Federated learning (FL) is a widely studied framework for privacy-preserving collaborative training among multiple clients. However, real-world deployments reveal a persistent challenge: free-riders, i.e., participants who benefit from the system without contributing meaningful updates. If not properly addressed, free-riders can discourage honest contributors and ultimately impair both the fairness and efficiency of FL ecosystems. Existing defenses mainly rely on post-hoc per-client, per-round evaluation, leading to limited deterrence and high resource overhead, particularly in large-scale deployments. To tackle these problems, we propose FLET, a novel federated learning framework with test tasks. FLET introduces dedicated test tasks into the training process, blending them with real FL tasks while concealing their types from participants. These test tasks, generated from the reference datasets, serve as decoys that enable accurate detection of free-riding behavior. To enforce accountability, an economic penalty mechanism is employed, achieving both proactive (ex-ante) deterrence and reactive (expost) detection.We analyze the interactions between the server and participants through a free-riding suppression game model with asymmetric information (i.e.,task type), and develop a strategic information disclosure scheme (i.e.,revealing task requirements) to mislead attackers and proactively shape participant behavior. We characterize both pure-strategy and mixed-strategy perfect Bayesian Nash equilibria, and propose a lightweight strateg-ymaking algorithm that guides players toward equilibrium strategies under different conditions with modest overhead. Extensive experiments validate that FLET effectively suppresses free-riding and enhances the utility of both the server and participants. Our findings provide insights for designing cost-effective free-riding defenses in practical FL.

By interacting, synchronizing, and cooperating with its physical counterpart in real time, digital twin (DT) is promised to promote an intelligent, predictive, and optimized modern city. Via interconnecting massive physical entities and their virtual twins with inter-twin and intra-twin communications, the Internet of DTs (IoDT) enables free data exchange, dynamic mission cooperation, and efficient information aggregation for composite insights across vast physical/virtual entities. However, as IoDT incorporates various cutting-edge technologies to spawn the new ecology, severe known/unknown security flaws, and privacy invasions of IoDT hinder its wide deployment. Besides, the intrinsic characteristics of IoDT, such as decentralized structure, information-centric routing, and semantic communications, entail critical challenges for security service provisioning in IoDT. To this end, this article presents an in-depth review of the IoDT with respect to system architecture, enabling technologies, and security/privacy issues. Specifically, we first explore a novel distributed IoDT architecture with cyber–physical interactions and discuss its key characteristics and communication modes. Afterward, we investigate the taxonomy of security and privacy threats in IoDT, discuss the key research challenges, and review the state-of-the-art defense approaches. Finally, we point out the new trends and open research directions related to IoDT.

Federated learning (FL) as a privacy-preserving machine learning (ML) algorithm provides an efficient distributed training paradigm. Existing FL frameworks still suffer from privacy leakage hazards such as membership inference attacks. The current popular defense approaches are mainly based on differential privacy (DP) strategy. However, privacy preservation is undertaken with an inevitable loss of model utility in DP. As a result, it performs miserably in practical deployments. To solve this problem, we modify the FL framework through the information bottleneck (IB) method to attain a trade-off between privacy protection and model utility. Firstly, we adapt the training process on client side by applying IB in the local training. It is intended to squeeze out privacy through the bottleneck. Secondly, we further modify the training process on server side. A validation process is used to evaluate whether the IB-based local training is squeezing out privacy. Clients that extrude the right information will occupy an important place in aggregation phase. Extensive experiments on classic datasets demonstrate the superiority of the proposed scheme in terms of privacy preservation and model utility.