Source-linked AI summary
Reliable Federated TinyML Deployment for IoT Security
Younsoo Park, Seokhyoen Bae, Shasi Kumar Ramachandran Prabhu, Suman Saha, Peilong Li
TL;DR
The paper addresses the challenge of deploying privacy-preserving federated intrusion detection on resource-constrained IoT devices. It evaluates TinyML-oriented compression within federated training and reports improved attack recall with server-coordinated cosine scheduling, alongside reduced model size and inference latency.
Problem
Federated models can be too large and difficult to deploy on resource-constrained IoT devices, while TinyML systems often focus on inference rather than federated training.
Source: §1 · p. 1Method
The paper evaluates distillation, pruning, and quantization in a federated intrusion-detection pipeline, including a smaller distilled student, structured pruning, and optional quantization-aware fine-tuning.
Source: §1 · p. 2, §4.2 · p. 4Results
Attack Recall increases from 46.7% to 93.85% with server-coordinated cosine learning-rate scheduling, while the compression pipeline reduces model size by 12.28× and inference latency by 74.5% on ESP32-class hardware.
Source: §6 · p. 6Takeaways & Limitations
The results provide practical guidance for lightweight, privacy-preserving intrusion detection suited to federated TinyML deployment in IoT environments.
Source: §6 · p. 6
Abstract
from arXiv · showhide
The growing deployment of Internet of Things (IoT) devices has increased the need for privacy-preserving intrusion detection systems that operate directly on resource-constrained hardware. Federated Learning enables collaborative model training without sharing raw data, but conventional federated models are often too large and unstable for deployment on microcontroller-class devices. TinyML techniques enable compact neural networks but are typically designed for inference-only workloads. This work investigates combining Federated Learning with TinyML-based model compression for intrusion detection in IoT environments. We evaluate compression strategies including knowledge distillation, structured pruning, and quantization within a federated training pipeline. Preliminary results show that training stability plays a critical role in federated TinyML systems. In particular, server-coordinated cosine learning-rate scheduling improves Attack Recall from 46.7% to 93.85% while enabling substantial model compression and efficient edge deployment. These findings provide insights for designing lightweight and privacy preserving intrusion detection systems for IoT devices.
1 Introduction
The paper studies federated intrusion detection with TinyML-oriented compression for resource-constrained IoT devices. It identifies unstable training as a key challenge and reports a large recall improvement with server-coordinated cosine scheduling.
1 Introduction
- Federated Learning avoids sharing raw data, but IoT deployment is constrained by device memory, computation, energy, and the large models assumed in standard pipelines.These constraints motivate privacy-preserving detection that can run on resource-limited devices.Source: §1 · p. 1
- TinyML optimizes networks for microcontroller inference, but most systems are inference-only and integrating them with federated training remains challenging for intrusion detection.IDS models must also maintain high attack recall on IoT devices.Source: §1 · p. 1
- The study evaluates distillation, structured pruning, QAT, and PTQ within federated intrusion detection, and examines FGSM adversarial robustness.It analyzes effects on detection performance, training stability, and deployment feasibility.Source: §1 · p. 2
- Server-coordinated cosine learning-rate scheduling improves attack recall from 46.7% to 93.85%; the proposed compression pipeline significantly reduces model size and inference latency while preserving strong detection performance.Source: §1 · p. 2
2 Related Work
Related work describes federated learning and TinyML as relevant to IoT privacy and deployment constraints, while noting that their combination for intrusion detection remains insufficiently addressed. The paper evaluates compression and training strategies within that combined setting.
2 Related Work
- Federated Learning supports collaborative training without raw-data sharing [2], but IoT deployment faces communication overhead, client heterogeneity, and resource constraints [5].The paper frames these as practical challenges for running large models on constrained devices.Source: §2 · p. 2
- TinyML optimizes model size, memory, and latency for microcontrollers [6], while most existing systems focus on inference rather than federated training.The related-work passage calls for lightweight models and carefully designed pipelines to integrate the two.Source: §2 · p. 2
- Compression techniques for efficient deployment on constrained hardware include structured pruning, which removes redundant parameters; knowledge distillation, which transfers knowledge from large teachers to compact students; and quantization, which reduces precision [9].QAT and PTQ are commonly used to convert floating-point models into efficient integer representations.Source: §2 · p. 2
- Prior IDS work often assumes centralized training and resource-rich environments, while adversarial robustness is evaluated with methods such as FGSM and PGD [11].Few studies jointly address federated learning, TinyML deployment constraints, and IoT intrusion detection.Source: §2 · p. 2
3 Approach
The approach targets high intrusion-detection performance with compact models for constrained IoT devices. It combines a federated training baseline with compression experiments and selects deployment configurations according to efficiency and performance trade-offs.
