Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface

Adrita Rahman Tory; ABM Shawkat Ali; Md Abu Layek; Khondokar Fida Hasan

Source-linked AI summary

Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface

Adrita Rahman Tory, ABM Shawkat Ali, Md Abu Layek, Khondokar Fida Hasan

arXiv:2609.03420v1Sep 3, 2026cs.CRcs.AIcs.LG

TL;DR

Federated NIDS must jointly satisfy privacy, Byzantine robustness, and reliable coverage of imbalanced attack categories, yet prior work often treats these properties as independently composable. This paper studies their interaction using DP-SGD and coordinate-wise median on UNSW-NB15 under adversarial attacks, finding disproportionate rare-attack degradation, calibration effects, and a residual floor for ultra-rare classes.

Problem
Joint evidence on privacy, robustness, and rare-attack coverage in class-imbalanced federated NIDS remains limited, despite their simultaneous operational importance.
Method
The paper uses geometric indistinguishability to study DP-SGD with coordinate-wise median on UNSW-NB15 under label-flip and model-poisoning attacks.
Results
The joint use of privacy noise and robust aggregation disproportionately degrades rare-attack coverage relative to majority classes, with some collapse attributable to miscalibration.
Takeaways & Limitations
Privacy, robustness, and rare-attack coverage should be evaluated jointly rather than assumed to compose cleanly by default.
Takeaways & Limitations
Findings are limited by IID client partitioning, coordinate-wise median aggregation, exclusive reliance on UNSW-NB15, and incomplete evaluation of CMS.

Abstract

from arXiv · show

Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning attacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks relative to majority classes. We also show that part of the observed collapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after epsilon-dependent tuning. These findings motivate studying privacy, robustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy federated NIDS.

1 Introduction

Federated NIDS must balance privacy, adversarial robustness, and coverage of highly imbalanced attack categories. This paper examines how DP-SGD and robust aggregation may jointly obscure minority-class updates and degrade rare-attack detection.

Rare and novel attacks may be operationally important despite sparse traffic prevalence, while organizations observe only partial threat landscapes.
Federated learning shares model updates rather than raw data, but formal privacy requires DP-SGD because updates can leak sensitive training inputs.DP-SGD clips per-sample gradients and adds calibrated Gaussian noise, with a utility cost.
Robust aggregation filters statistically unusual updates, creating a potential conflict with sparse minority-class signals when privacy noise increases update dispersion.The paper frames this interaction at the aggregation interface through geometric indistinguishability.
The study evaluates UNSW-NB15 with DP-SGD and coordinate-wise median under label-flip and model-poisoning attacks.
Joint privacy and robustness constraints can disproportionately degrade rare-attack coverage, although some apparent collapse may reflect hyperparameter miscalibration.
The paper advocates evaluating privacy, adversarial robustness, and class-wise threat coverage together, with aggregation-aware modeling and sample-aware evaluation as future directions.

2 Related Works

Prior federated NIDS research generally evaluates privacy, robustness, and fairness separately. The paper positions joint evaluation of these dimensions in class-imbalanced federated intrusion detection as an underexplored gap.

Existing federated NIDS studies demonstrate collaborative intrusion detection across IoT, fog, enterprise, and UNSW-NB15 settings but treat key properties as independently composable.
DP-SGD provides formal (ϵ, δ)-privacy guarantees but imposes utility costs and can widen majority–minority performance gaps as privacy tightens.
Byzantine-robust rules such as coordinate-wise median, Krum, and Trimmed Mean filter poisoned or statistically unusual updates, but their interaction with class imbalance remains insufficiently studied.
The closest related work leaves joint evaluation across privacy, robustness, fairness, and federated NIDS unresolved.
Regulatory frameworks motivate simultaneous consideration of these dimensions but do not specify how to realize them together in a learning system.

3 Problem Formalization

The paper formalizes federated training with privacy-preserving client updates, Byzantine deviations, coordinate-wise median aggregation, and a geometric lens for minority-update attenuation. Geometric indistinguishability remains an interpretive hypothesis rather than a theorem.

