Source-linked AI summary
Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface
Adrita Rahman Tory, ABM Shawkat Ali, Md Abu Layek, Khondokar Fida Hasan
TL;DR
How privacy and Byzantine-robust aggregation interact with rare-attack coverage in class-imbalanced federated intrusion detection remains underexamined. This paper studies that interaction on UNSW-NB15 using DP-SGD and coordinate-wise median under adversarial attacks, finding disproportionate rare-attack degradation and a residual detection floor for ultra-rare classes after tuning.
Problem
How privacy noise and Byzantine-robust aggregation interact with rare-attack coverage in class-imbalanced federated NIDS is underexamined, despite operational incentives for privacy-preserving collaboration.
Source: §1 · p. 2Method
The paper introduces geometric indistinguishability and evaluates DP-SGD with coordinate-wise median on UNSW-NB15 under label-flip and model-poisoning attacks, assessing coverage across attack categories.
Source: §1 · p. 3, §8 · p. 14Results
Joint privacy noise and robust aggregation disproportionately degraded rare-attack detection; miscalibration explained part of strong-privacy collapse, while an ultra-rare-class detection floor remained after ε-dependent tuning.
Source: §1 · p. 3, §8 · p. 14Takeaways & Limitations
Privacy, robustness, and rare-attack coverage should be evaluated jointly rather than treated as independent properties in federated NIDS.
Source: §1 · p. 3Evidence is limited to UNSW-NB15 and coordinate-wise median, leaving generalization across datasets and robust aggregation rules unvalidated.
Source: §7 · p. 13
Abstract
from arXiv · showhide
Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning attacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks relative to majority classes. We also show that part of the observed collapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after epsilon-dependent tuning. These findings motivate studying privacy, robustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy federated NIDS.
1 Introduction
The introduction argues that privacy noise and robust aggregation can jointly undermine rare-attack detection in federated NIDS. It presents initial evidence of this risk and calls for evaluating privacy, robustness, and threat coverage together.
1 Introduction
- Because organizations see partial threat landscapes while traffic metadata may be personal data, FL shares model updates rather than raw traffic but offers no formal privacy guarantee by default.Source: §1 · p. 2
- Geometric Indistinguishability frames how privacy-induced update dispersion can make robust aggregation suppress sparse minority-class signals.Privacy noise increases update dispersion, while robust aggregation filters statistically unusual updates at the server interface.Source: §1 · pp. 2–3
- Under strong privacy, part of the apparent collapse stems from training miscalibration, while an ultra-rare-class detection floor remains after ϵ-dependent tuning.Source: §1 · p. 3
- The paper argues that trustworthy federated NIDS should jointly evaluate privacy, adversarial robustness, and class-wise threat coverage, with aggregation-aware modeling and sample-aware evaluation as future directions.Source: §1 · p. 3
- UNSW-NB15 experiments with DP-SGD and coordinate-wise median under label-flip and model-poisoning attacks initially indicate disproportionate rare-attack degradation.The study assesses coverage across attack categories.Source: §1 · p. 3
2 Related Works
Prior work establishes the viability of federated intrusion detection but generally treats privacy, robustness, and fairness independently,,,. Their joint evaluation in class-imbalanced federated NIDS remains scarce, motivating this paper’s focus on the gap,.
2 Related Works
- Federated NIDS has been applied in IoT, fog, and enterprise settings,, with UNSW-NB15 multiclass viability demonstrated, but these works treat privacy, robustness, and fairness independently.Source: §2 · p. 3
- DP-SGD provides formal (ϵ, δ)-privacy guarantees, yet tighter privacy budgets widen majority–minority accuracy gaps, and hyperparameter retuning does not reliably resolve this disparity [8],.Source: §2 · pp. 3–4
- Coordinate-wise median, Krum, and Trimmed Mean filter poisoned updates, but uniform aggregation weights fail to protect minority gradients under label imbalance,,,.Class-imbalance attacks have also reduced minority accuracy to near-zero under state-of-the-art robust federated methods.Source: §2 · p. 4
- Joint evaluation of these properties in class-imbalanced federated NIDS remains scarce, and no prior work jointly addresses all four dimensions in that context.GDPR and the EU AI Act motivate the joint requirement but do not specify its realisation in a learning system; this paper addresses that gap.Source: §2 · p. 4
3 Problem Formalization
The section formalizes federated learning, privacy, and Byzantine-robust aggregation, then uses geometric indistinguishability to frame how privacy noise may make minority-attack updates harder to preserve. This is an interpretive hypothesis, not a formal theorem or estimated decision rule.
