Why are clients more likely than servers to act as model downgrade attackers?

Clients are more likely to act as model downgrade attackers because they can benefit from sabotaging the training process, such as undermining the utility of the shared model for competing clients. Servers are less likely to do so because they typically gain no advantage from such actions.

In the spatial domain of federated learning, model downgrade attackers aim to degrade the overall performance of the trained model. Clients are more likely to take this role because sabotaging the training process can give them a competitive benefit by reducing the utility of the shared model for other clients. Servers, by contrast, generally do not gain anything from degrading the model, so they are less likely to engage in this kind of attack.