3 Approach
- The approach targets maintaining intrusion-detection performance while minimizing model size for deployment on resource-constrained IoT devices.This objective frames the training and compression choices that follow.Source: §3 · p. 2
3.1 Federated Training Baseline
- Edge devices locally train an intrusion-detection model and send updates to a central server for aggregation and redistribution; focal loss addresses class imbalance, and cosine learning-rate decay stabilizes training.The baseline runs for 80 federated communication rounds before compression, using α = 0.7 and γ = 2.0 for focal loss.Source: §3.1 · p. 3
3.2 Model Compression Experiments
- Compression experiments evaluate knowledge distillation and structured pruning, with configurations compared for detection accuracy and model efficiency.The described final pipeline includes BatchNorm folding, distillation, pruning, and optional quantization-aware fine-tuning before TFLite INT8 conversion.Source: §3.2 · p. 3
3.3 Model Selection for Deployment
- Four representative configurations span compression and accuracy trade-offs, allowing model choice to reflect device constraints.The most-compressed option targets highly constrained devices, while balanced or accuracy-oriented options suit more capable devices.Source: §3.3 · p. 3
4 Experimental Results
Experiments evaluate federated TinyML intrusion detection on CIC-IDS2017, spanning training stability, model compression, and quantization strategies. Stabilized training improves attack recall, while compression reduces model size and inference latency; QAT’s benefits vary with compression level.
4 Experimental Results
- The experimental section examines training stability, compression efficiency, quantization strategies, and deployment reliability in federated TinyML intrusion detection.The compression study evaluates 48 configurations combining FL QAT, distillation choices, structured pruning choices, and optional post-training quantization.Source: §4 · p. 3, §4.5 · p. 5
4.1 Experimental Setup
- Experiments used CIC-IDS2017 with four federated clients and focal loss; the data used stratified 80:20 train/test splitting and training-set majority-class undersampling.Each client trained locally, and the server aggregated updates using FedAvgM with cosine learning-rate decay; Bot-IoT and TON IoT were excluded due to extreme class imbalance.Source: §4 · p. 3, §4.1 · p. 4
4.2 Compression Pipeline
- The multi-stage pipeline reduced model size from 0.78 MB to 0.0635 MB and latency from 1.89 ms to 0.48 ms.It folds BatchNorm, distills a student with 50% of the original parameters, prunes low-importance Dense-layer neurons, and optionally applies QAT fine-tuning for INT8 deployment.Source: §4.2 · p. 4
4.3 Training Stability and Detection Performance
- Focal loss and server-coordinated cosine decay raised CIC-IDS2017 attack recall from 46.7% to 93.85%, maintained high overall accuracy, and eliminated divergence seen with fixed learning rates.Focal loss emphasizes hard attack examples, while cosine decay anneals the global learning rate over federated communication rounds.Source: §4.3 · p. 4
4.4 Detection Performance
- After server-coordinated cosine learning-rate decay, detection reached 96.02% accuracy, 89.32% F1-score, and 93.85% attack recall.The baseline had unstable convergence and 46.7% attack recall; the reported improvement is attributed primarily to stabilized training, while compression reduces size and latency while preserving detection performance.Source: Table 1 · p. 5, §4.4 · p. 5
4.5 Compression and Quantization Analysis
- Under moderate compression (~38 KB), no-QAT achieved 99.16% accuracy and 97.60% F1; under extreme compression (~14 KB), QAT led with 95.81% accuracy and 86.66% F1, reversing the trend.Source: §4.5 · p. 5
5 Future Work
Future work proposes reducing communication overhead, extending robustness evaluation, and validating the pipeline on microcontroller-class hardware.
Dynamic Communication and Adaptive Aggregation
- Selective client participation and asynchronous aggregation are proposed to reduce communication overhead and handle heterogeneous IoT network conditions.The proposed participation strategy transmits updates only from devices with significant updates.Source: §5 · p. 6
Adversarial Robustness and Training Strategies
- Future work will add adversarial training and evaluate robustness under stronger attacks such as PGD, examining trade-offs among compression, detection performance, and robustness.Source: §5 · p. 6
Real-World Deployment on Microcontrollers
- The pipeline will be validated end-to-end on microcontroller-class devices such as ESP32 using TensorFlow Lite for Microcontrollers.Planned measurements include on-device inference latency, memory use, and energy consumption under real-world hardware constraints.Source: §5 · p. 6
6 Conclusion
The conclusion reports that stabilizing federated training improves attack recall, while compression supports more efficient edge deployment. It also finds that QAT’s effectiveness depends on the compression regime.
6 Conclusion
- Server-coordinated cosine scheduling increased Attack Recall from 46.7% to 93.85%, and the compression pipeline reduced model size 12.28× and inference latency 74.5% on ESP32-class hardware while preserving detection accuracy.Source: §6 · p. 6
- Full-precision training performed better under moderate compression, whereas QAT became important under aggressive compression.The authors describe these findings as practical guidance for lightweight, privacy-preserving intrusion detection in federated TinyML IoT settings.Source: §6 · p. 6