How does a pool know work has been done I have not been able to find any method that pools use to verify you've done the work you say you did. So if someone does a solution withholding attack but without actually knowing what the solution is in a PPS pool then can't this attack just get free coins?
Miners submit shares to the pool to prove that work has been done. Shares are easier hashes than blocks (by default, one in 2^32 hashes will be a share), and there is no way to find shares without doing the work needed to find blocks. See also What is a share? Can I find it while mining solo, or only when pool mining?

However, a miner can do the work but still refuse to send valid blocks if he finds them. This is called block withholding and can be used in several attacks.