3.1 Minimal System Model
- The system uses N federated clients that compute local mini-batch SGD updates and transmit them for server aggregation.The server applies an aggregation function to client updates to produce the next model parameters.Source: §3.1 · pp. 4–5
- Up to αN clients, with α < 0.5, may deviate arbitrarily and submit malicious updates under the Byzantine threat model.Source: §3.1 · p. 5
3.2 Mechanisms
- DP-SGD clips per-sample gradients to bound L2 sensitivity and adds calibrated Gaussian noise, expanding variance in transmitted updates.The noise multiplier is calibrated to satisfy (ε, δ)-privacy across T rounds.Source: §3.2 · p. 5
3.3 Byzantine-Robust Aggregation
- The server uses coordinate-wise median aggregation, taking the element-wise median of client updates for each parameter coordinate.Source: §3.3 · p. 5
3.4 Geometric Indistinguishability
- Privacy-perturbed minority updates may overlap more with adversarial updates, making minority-class signals harder for robust aggregation to preserve.The paper presents geometric indistinguishability as an interpretive hypothesis rather than a formal theorem or directly estimated decision rule; prior work suggests privacy may disproportionately affect underrepresented classes and robust aggregation may attenuate atypical updates.Source: §3.4 · pp. 5–6
- The geometric-indistinguishability lens distinguishes calibration-driven collapse from persistent degradation in which rare-attack coverage remains fragile after ε-dependent tuning.The section presents this distinction as a way to interpret empirical results.Source: §3.4 · p. 6
4 Empirical Validation of Geometric Indistinguishability
The validation uses an IID, ten-client UNSW-NB15 setup to isolate privacy–robustness interactions, then evaluates DP-SGD and median aggregation against poisoning using class-wise detection disparities.
4.1 Dataset and Partitioning
- 175,341 UNSW-NB15 samples are split IID across ten clients; Worms account for 0.2% and Shellcode for 1.5%.IID sampling isolates the privacy–robustness interaction from client data heterogeneity and favors minority-gradient survival; rare attacks are described as critical security events despite representing under 2% of traffic,.Source: §4.1 · pp. 6–7
4.2 Federated Learning and Privacy Configuration
- The setup combines Opacus DP-SGD with gradient clipping and positive-weight BCE, calibrating learning rates downward for noise and inversely to σ.The paper says this schedule is intended to preserve gradient signal-to-noise ratio and convergence stability.Source: §4.2 · p. 7
4.3 Adversarial Threat Model and Evaluation
- Under 40% adversarial pressure, coordinate-wise median showed a 0.3% F1 drop in pre-validation and was used against label-flip and Gaussian update poisoning N(0, 5.0²).Class-wise fairness metrics were used to assess detection-rate disparities.Source: §4.3 · p. 7
- DIclass is the minimum-to-maximum detection-rate ratio across nine attack categories, with DIclass ≥ 0.8 as the fairness threshold.This per-class measure is more conservative than grouped minority/majority ratios because it reflects the single worst-performing category.Source: §4.3 · p. 7
5 Results
After ε-dependent calibration, detection remains functional, but no differentially private setting meets the class-fairness threshold. At ε = 1.0, ultra-minority classes retain a detection floor even after calibration.
5.1 Original Collapse: The Problem Under Investigation
- At ε = 1.0, static η = 0.05 produces near-total collapse: Exploits, DoS, and Reconnaissance fall below 40%, minorities approach zero, and DI fails to reach 0.8.Subsequent analysis identifies this collapse as a configuration artifact and says ε-dependent calibration is essential for valid evaluation.Source: §5.1 · pp. 8–9
5.2 Results After ϵ-Dependent Learning Rate Calibration
- F1 declines from 0.9537 at ε = ∞ to 0.7379 at ε = 1.0, while DIclass falls from 0.750 to 0.205; no private setting meets DIclass ≥ 0.8.Calibration restores utility compared with the static schedule, but fairness remains below threshold.Source: Figure 5 · p. 8, §5.2 · p. 9
- At ε = 3.0, DIclass is 0.516 in the clean private setting, 0.581 under 40% label flipping, and 0.509 under model poisoning.The authors describe privacy budget as the dominant degradation driver and characterize the pattern as threshold-like evidence, not a formally established phase transition.Source: §5.2 · p. 9
5.3 Persistent Detection Floor for Ultra-Minority Classes
- At ε = 1.0, Worms (n = 5) detection stabilizes at 20% and Shellcode (n = 80) at 52.5% across scenarios; at ε = 3.0, Worms reaches 80–100%.The floor persists across clean and adversarial scenarios, so it is not explained solely by attack pressure or static-schedule miscalibration; the authors describe it as configuration-specific, with Worms results indicative rather than statistically robust.Source: Figure 6 · p. 9, §5.3 · pp. 9–10
6 Discussion
Across the studied configurations, privacy noise and robust aggregation can sharply reduce rare-attack coverage; architectural pre-conditioning helps selectively, while calibration does not eliminate the ultra-rare-class floor.