3.1 Minimal System Model: Each client computes a local SGD update, transmits it to the server, and participates in an aggregation-based global model update.
3.1 Minimal System Model: The Byzantine model permits up to αN clients, with α < 0.5, to deviate arbitrarily and submit malicious updates.
3.2 Mechanisms: DP-SGD clips per-sample gradients to bound L2 sensitivity and injects calibrated Gaussian noise, expanding variance in transmitted updates.
3.2 Mechanisms: The noise multiplier σ_DP is calibrated for (ε, δ)-DP across T rounds, with larger privacy requirements reflected through its stated dependence on ε and log(1/δ).
3.3 Byzantine-Robust Aggregation: Coordinate-wise median outputs the median of each parameter coordinate across participating client updates, filtering coordinate-level outliers.
3.4 Geometric Indistinguishability: Geometric indistinguishability describes privacy-perturbed minority updates overlapping more strongly with adversarial updates, making minority signals harder to preserve.
3.4 Geometric Indistinguishability: The concept is used as an interpretive hypothesis, not a formal theorem or directly estimated decision rule.
3.4 Geometric Indistinguishability: The lens distinguishes calibration-driven collapse from persistent degradation that remains after ϵ-dependent tuning.

4 Empirical Validation of Geometric Indistinguishability

The evaluation uses UNSW-NB15 under severe class imbalance, with ten IID-partitioned clients and adversarial aggregation tests. It combines privacy calibration, poisoning scenarios, and class-wise fairness metrics to assess rare-attack coverage.

4.1 Dataset and Partitioning: UNSW-NB15 contains 175,341 samples, including rare Worms and Shellcode classes that represent severe inter-class imbalance.Worms account for 0.2% and Shellcode for 1.5% of the dataset.
4.1 Dataset and Partitioning: The federated setup uses 10 clients, IID partitioning, 20 communication rounds, and at least 8 participating clients.
4.1 Dataset and Partitioning: Rare attacks constitute less than 2% of traffic yet remain operationally critical, motivating sample-aware fairness evaluation.
4.2 Privacy and Training Configuration: Local class imbalance is mitigated with BCEWithLogitsLoss using positive class weighting, while DP-SGD uses gradient clipping and privacy-dependent learning-rate calibration.The calibration schedule addresses convergence instability caused by differential-privacy noise.
4.3 Adversarial Threat Model and Evaluation: Class-wise disparate impact is defined as the minimum-to-maximum detection-rate ratio across nine attack categories, with 0.8 as the fairness threshold.This metric focuses on the single worst-performing category rather than grouped minority and majority classes.
4.3 Adversarial Threat Model and Evaluation: The evaluation compares FedAvg, Krum, coordinate-wise median, and Trimmed Mean across clean, 20%, and 40% adversarial-client conditions.Coordinate-wise median is selected for subsequent evaluation because pre-validation reported only a 0.3% F1 drop under 40% pressure.

5 Results

The results show that privacy-induced collapse is partly a learning-rate calibration artifact, but stronger privacy still degrades fairness and leaves ultra-minority detection floors after calibration. These effects persist across adversarial settings and are configuration-specific rather than evidence of a universal privacy limit.

5.1 Original Collapse: The Problem Under Investigation: At ε = 1.0, static learning rate η = 0.05 produces near-total detection collapse, which later analysis identifies as a configuration artifact.The result motivates ε-dependent hyperparameter calibration before attributing collapse to privacy–robustness conflict.
5.2 Results After ε-Dependent Learning Rate Calibration: ε-dependent calibration restores F1 from 0.007 to 0.738 at ε = 1.0, but DIclass remains below 0.21 and the 0.8 fairness threshold.Across calibrated settings, F1 declines from 0.9537 without privacy to 0.7379 at ε = 1.0, while DIclass decreases from 0.750 to 0.205.
5.3 Persistent Detection Floor for Ultra-Minority Classes: At ε = 1.0, Worms detection stabilizes at 20% and Shellcode at 52.5% across evaluated scenarios after calibration.Worms has only five total samples, so its estimate is indicative rather than statistically robust.
5.3 Persistent Detection Floor for Ultra-Minority Classes: The persistent ultra-minority degradation is not explained solely by attack pressure or static-learning-rate miscalibration.Both classes recover at ε = 3.0, with Worms reaching 80–100% detection in the reported scenarios; the authors characterize the ε = 1.0 floor as configuration-specific.

