PaperlayerView exact revision on arXiv

Source-linked AI summary

PVBRF-ID: Private, Verifiable and Byzantine-Robust Federated Intrusion Detection for Oilfield Enterprise Networks

Mustafa S. Aljumaily, Ali Ataeemh Allami, Mustafa N. Mnati, Nawar S. Alseelawi, Shahab Abdulla

arXiv:2610.12704v1cs.CRcs.LG

TL;DR

Federated intrusion detection for dispersed oilfield sites must reconcile private updates with poisoning checks that ordinarily inspect updates in plaintext. PVBRF-ID secret-shares updates across two servers, tests them against a clean root-set reference, and makes accepted-update inclusion verifiable; with secure clipping, it reached 0.641 macro-F1 against a 30% adaptive attacker, while FedAvg fell to 0.046.

  • Problem

    Secure aggregation hides individual updates, while Byzantine-robust rules inspect them in plaintext, creating a privacy–robustness tension for federated learning.

    Source: Introduction · p. 1

  • Method

    PVBRF-ID secret-shares updates across two servers, which test each update’s norm and cosine similarity to a clean root-set reference and publish an auditable inclusion transcript.

    Source: Introduction · p. 2

  • Results

    Against a 30% adaptive attacker, PVBRF-ID with secure clipping reached 0.641 macro-F1, while FedAvg fell to 0.046; plaintext multi-Krum remained more robust.

    Source: Discussion · p. 14

  • Takeaways & Limitations

    Where updates must remain hidden from the aggregator, PVBRF-ID keeps clean-data accuracy at the FedAvg level and exposes one accept bit per site with a verifiable transcript.

    Source: Discussion · p. 13

    Secure comparison, range proofs, trusted-dealer triple generation, and secure clipping with noise are idealized rather than fully implemented.

    Source: Implemented and idealized components · p. 8

Abstract

from arXiv · show

Federated learning allows dispersed oilfield sites to train a shared intrusion detector without pooling network traffic, yet its aggregation step forces a choice between privacy and robustness. Byzantine-robust rules must read each update in the clear, whereas secure aggregation hides updates from the checks that detect poisoning. We present PVBRF-ID, a two-server protocol in which sites secret-share their updates and the servers jointly test each update's norm and its cosine similarity to a reference computed on a small clean root set, revealing one accept bit per site. Commitments, Merkle roots and a homomorphic audit make the inclusion of accepted updates publicly verifiable. On a 15-class Edge-IIoTset task with ten sites holding differently distributed data and ten random seeds, PVBRF-ID matched FedAvg on clean data (macro-F1 0.708 vs. 0.706) and withstood sign-flip attacks (0.696 vs. 0.091). Against an adaptive attacker controlling 30% of sites, PVBRF-ID with secure clipping reached 0.641, whereas FedAvg fell to 0.046; plaintext multi-Krum remained higher by 0.052. An update-inference attacker recovered each site's class mix from plaintext updates (Spearman correlation 0.81) but not from one server's view. Backdoors passed the filter, and noise-based mitigation gave only heuristic protection. The implementation uses Python 3.13, NumPy 2.3, 30 rounds and 10 seeds.

Introduction

PVBRF-ID addresses the tension between private aggregation and update-level poisoning checks in federated intrusion detection for dispersed oilfield sites. It combines secret-shared, root-guided acceptance tests with verifiable aggregation, and evaluates robustness, privacy, and fairness on simulated-site IIoT data.

Design

  • PVBRF-ID secret-shares updates across two servers, tests each update’s norm and tolerant cosine similarity to a root-set reference, and makes accepted-update inclusion verifiable.Published commitments, Merkle roots, and an audit support verification.Source: Introduction · p. 2

Design finding

  • A public reference derived from the previous aggregate let an adaptive attacker drive macro-F1 to 0.012, while a clean root set avoided this failure.The previous aggregate can be shaped by accepted updates, creating a reference-capture feedback loop.Source: Introduction · p. 2

Evaluation scope

  • The evaluation benchmarks a 15-class Edge-IIoTset task across ten sites and ten seeds against four aggregation baselines and five non-adaptive attacks plus an adaptive attacker.The adaptive attacker exploits the cosine tolerance.Source: Introduction · p. 2

Privacy and fairness

  • Plaintext updates exposed site class mix to an inference attacker, while multi-Krum systematically excluded atypical sites and PVBRF-ID with a suitable norm bound did not.Experiments use public IIoT traffic with simulated sites, not operator data.Source: Introduction · pp. 2–3

Negative results

  • Backdoors passed PVBRF-ID’s filter, noise-based mitigation was heuristic, and plaintext multi-Krum was more robust at 30% adversaries.The paper frames these as negative results rather than guarantees of protection.Source: Introduction · p. 3

Methods

PVBRF-ID uses two servers and a clean root set to test secret-shared site updates while limiting each server’s view. Its protocol publishes an auditable transcript, and its secure tests are designed to match the plaintext rule under stated arithmetic bounds.