6.1 Architectural Pre-conditioning: CMS vs. MLP
- At ϵ = 3.0, CMS won 5/5 Shellcode scenarios, but MLP favored minority detection with a 47% CMS win rate, making the architecture trade-off deployment-dependent.CMS had a 100% Shellcode win rate (5/5), with a +6.5pp mean and +8.75pp maximum advantage; CMS led in precision (73% win rate) and F1 (60%).Source: §6.1 · p. 11
6.2 Operational Regime Classification
- At ϵ = 1.0, both models fell below the fairness threshold under clean and model-poisoning settings (DIclass ≈ 0.20), while CMS reached 0.67 versus MLP’s 0.41 under 40% label poisoning.At ϵ = 3.0 CMS won all comparisons (5/5; maximum +0.044); without privacy it had a small clean-setting edge (∆ = +0.017), while MLP won 3/4 adversarial comparisons.Source: §6.2 · pp. 11–12
6.3 Threshold-Like Degradation at the Aggregation Interface
- Severe minority-class degradation appeared between 20% and 40% adversarial participation, consistent with—but not proof of—a configuration-specific geometric-indistinguishability effect.The proposed mechanism is that DP-SGD disperses honest minority updates, causing robust aggregation to attenuate them as statistically atypical; the paper does not claim a formally established phase transition.Source: §6.3 · p. 12
6.4 Regulatory Motivation and Joint Evaluation
- The paper treats privacy, robustness, and rare-attack coverage as technical dimensions for joint evaluation, not as a complete legal-compliance model.GDPR and the EU AI Act motivate these goals, but do not specify how to realize them jointly in a learning system.Source: §6.4 · p. 12
6.5 Insufficiency of Conventional Mitigations
- Conventional mitigations leave the geometric conflict unresolved: class-aware privacy budgets risk revealing rare-attack distributions, and SMOTE cannot prevent sparse, high-variance minority gradients from being rejected.Noise-adaptive thresholds assume non-adaptive adversaries, which may exploit expanded acceptance regions by mimicking privacy-perturbed minority gradients; data balancing does not change DP-SGD’s gradient geometry.Source: §6.5 · pp. 12–13
6.6 Artifactual vs. Fundamental Fairness Limits
- Calibration eliminates collapse for Analysis and Backdoor, but Worms (n = 5) remains below 20% detection, indicating a residual floor for ultra-rare classes.The passage attributes the remaining limit to the empirical signal-to-noise boundary induced by strong DP noise, even after hyperparameter calibration.Source: Figure 8 · p. 13, §6.6 · p. 13
7 Limitations and Future Work
The study’s fairness findings are limited by its IID partitioning, aggregation rule, benchmark, and preliminary CMS configuration. Future work should connect privacy settings to learning behavior, design fairness-aware aggregation, and evaluate fairness with sample-aware measures.
Limitations
- IID partitioning may understate fairness collapse; coordinate-wise median and UNSW-NB15 constrain generalization, while CMS evaluation uses a preliminary fixed configuration rather than exhaustive tuning.The authors characterize the IID result as a conservative baseline and note that heterogeneous traffic could further reduce minority-gradient contributions.Source: §7 · pp. 13–14
Future Work
- Future work should derive principled relationships among ε, noise multipliers, and learning rates to standardize privacy-preserving deployment protocols.Source: §7 · p. 14
- Fairness-constrained aggregation should distinguish privacy-perturbed minority gradients from adversarial outliers; CMS improves Jain Fairness Index over MLP baselines, but needs evaluation against adaptive adversaries and non-IID partitions.Source: §7 · p. 14
- Sample-aware fairness metrics are needed to separate detection gaps caused by sample scarcity from those caused by architectural failure.Source: §7 · p. 14
8 Conclusion
This initial UNSW-NB15 case study examines how privacy noise and robust aggregation interact with rare-attack coverage in class-imbalanced federated intrusion detection. It motivates evaluating privacy, robustness, and class-wise threat coverage jointly.
8 Conclusion
- Joint privacy noise and robust aggregation can disproportionately degrade rare-attack coverage relative to majority classes.The authors characterize this as initial empirical evidence, not a universal theorem.Source: §8 · p. 14
- Under strong privacy, apparent collapse can partly arise from training miscalibration, while degradation may persist for ultra-rare classes after ϵ-dependent tuning.The conclusion distinguishes a potentially correctable calibration effect from a more persistent degradation regime.Source: §8 · p. 14
- The paper introduces geometric indistinguishability to describe how privacy-perturbed minority updates may become harder for robust aggregation to preserve.The study uses DP-SGD and coordinate-wise median on UNSW-NB15 under label-flip and model-poisoning attacks.Source: §8 · p. 14
- The findings motivate joint evaluation of privacy, robustness, and class-wise threat coverage rather than treating them as independently composable properties.The authors identify aggregation-aware modeling, clearer privacy specification, and sample-aware evaluation as directions for trustworthy federated intrusion detection.Source: §8 · p. 14