PaperlayerView exact revision on arXiv

Source-linked AI summary

Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure

Jeff Nijsse, Shu Su, Benjamin Oholeguy, Sreenivas Sremath Tirumala

arXiv:2609.34804v1cs.CRcs.LG

TL;DR

Federated learning can pool information for industrial intrusion detectors while keeping telemetry local, but update-space defenses do not inspect the data behind client updates. This paper admits batches using mined process invariants and evaluates the gate across water testbeds and a distribution benchmark. The gate reduces targeted-recall damage from replay and fabricated telemetry, and clients can prove invariant compliance without revealing telemetry.

  • Problem

    Federated aggregation protects local telemetry from coordinator inspection, but update-space defenses cannot distinguish updates derived from fabricated telemetry.

    Source: §2.4 · p. 7

  • Method

    The paper uses automatically mined process invariants as pre-aggregation admission requirements and demonstrates zero-knowledge proofs of batch compliance.

    Source: §1 · p. 4, §3.2.2 · p. 10

  • Results

    Across five aggregation rules, the gate eliminates 69–100% of targeted recall degradation from replay poisoning and 54–100% from fabrication.

    Source: §1 · p. 4

  • Takeaways & Limitations

    The work establishes process physics as a privacy-preserving admission gate for federated intrusion detection in critical water infrastructure.

    Source: §7 · p. 25

    The reported damage removal applies to covered attacks; replayed sequences that obey the invariant set and successfully projected batches can evade the defenses.

    Source: §6.4 · p. 24

Abstract

from arXiv · show

Federated learning enables industrial operators to train shared intrusion detection models without disclosing proprietary operational telemetry. However, existing defenses operate strictly in update space, leaving aggregators blind to data poisoning; model updates derived from fabricated telemetry remain indistinguishable from honest contributions. We repurpose cyber-physical process invariants, such as conservation laws and actuator couplings, from runtime detection heuristics into a verifiable admission requirement for federated updates, mined automatically from clean operational data. We evaluate this admission gate across two physical water testbeds (SWaT, WADI) and a distribution benchmark (BATADAL), testing seven aggregation rules against telemetry fabrication, exposure-only replay poisoning, and an invariant-aware adaptive adversary. Across three testbeds the mined invariants reject none of 100 honest shards and all naively fabricated ones, including optimised perturbations that FoolsGold admits in full. On real telemetry, five mined invariants detect 12 of SWaT's 35 attacks, while nine invariants detect 20, with no honest shard rejected. With nine rules, the physics gate recovers 69--100% of the targeted-attack recall lost to replay poisoning, and 54--100% of that lost to fabricated telemetry, across five standard aggregators. To reconcile physical admission control with federated data privacy, we show invariant compliance using zero-knowledge proofs (zk-SNARKs) to allow clients to prove batch adherence without revealing operational telemetry.

1 Introduction

Federated learning can help address scarce local training data, but update-space defenses cannot distinguish updates derived from fabricated telemetry. This paper uses mined process invariants as a pre-aggregation admission gate and evaluates its robustness and zero-knowledge verification.

1 Introduction

  • The gate turns physical process invariants into a requirement that each local training batch satisfy before its update is accepted into a federated round.Affine constraints reduce verification to bounded range checks that can be proved in zero-knowledge without disclosing raw telemetry.Source: §1 · p. 3
  • Mined affine process invariants reject every synthetic fabrication breaking cross-channel relations while producing zero false rejections across 100 honest client shards.The evaluation covers SWaT, WADI, and BATADAL.Source: §1 · p. 3
  • Across seven aggregation rules, four admit physics-violating fabrications at 73–100%, while the data gate rejects every fabrication and admits every update-space attack.An optimised perturbation is admitted in full by FoolsGold.Source: §1 · p. 4
  • 69–100% of targeted recall degradation from replay poisoning and 54–100% from fabrication is eliminated across five aggregation rules.The gate is evaluated against an adaptive adversary that projects corrupted batches back onto the invariants.Source: §1 · p. 4
  • PA-FL Lite lets clients prove batch invariant compliance over sampled rows without disclosing operational telemetry.The paper constructs and benchmarks a succinct zero-knowledge attestation protocol.Source: §1 · p. 4

2 Background

The background covers update-space aggregation, physics-based monitoring, and cryptographic verification, noting that none of these regimes verifies the physical provenance of local training data. It then situates the proposed admission gate among operational testbeds and existing detectors.