6 Discussion

CMS improves selected precision and fairness outcomes under moderate privacy, but MLP can provide more consistent minority coverage. The results also indicate threshold-like degradation and distinguish calibration-related collapse from persistent ultra-rare-class limits.

Architectural Pre-conditioning: CMS achieves a 100% win rate on Shellcode at ϵ = 3.0, with a +6.5pp mean and +8.75pp maximum advantage.This corresponds to 5/5 scenarios.
Architectural Pre-conditioning: CMS records a 50% overall minority win rate at ϵ = 3.0, with 10/20 wins and no losses.
Architectural Pre-conditioning: CMS performs strongest in precision, with a 73% win rate, while MLP provides more consistent minority coverage.CMS has a 60% F1 win rate, whereas minority detection favors MLP with a 47% CMS win rate.
Operational Regime Classification: At ϵ = 1.0 with 40% label poisoning, CMS achieves a 3.3× fairness gain over MLP, 0.67 versus 0.41.At ϵ = 1.0 under clean and model-poisoning settings, both models fall below DIclass ≈ 0.20.
Operational Regime Classification: CMS advantages concentrate at moderate privacy and at the privacy-attack intersection, while benefits diminish at privacy extremes.Without privacy, CMS has a small clean-setting edge, but MLP wins 3/4 adversarial comparisons.
Threshold-Like Degradation at the Aggregation Interface: Rare-attack degradation appears threshold-like between 20% and 40% adversarial participation rather than smoothly declining.The interpretation is consistent with DP-SGD increasing minority-update dispersion, allowing robust aggregation to attenuate statistically atypical updates more strongly.
Threshold-Like Degradation at the Aggregation Interface: The reported degradation is empirical and configuration-specific, not a formally established phase transition.The studied combination of privacy noise, robust aggregation, and class imbalance can still produce sharp rare-attack coverage degradation.
Calibration and Persistent Minority Floors: Calibration eliminates collapse for Analysis and Backdoor, but a detection floor persists for Worms.This supports a distinction between training miscalibration and a sample-scarcity boundary under strong DP noise.

7 Limitations and Future Work

The study’s conclusions are bounded by its IID partitioning, single aggregation rule and benchmark, and preliminary CMS configuration. Future work calls for principled privacy calibration and aggregation that better distinguishes minority gradients from adversarial updates.

Limitations: IID client partitioning provides a conservative fairness baseline and may understate minority degradation in heterogeneous traffic.Real-world heterogeneous distributions would likely reduce minority gradient contributions further.
Limitations: Using coordinate-wise median limits immediate generalization to other Byzantine-robust aggregation rules.
Limitations: Results rely exclusively on UNSW-NB15, leaving feature-space generalization unvalidated.
Limitations: CMS evaluation uses a preliminary fixed configuration rather than an exhaustive hyperparameter search.
Future Work: Future work should derive principled relationships among ϵ, noise multipliers, and learning rates for privacy-preserving deployment.
Future Work: Fairness-constrained aggregation should distinguish privacy-perturbed minority gradients from adversarial outliers and be tested against adaptive adversaries and non-IID partitions.

8 Conclusion

This paper studies privacy, adversarial robustness, and rare-attack coverage jointly in class-imbalanced federated NIDS. Using DP-SGD and coordinate-wise median on UNSW-NB15, it finds initial evidence of disproportionate rare-attack degradation, while distinguishing calibration-related collapse from persistent ultra-rare-class fragility.

Conclusion: The study examines competing privacy, robustness, and rare-attack coverage requirements in federated NIDS.
Conclusion: The evaluation combines DP-SGD and coordinate-wise median on UNSW-NB15 under label-flip and model-poisoning attacks.
Conclusion: Joint privacy noise and robust aggregation provide initial evidence of disproportionately degraded rare-attack coverage relative to majority classes.
Conclusion: Strong-privacy collapse can partly arise from training miscalibration, while ultra-rare classes may retain a performance floor after ϵ-dependent tuning.
Conclusion: The findings are an initial empirical case study rather than a universal theorem.