium contribution remains full under both standalone ML and FL, so the primary distortion lies in collaboration formation rather than contribution intensity once FL is formed (Meng et al., 2024).

Taken together, these results distinguish at least three federated-learning senses of free-riding: fabricated updates without data, strategic non-participation under cost, and participation under asymmetric benefit extraction. This suggests that “free-riding in FL” is not reducible to a single threat model.

3. Forward-Forward networks: cumulative-goodness free-riding as an optimization pathology

In Forward-Forward networks, layer free-riding is formalized as a failure mode in which later blocks do not learn their own discriminative features because earlier blocks have already accumulated enough “goodness” to separate the classes. For an example $G_{i,j}$7 and a negative hypothesis $G_{i,j}$8, the current-block margin at depth $G_{i,j}$9 is

$$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$0

while the cumulative margin used by the training loss is

$$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$1

with $$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$2 in the main cumulative setting, $$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$3 in LCFF, and $$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$4 in purely local FF. The loss is the softplus barrier

$$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$5

Because the derivative of the softplus decays as the cumulative margin becomes positive, the parameter-gradient reaching block $$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$6 is the local-gradient direction scaled by an attenuation factor $$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$7. The paper proves an exponential attenuation bound in the already-separated regime, so as earlier blocks accumulate larger positive margin, the direct discrimination gradient to deeper blocks decays exponentially (Yousefiramandi, 7 May 2026).

The paper distinguishes current-block and cumulative diagnostics. The current-block nonlinear separation is

$$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$8

the cumulative nonlinear separation is

$$M_{j+1} = M_j - \eta \cdot \frac{1}{n}\sum_{i=1}^n G_{i,j}.$$9

and the paper also uses depth-truncation accuracy $C_i^f$0, end-of-stage cumulative loss $C_i^f$1, and a clipped free-riding index $C_i^f$2. Layer health is diagnosed by a mismatch between low or collapsing current-block separation and near-saturated cumulative separation: if $C_i^f$3 is already high but $C_i^f$4 collapses in deeper blocks and the block discrimination loss goes to nearly zero, the later block is “free-riding” (Yousefiramandi, 7 May 2026).

Three local remedies are studied. The per-block / block-local variant sets $C_i^f$5 so the loss depends only on the current-block margin. Hardness-gated collaboration reduces the effective cumulative weight on examples that have already been well separated by earlier blocks. Depth-scaled current-block discrimination adds a local term

$C_i^f$6

with default values $C_i^f$7 and $C_i^f$8, giving block weights $C_i^f$9 for blocks 0–3. The residual example weights are proportional to $[-R,R]$0, so unresolved examples are emphasized while batch loss scale is preserved. The appendix theorem shows that this restores a gradient floor independent of upstream cumulative margin for unresolved examples (Yousefiramandi, 7 May 2026).

Empirically, the main result is sharply qualified. On CIFAR-10 and CIFAR-100, the remedies yield $[-R,R]$1–$[-R,R]$2 gains in deep-layer separation statistics, yet final accuracy changes by less than one percentage point for non-degenerate training procedures. On CIFAR-10 at $[-R,R]$3, $[-R,R]$4 is 3.28 for $[-R,R]$5, versus 0.61 for CP-FAIR and 0.64 for LCFF. On CIFAR-100, the deepest current-block separation is 4.78±0.03 for $[-R,R]$6, 1.71±0.01 for adaptive $[-R,R]$7, and 0.96±0.01 for cumulative $[-R,R]$8, while S1 and S2 TTA accuracies remain close across regimes. On Tiny ImageNet, $[-R,R]$9 remains much stronger than the cited SCFF baseline in top-1 accuracy, but current-block separation peaks at block 1 and then declines deeper. The paper’s conclusion is therefore that cumulative free-riding is real and repairable, but not the dominant factor limiting achievable accuracy under the studied FF training rules, architectures, and datasets (Yousefiramandi, 7 May 2026).

This use of the term differs from adversarial free-riding in FL. Here the “free rider” is a trainable block within the same model, and the pathology is induced by the objective itself rather than by strategic deception.

4. Peer-to-peer systems: cross-layer reuse, layered service access, and incentive control

A distinctive use of “free ride” appears in passive network tomography for peer-to-peer systems. The method takes a free ride over ordinary P2P data flows to infer network-layer routing topology from application-layer traffic, avoiding explicit probing packets and any cooperation from intermediate routers. For two receivers $$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$0 and $$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$1, if packets are sent in back-to-back pairs from sender $$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$2, the receive times satisfy

$$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$3

and after adjustment for constant packet spacing $$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$4, the paper shows that the correlation between path delays equals the correlation between adjusted arrival-time sequences. The sample estimator is

$$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$5

which the paper states is an unbiased estimator of the underlying delay correlation. In a real Internet testbed with 12 hosts across 5 universities using BitTorrent, the method achieves about 92% topology recovery accuracy with small packets such as 200 bytes; in OMNeT++ simulation with 200 nodes, 150 end hosts, and 50 routers, best accuracy is about 95%, and dynamic growth from 200 to 800 nodes reduces accuracy only from 95% to 89% (Qin et al., 2013).

