You can't, not effectively. This ain't necessarily a federation problem though, centralised social media has the same problem. You can do the same on Reddit.
That's not to say there aren't things that can be done. Instances can agree to implement shared banlists that include known-abusive IPs or, if an abusive user has a habit of using a pattern in their evasion usernames, you can use a Regex to hunt them out.