2.1 Byzantine-Robust Aggregation and Evasion in Federated Learning

  • Robust aggregation rules inspect update-vector geometry, but adversaries can optimize perturbations to evade these filters, and the rules do not constrain the underlying training telemetry.Table 1 summarizes representative mechanisms and their key robustness assumptions.Source: §2.1 · pp. 4–5, Table 1 · p. 5

2.2 Physics-Based Anomaly Detection in Industrial Control Systems

  • Process invariants encode relationships across monitored channels, but their defensive coverage is bounded by sensor instrumentation and cannot detect attacks that do not violate instrumented laws.The paper repurposes invariants as pre-aggregation requirements for federated training batches rather than online alarm rules.Source: §2.2 · p. 6

2.3 Cryptographic Verification in Federated Learning

  • Existing cryptographic FL methods verify hidden update properties or aggregation integrity, while no cited scheme verifies whether local training data represents physically valid telemetry.End-to-end training verification is described as computationally prohibitive.Source: §2.3 · p. 6

2.4 Operational Testbeds and Baseline Detectors

  • Established testbeds and autoencoder baselines support centralized intrusion detection, but had not been studied with physics-based admission checks and coordinated data-poisoning attacks.The described testbeds include SWaT, WADI, BATADAL, and HAI.Source: §2.4 · p. 7
  • The three regimes—robust aggregation, physics-based monitoring, and cryptographic FL—trust training-data provenance, leaving poisoned telemetry unchecked when its update resembles normal client variation.The paper addresses this gap with a process-physics admission gate before aggregation.Source: §2.4 · p. 7

3 Methodology: Physics-Attested Admission

The method places a physics-based admission gate on each participant’s training batch before aggregation, using process invariants mined from clean plant telemetry. It tests naive and physics-aware poisoning and uses zero-knowledge proofs so clients can attest to batch compliance without disclosing raw telemetry.

3.1 System Model and Threat Framework

  • Ten facilities train synchronously, with a data-space gate checking participant batches before their updates reach aggregation.The headline threat model has three compromised facilities among ten, and the attacker knows the full invariant set and tolerances.Source: §3.1 · pp. 7–8, Figure 2 · p. 8

3.2 Process Invariants and the Admission Gate

  • Two affine invariant families encode actuator-to-flow coupling and tank mass balance, with switching-transition rows excluded from coupling checks.The mass balance relates changes in tank level to net flow through boundary pipes.Source: §3.2 · pp. 8–9

3.2.1 Automated Invariant Mining and Calibration

  • Invariants are mined from uncorrupted calibration data: actuator states partition flow distributions, while sparse regression identifies tank balances with R2 ≥0.60.Operational tolerances are calibrated on clean holdout telemetry using the empirical 99.9th percentile of absolute residuals.Source: §3.2.1 · pp. 9–10

3.2.2 Batch Admission Criterion

  • A candidate batch is admitted only if no more than 1% of its rows violate at least one applicable invariant.The evaluated SWaT configurations use five narrow or nine wide rules; an attack is covered when its batch violation rate exceeds the threshold.Source: §3.2.2 · p. 10

3.3 Attack Formulations and Threat Vectors

  • The gate is tested against data-space telemetry corruption and update-space parameter alterations, including replay, fabrication, and an invariant-aware attacker.The adaptive attacker projects corrupted data onto the invariant-feasible subspace while holding discrete actuator channels fixed and perturbing continuous sensor readings.Source: §3.3 · pp. 10–11, §3.3.1 · p. 11

3.4 Zero-Knowledge Verification Architecture (PA-FL Lite)

  • PA-FL Lite uses Groth16 zk-SNARKs and Poseidon commitments to verify sampled batch adherence without revealing raw telemetry.The client proves compliance for 32 pseudorandomly sampled rows; unproven or non-compliant batches are excluded before aggregation.Source: §3.4 · p. 11

4 Experimental Setup

The experiments evaluate federated anomaly detection across four industrial records, using controlled client shards, standard reconstruction autoencoders, and seven aggregation rules. Five execution modes and targeted-attack recall metrics support comparison of poisoning damage and admission-gate behavior.