In live streaming, the term becomes explicitly layered again. ReputeStream argues that a single-layer system gives every peer essentially the same stream quality and therefore weakens incentive enforcement, whereas a multi-layer design can tie quality to contribution. In this setting, layer free-riding means attempting to obtain higher-quality enhancement layers without earning them through upload bandwidth, forwarding, or other service. The system addresses this with dynamic reputation, request-to-join logic, and topological positioning of high-reputation peers near sources or significant contributors. Reputation is updated as

$$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$6

or, when multiple reports are aggregated,

$$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$7

The paper states that a larger $$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$8 is chosen because live streaming is time-sensitive and free riders should be identified quickly, and that the reputation layer stores three identical copies of reputation data across different peers (Kushwaha et al., 2024).

A closely related architecture also uses a reputation DHT, a tree-based overlay, and request-to-join selection, but notes an important limitation: all peers receive the same video quality regardless of contribution level, so the incentive is indirect and structural rather than fine-grained quality differentiation. There, a free rider’s reputation decays exponentially because $$G_{i,j}^f = M_{j-1} - M_j = \eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}.$$9, yielding

$$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$0

Peers with higher reputation replace lower-reputation children in the overlaid multicast tree, and the architecture maintains RT, NT, BRT, OMT, and BPT tables for routing, fallback, and churn recovery (Kushwaha et al., 2024).

The broader P2P literature treats free-riding as consuming without uploading, relaying, or hosting. Earlier work proposed trust systems that distinguish unwillingness to serve from lack of opportunity to serve, allowing newcomers to accumulate trust rather than be locked out by a cold-start deadlock; Q-learning schemes that exclude low-content neighbors from active routing and learn to route around free riders; and RL-based BitTorrent peer selection that cuts upload to free riders by 64%, improves high-capacity peers’ completion times by up to 33%, and reduces peer-selection fluctuations by 57% (0912.0985, Thampi et al., 2010, Thampi et al., 2010, Izhak-Ratzin et al., 2010, Gupta et al., 2013, Mishra, 2016).

One common misconception is that “free-riding” in networked systems is always an attack. The tomography paper shows a non-adversarial, measurement-oriented use of the idea, while live-streaming and file-sharing papers use it in the classical incentive sense.

5. Multi-layer games, multi-issue decisions, and networked public goods

In multi-issue voting, free-riding arises because fairness-oriented rules often track cumulative voter satisfaction across issues. A voter can untruthfully oppose a popular winner on one issue without changing that issue’s outcome, appear less satisfied, and then receive more favorable treatment in later issues. Formally, a voter $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$1 can free-ride on issues $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$2 if there exists an election $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$3 differing only in $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$4’s approvals on those issues such that the actual winner $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$5 remains unchanged for every $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$6, even though $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$7 withdraws approval of $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$8. The paper finds that the utilitarian rule is the only exception among the studied classes: it cannot be manipulated by free-riding because issues are decided independently. For almost every other OWA or Thiele rule, including sequential versions, free-riding is possible. The paper also stresses risk: under leximin, free-riding cannot reduce the manipulator’s satisfaction, but for most sequential Thiele rules and the sequential egalitarian rule it can backfire. In simulation with $$G_{i,j}^{f}=\eta \cdot \frac{1}{n}\sum_{x=1}^n G_{x,j-1}+N(0,\sigma),$$9, $\sigma=10^{-3}$0, and 4 candidates per issue, harmful free-riding risk is about 3.7% for sequential PAV and about 17.2% for sequential leximin (Lackner et al., 2023).

A different multi-layer setting is the two-layer shelter–victim network for post-disaster recovery. The upper layer consists of shelters on a scale-free network or a Beijing spatial network; the lower layer consists of victims on independent $\sigma=10^{-3}$1 lattices. Shelter $\sigma=10^{-3}$2 contributes

$\sigma=10^{-3}$3

and victim cooperation within shelter $\sigma=10^{-3}$4 is

$\sigma=10^{-3}$5

Shelter group utility is

$\sigma=10^{-3}$6

with shelter payoff depending on whether $\sigma=10^{-3}$7 exceeds threshold $\sigma=10^{-3}$8, and victim defector punishment

$\sigma=10^{-3}$9

depends on shelter contribution. The paper’s principal result is non-monotonicity: moderate public goods enhancement $z_c$0 and subsidy $z_c$1 promote cooperation, while excessive incentives induce free-riding; by contrast, credible punishment suppresses defection, with $z_c$2 the dominant factor, $z_c$3 secondary, and $z_c$4 supplementary. Targeted punishment of highly connected shelters outperforms random punishment, with diminishing returns beyond about 80% coverage in the random case (Chen et al., 29 Jan 2026).