4 Experimental Setup

  • 1,120 trained federations across four industrial records form the experimental grid.Headline configurations use five random seeds; secondary sweeps use three.Source: §4 · p. 12

4.1 Benchmark Records and Preprocessing

  • SWaT and WADI are downsampled to five-second strides, while BATADAL retains 365 days of hourly telemetry and HAI serves as a non-hydraulic negative control.The records yield 35 SWaT and 14 WADI attack segments; SWaT AIT channels are excluded because of severe electrochemical drift.Source: §4.1 · p. 12

4.2 Federation Partitioning and Threat Synthesis

  • Normal telemetry is temporally divided into invariant discovery (30%), validation (15%), server root (5%), and ten disjoint client shards (50%), with attacks held out for global evaluation.Compromised clients splice attack segments across 25% of shard rows and oversample attack windows to 50% of local batches.Source: §4.2 · p. 12, Figure 4 · p. 13

4.3 Local Detector Architecture and Training Setup

  • Each facility trains an unsupervised reconstruction autoencoder on ten-step telemetry windows, using a 24-dimensional latent bottleneck and a clean-validation error threshold for alarms.Federated training runs for 25 rounds with two local epochs per round; a full run takes under 22 seconds on commodity hardware.Source: §4.3 · p. 13

4.4 Baseline Aggregation Rules

  • Seven aggregation rules span FedAvg, coordinate-wise estimators, geometric filters, FLTrust, and FoolsGold.Median and Trimmed Mean are coordinate-wise estimators; Norm Clipping and Krum are geometric filters.Source: §4.4 · p. 14

4.5 Federated Execution Modes and Evaluation Metrics

  • Five execution modes compare clean training, an honest-only reference, ungated naive poisoning, ungated invariant-projected attacks, and gated admission.Gated training excludes batches that breach the admission criterion before aggregation.Source: §4.5 · p. 14
  • Targeted-Attack Recall is primary because targeted attacks comprise under 12% of SWaT test rows, making macro F1 insensitive to some targeted detection failures.The evaluation also reports damage-weighted removal, untargeted recall, clean global F1, AUC-PR, and gate admission rates.Source: §4.5 · p. 14

4.6 Verification Protocols and Reproducibility

  • Verification uses a separation protocol on clean and fabricated telemetry and a coverage audit of all SWaT and WADI attacks.The separation protocol evaluates 200 random 1,000-row batches per record; the coverage audit scores 35 SWaT and 14 WADI attacks against narrow and wide invariant sets.Source: §4.6 · pp. 14–15

5 Results

The physics gate distinguishes honest telemetry from fabricated data and removes much of the targeted poisoning damage that update-space defenses miss. Its effectiveness depends on physical coverage, and zero-knowledge proofs offer a way to verify compliance without disclosing telemetry.

5.1 Vulnerability of Robust Aggregation to Data-Space Poisoning

  • Across SWaT, WADI, and BATADAL, no honest shards were rejected, while fabricated channel rolls, permutations, and conservation-scaled batches violated physical constraints.The highest honest single-shard violation rate was 0.51%, below the 1% gate; fabricated attacks produced violation rates of 22.2%–99.0%.Source: §5.1 · pp. 15–16, Figure 5 · p. 15

5.1.2 Evasion of Robust Aggregation Rules

  • FedAvg data-space attacks reduced targeted recall by 6.0–8.6 points while global F1 did not fall; update-space defenses failed across four data-space attacks.FoolsGold admitted 100% of optimised-perturbation updates, while Krum admitted none but showed a uniform 9.2-point drop attributed to selection variance.Source: §5.1.1 · p. 16, §5.1.2 · pp. 16–17

5.2.1 Narrow vs. Wide Attack Coverage

  • Relaxed mining added multi-stage balances that flagged the ultrafiltration backwash drain in 89% of rows, while WADI’s seven couplings covered 3 of 14 attacks.The relaxed SWaT set raised honest violation rates to 0.36%, below the 1% threshold; WADI had no reliable mass balances because of unmetered demand loops.Source: §5.2.1 · p. 18, Table 4 · p. 18, Figure 7 · p. 18

5.2.2 Poison Damage Removal across Aggregation Rules

  • Invariant projection alone removed only 11%–42% of replay damage under coordinate rules, and 40% of projected batches remained admissible to the gate.The projection distorted sensor readings around fixed discrete actuator states but did not prevent the model from learning the attack.Source: §5.2.2 · p. 19, Table 5 · p. 19
  • 71% of naive replay damage and 92% of channel-roll damage were removed under FedAvg; coordinate estimators removed 89%–104% of replay damage.The gate removed 69% of replay damage and 54% of channel-roll damage under FLTrust; Krum and FoolsGold had too few informative seeds for a ratio.Source: §5.2.2 · p. 19, Figure 8 · p. 20

5.2.3 Invariant Coverage Bounds What the Gate Removes

  • Under the wide set, the gate admitted 40% of projected batches, excluded an average of 1.8 of 3 malicious clients per round, and removed 69%–100% of replay damage.The narrow set admitted 80% of batches, excluded 0.6 malicious clients per round on average, and removed 8%–35% of replay damage across coordinate estimators.Source: §5.2.3 · p. 20, Figure 9 · p. 21

5.2.4 Structural Defense Complementarity

  • The gate rejected all batches in the four data-space attacks, whereas update-space attacks on honest telemetry passed the physics check and required aggregation defenses.Among the tested rules, FLTrust held every update attack to 1.5 points or less; FedAvg lost 7.1 and 8.8 points to sign flipping and scaling, respectively.Source: §5.2.4 · p. 21

5.3 Zero-Knowledge Verification Feasibility

  • At k = 32, proof verification took 290 ms with an 806-byte proof; honest batches passed with 98.51% probability, while unconstrained attacks were rejected with 99.8% certainty.Local proof generation required 12.0 seconds and 3.8 GB peak RAM; adaptive projection lowered violations enough to pass verification but removed only part of the poisoning damage.Source: §5.3.1 · p. 22, §5.3.2 · p. 22

6 Discussion

The discussion explains why data-space admission complements update-space aggregation, how physical coverage bounds protection, and how zero-knowledge proofs support private verification. It also identifies limits in adversary coverage, proof guarantees, and evaluation scope.

6.1 Why Are Update-Space Defences Blind to Poisoned Data?

  • Update-space rules cannot identify poisoned training data from parameter vectors, so the admission gate checks batches before local training while aggregation rules check updates afterward.The two defences address distinct threat spaces; process invariants provide a data-grounded anchor without requiring the coordinator to see sensitive telemetry.Source: §6.1 · pp. 22–23

6.2 How Much Protection Does Process Physics Actually Provide?

  • The gate’s protection is bounded by instrumentation: it covers measured operational states, with limited protection on unmetered demand loops and none for continuously positioned valves lacking active switching.A rejection is interpretable as a violated invariant, such as impossible negative pump flow.Source: §6.2 · p. 23
  • 69%–100% of targeted poisoning damage is eliminated across evaluated aggregation rules on coupled, metered balances, but unmonitored dynamics remain unprotected.The gate works through batch exclusion rather than projection neutralising the poisoning payload; its coverage can be configured before training.Source: §6.2 · pp. 23–24

6.3 Can We Verify the Data Without Seeing It?

  • Zero-knowledge attestation lets clients prove batch compliance with physical predicates without revealing sensor readings, offering an intermediary while full proof-of-training remains computationally prohibitive.PA-FL Lite moves the proved statement to local training data; the cited discussion describes physical-predicate compliance as a compact, well-defined statement.Source: §6.3 · p. 24

6.4 Limitations

  • The experiments simplify complex systems, and replayed invariant-compliant sequences, regime-spliced data, and projected batches can evade defences.The authors leave open how much poisoning survives when an adversary jointly optimises against physical invariants and server filters.Source: §6.4 · p. 24
  • PA-FL Lite does not establish that an update was computed only from its committed batch; fixed-point equivalence is argued, not proven, and public coefficients disclose aspects of plant topology.Evaluation relies on testbeds and simulated distribution networks governed by mass conservation; broader settings and live facilities remain future work.Source: §6.4 · p. 25

7 Conclusions

The conclusion presents process physics as a privacy-preserving admission gate for federated intrusion detection in critical water infrastructure. It reports protection against replay poisoning and a zk-SNARK check for batch compliance.

7 Conclusions

  • Across physical SWaT and WADI records, mined invariants admit all honest shards while neutralising targeted damage from historical attack replay, including when adversaries know the invariant set.Operators can adjust narrow or wide rule sets to configure coverage boundaries before training; the zk-SNARK check proves batch compliance in seconds on clients and verifies in milliseconds at the coordinator.Source: §7 · p. 25

Funding

The paper reports no external funding or conflicts of interest. It provides access information for the datasets and publicly releases supporting code and experimental materials.

Funding

Data Availability

  • SWaT and WADI data require a formal academic request, while BATADAL and HAI datasets are publicly accessible.The source code, invariant-mining scripts, verification circuits, tests, and raw evaluation results are publicly available.Source: Data Availability · pp. 25–26

Conflicts of Interest

A Data Preparation and Verification Protocols

The appendix documents channel handling for the physical testbeds and the protocols used to verify invariant sets before federated training.

A.1 Testbed Channel Handling

  • SWaT analyser channels were excluded from detector training and invariant mining because drift and a scaler fault impaired clean detector performance.Excluding AIT channels and flooring the scaler raised clean F1 from 0.27 to 0.756.Source: §A.1 · p. 26
  • Four entirely empty WADI historian channels were dropped, and short gaps in some analyser channels were filled from neighbouring rows.Source: §A.1 · p. 26

A.2 Separation Protocol

The separation protocol tests whether mined invariants distinguish honest telemetry from fabricated batches, while the coverage audit measures which labelled plant attacks violate those invariants and the honest-data cost.