In endogenous networks with local public goods, free riding appears as link formation itself. Each player allocates budget across links, a local public good, and a private good, and links are purchased precisely to free ride on others’ contributions. If player $z_c$5 sponsors a directed link to $z_c$6, $z_c$7 enjoys $z_c$8’s contribution, so local public-good consumption is

$z_c$9

The paper shows that in equilibrium large contributors link to each other, while others link to them, generating core-periphery or nested split graph structure. In large societies, the proportion of core players vanishes, so almost everyone is in the periphery. The welfare and inequality effects are conditional: free riding reduces inequality only when it is initially low; otherwise richer players benefit more because they can afford more links (Kinateder et al., 2021).

At a broader conceptual level, evolutionary game theory treats the free rider as the neutral reference point between altruism and parasitism. In that taxonomy, the standard altruist-versus-free-rider Prisoner’s Dilemma and the free-rider-versus-parasite Prisoner’s Dilemma are dynamically similar but conceptually different: one concerns costly benefit provision, the other the avoidance of damage. The same review reports that random exploration of altruism, free-riding, and parasitism can support coexistence without reciprocation, punishment, or reward strategies in a world with finite resources (Requejo-Martínez, 2013).

These papers show that layer free-riding is not limited to machine learning or communication networks. It also arises in sequential collective choice, cross-layer social cooperation, and endogenous network formation.

6. Detection, incentives, limitations, and unresolved questions

The main defense families differ by whether the problem is one of hidden contribution, attenuated training signal, or strategic participation. In federated learning, the dominant approach is anomaly detection on submitted updates. Autoencoders, DAGMM, and especially STD-DAGMM attempt to separate honest and fabricated updates using reconstruction error, Euclidean distance, cosine distance, standard deviation, and a GMM-based energy score. In cumulative-goodness Forward-Forward networks, the remedies are entirely local and do not rely on backpropagated gradients across blocks: block-local training, hardness-gated collaboration, and depth-scaled current-block discrimination restore strong blockwise separation while preserving the local-learning character of the method (Lin et al., 2019, Yousefiramandi, 7 May 2026).

In peer-to-peer systems, the primary defenses are reputational and architectural. Reputation decay, probabilistic allocation, join-time ranking based on contribution, RL-based unchoking, and Q-learning-based routing all seek to make future access contingent on past service. The literature is notable for often combining punishment with rehabilitation: low-performing nodes may be suspended or pushed downward in the overlay, but several systems explicitly allow them to recover rank by hosting files, relaying traffic, or otherwise improving observable contribution (Kushwaha et al., 2024, Kushwaha et al., 2024, Izhak-Ratzin et al., 2010, Thampi et al., 2010, Gupta et al., 2013).

In strategic games, defenses correspond to incentive design rather than anomaly detection. The NextG FL game suggests pricing-like mechanisms to reduce selfish behavior. The two-layer shelter–victim model emphasizes calibrated incentives, credible punishment, and structural targeting of hubs. The endogenous-network public-good model derives income redistribution that increases welfare and personalized prices that implement the efficient solution. In multi-issue voting, the utilitarian rule is the sole rule in the studied families that blocks free-riding by making issues independent (Sagduyu, 2022, Chen et al., 29 Jan 2026, Kinateder et al., 2021, Lackner et al., 2023).

Several limitations recur. The federated-learning attack-and-defense study is restricted to MNIST, a 2-layer fully connected neural network, and a setup in which the server can inspect individual updates; secure aggregation would make detection much harder. The Forward-Forward study shows that repairing layer health does not necessarily translate into materially higher accuracy, so free-riding can be a real pathology without being the dominant system bottleneck. The passive tomography method is sensitive to congestion and host-level timing noise, as shown by the drop to below 40% accuracy on PlanetLab under settings that worked well on the Internet testbed. Reputation systems depend on sufficiently honest reporting and can become more volatile when decay is made aggressive (Lin et al., 2019, Yousefiramandi, 7 May 2026, Qin et al., 2013, Kushwaha et al., 2024).

A further point of controversy concerns explanatory scope. In some literatures, the free-rider hypothesis is treated as a default explanation for weak collective action. Yet an empirical climate-policy study proposes a country-size test and finds no robust positive country-size effect in 2020 emission-weighted carbon prices, concluding that the free-rider hypothesis is not supported by that criterion and that other obstacles may matter more (Schmidt et al., 2022). This does not negate the engineering and game-theoretic literatures on layer free-riding, but it does caution against treating free-riding as a universal explanatory endpoint.

Across the surveyed work, the common analytical lesson is that layer free-riding emerges when layered systems separate benefit extraction from verifiable marginal contribution. What differs by domain is the observable object: gradient updates in federated learning, cumulative margins in Forward-Forward training, packet timing in P2P tomography, enhancement layers in live streaming, issue-by-issue approvals in voting, or cooperative payoffs in multi-layer games. The most effective responses therefore tend to be domain-specific, but they follow a shared logic: make contribution legible, make appropriation costly, or redesign the coupling between layers so that inherited benefit no longer suppresses local responsibility.