A.2 Separation Protocol

  • 200 consecutive-row batches are sampled from attack-free SWaT, WADI, BATADAL, and HAI records for the separation test.Batches contain 1,000 rows and start at random positions.Source: §A.2 · p. 26
  • Four fabrications preserve selected properties while breaking physical consistency: channel rolls, regime permutations, conservation scaling, and regime splicing.The designs preserve marginal distributions, regime-conditional statistics, channel ranges, or real rows while disrupting actuator–sensor couplings, mass balance, or feasible transitions.Source: §A.2 · pp. 26–27
  • Each batch is scored against calibrated invariants under the 1% admission rule, recording violation rates and honest and fabricated-batch rejection rates.The protocol reports these outcomes in Figure 5.Source: §A.2 · p. 27

A.3 Attack Coverage Audit

  • The coverage audit treats each contiguous run of labelled attack rows as one attack—35 on SWaT and 14 on WADI—and counts it covered when more than 1% of its rows violate an invariant.This is the same violation threshold used for batch admission.Source: §A.3 · p. 27
  • The audit measures the honest violation rate on the first 60,000 rows after the normal-record invariant slice as the cost side of coverage.Source: §A.3 · p. 27

B Targeted-Recall Damage and Removal per Rule

The appendix reports how Table 7 compares targeted-recall damage and its removal across aggregation settings, then describes the PA-FL Lite proof protocol and circuit choices used to attest sampled batch rows.

B Targeted-Recall Damage and Removal per Rule

  • Table 7 reports targeted-recall damage, the share removed by projection or the deployed gate, and malicious-update admission across aggregation rules, attackers, and invariant sets.Removal ratios are damage-weighted over informative seeds; values above 100% mean the gated federation scored above the honest-only reference within seed variance.Source: B Targeted-Recall Damage and Removal… · p. 27, Table 7 · p. 28

C Zero-Knowledge Circuit Arithmetisation (PA-FL Lite)

  • PA-FL Lite commits each 1,024-row batch to a Poseidon Merkle root, then proves that at most the permitted sampled rows violate invariants or have inapplicable checks.After a nonce challenge, the parties derive k indices; failed proofs exclude the client from that round, while admitted updates are robustly aggregated.Source: Figure 10 · p. 29

C.1 Circuit Pipeline and R1CS Optimisations

  • The circuit compiles invariant parameters as constants, making affine residuals linear combinations of witness values; its public inputs are the root, invariant set, and violation budgets.At k = 32, the public inputs total 35 field elements.Source: §C.1 · p. 29
  • Biased fixed-point encoding scales and shifts readings so signed values can be range-checked and field arithmetic reproduces signed integer arithmetic.The encoding uses S = 2^16 and adds 2^31 before 32-bit range checks.Source: §C.1 · p. 29
  • Chunked Poseidon hashing reduces row-hash cost, while soft violation accumulation sums Boolean violation and inapplicability flags against public budgets.Each leaf costs 1,095 constraints; checking flags at the circuit boundary avoids making the circuit unsatisfiable at the first violation.Source: §C.1 · p. 30

C.2 Constraint Breakdown and Prover Cost

At k = 32, PA-FL Lite uses 297,736 R1CS constraints, with Merkle openings and leaf hashes accounting for about 76%; the reported proving and verification costs are benchmarked on an Apple M3 Pro.

C.2 Constraint Breakdown and Prover Cost

  • 297,736 R1CS constraints are used at k = 32 over 1,024 rows, with Merkle openings and leaf hashes accounting for 7,030 constraints, about 76%.Source: §C.2 · p. 30
  • On an Apple M3 Pro with Circom 2.1.9, SnarkJS 0.7.4, Groth16 over BN128, and Powers of Tau 220, proving takes 12.0 s at 3.8 GB peak memory; verification takes 290 ms independent of k.The Groth16 proof is 256 bytes in binary and 806 bytes in SnarkJS JSON encoding.Source: §C.2 · p. 30
  • At k = 16, the circuit has 148,888 constraints and proves in 6.55 s with the same verification cost.Table 8 benchmarks attestation outcomes on seed-0 SWaT batches with vmax = 1 and umax = 8, and estimates sampling soundness from 19,992 random index draws over 56 honest windows.Source: §C.2 · p. 30, Table 8 · p. 31
  • The 36 range checks on two sampled rows take 1,152 constraints, nine tolerance checks take 1,035, and applicability and index-bit checks take the remaining 80.Source: §C.2 · p. 30
Loading 2609.34804v1…