System, threat model and goals

  • The threat model allows up to f < n/2 Byzantine sites and assumes two non-colluding, honest-but-curious servers; collusion and root-set compromise are out of scope.The stated goals include clean accuracy near FedAvg, robustness, per-site update privacy, verifiable inclusion, and avoiding systematic exclusion of atypical honest sites.Source: System, threat model and goals · p. 3

Protocol overview

  • Each round, servers compute a root update, sites secret-share their updates, and the servers jointly test each update before summing accepted contributions and publishing a transcript.The tests reveal one accept bit per site.Source: Protocol overview · p. 3, Figure 1 · p. 4

Secret sharing

  • Each site additively secret-shares its update, so a single share is uniformly distributed and reveals nothing about the update.Coordinates use fixed-point encoding and an idealized per-coordinate range proof enforces a bound.Source: Secret sharing · p. 4

Secure acceptance tests

  • The secure acceptance rule combines a public norm bound with cosine alignment to the root reference, using a tolerant threshold for mildly misaligned honest updates.With stated bounds, the secure tests match the plaintext rule; for the 2,319-dimensional study model, the largest tested quantity stayed below 2^119 with seven bits of headroom, and all eight tested boundary cases returned the same bit.Source: Secure acceptance tests · pp. 4–6

Root-set reference and reference capture

The servers compute the reference update locally on the clean root set, rather than using the public previous aggregate. The alternative can be steered by an adaptive attacker into a reference-capture feedback loop.

Root-set reference

  • An adaptive attacker can steer the public previous aggregate so attackers are accepted and honest sites rejected, creating a feedback loop called reference capture.The root-set update is known to the servers but not to the sites.Source: Root-set reference and reference capture · p. 6

Verifiable aggregation

Sites commit to their shares, and servers publish Merkle roots, accept bits, aggregate shares, and summed randomness. The homomorphic audit and Merkle paths let observers check accepted-contribution inclusion, but not the correctness of acceptance decisions.

Verifiable aggregation

  • Each server publishes a Merkle root over commitments and an aggregate share formed from accepted site shares, enabling a homomorphic check against the published aggregate.Each site can check the Merkle path for its own commitment.Source: Verifiable aggregation · p. 6
  • The audit detects a dropped accepted contribution or inconsistent server bitmaps, but it does not certify the accept decisions themselves.The stated threat model excludes a server deviating inside the secure tests.Source: Verifiable aggregation · p. 6

Security and privacy analysis (informal)

The security analysis gives proof-sketch guarantees for single-server privacy, bounded Byzantine influence, and audit soundness under the stated threat model. Its arguments rely on idealized comparison and range-proof functionalities.

Security and privacy analysis (informal)

  • The security propositions are proof sketches rather than full reductions because secure comparison and per-coordinate range proofs are idealized functionalities.The arguments identify the cryptographic assumptions on which each claim rests.Source: Security and privacy analysis (informal) · p. 6
  • A single server cannot distinguish update collections with the same accept bitmap and aggregate, but learns the accepted-site count and published aggregate.The ideal comparison functionality is assumed to reveal only the accept bit.Source: Security and privacy analysis (informal) · pp. 6–7
  • With f < n/2 Byzantine sites, their per-round displacement of the averaged update is at most fκ∥r_t∥/|A_t| in any direction.The bound weakens when honest sites are rejected; the norm bound alone suffices for this proposition.Source: Security and privacy analysis (informal) · p. 7
  • If both servers satisfy the commitment equation and all Merkle paths verify, the audit recovers the accepted-share aggregate except with negligible probability.The proof sketch relies on Pedersen commitment binding and Merkle-path verification.Source: Security and privacy analysis (informal) · p. 7

Optional mitigations

The optional mitigations combine secure clipping, Gaussian noise, and aggregate clipping, with Rényi-DP accounting for the noise over training rounds.

Optional mitigations

  • Secure clipping rescales each accepted update to norm at most C_t = ∥r_t∥, while Gaussian noise adds standard deviation zC_t/|A_t| per coordinate inside the aggregate.Here A_t is the accepted set and z is the noise multiplier.Source: Optional mitigations · p. 7
  • Aggregate clipping publicly bounds each revealed aggregate coordinate k by 3|r_t,k| + 0.5 rms(r_t).This is a post-processing step.Source: Optional mitigations · p. 7
  • Rényi-DP accounting covers Gaussian noise over T rounds under sensitivity C_t, client-level add/remove adjacency, and full participation, but excludes data-dependent accept bits and |A_t|.The excluded quantities lie outside the accounting in equation (6).Source: Optional mitigations · p. 7

Implemented and idealized components

The implementation covers secret sharing, secure norm and cosine tests, commitments, Merkle trees, and the homomorphic audit, while several cryptographic operations remain idealized.

Implemented and idealized components

  • Secret sharing, Beaver-based norm and cosine tests, SHA-256 Merkle trees, Pedersen commitments, and the homomorphic audit are implemented and covered by 12 unit tests, including tamper detection.The secure tests include the tolerant cosine case.Source: Implemented and idealized components · p. 8
  • Secure comparison, per-coordinate range proofs, trusted-dealer triple generation, and secure clipping with noise addition inside the aggregate are idealized.The comparison is specified to reveal only the accept bit, and its communication is a placeholder.Source: Implemented and idealized components · p. 8
  • The Pedersen group is a toy 512-bit group, so timings are upper bounds and the group is not secure; commitments and opening checks are disabled during training runs.The cost benchmark runs commitments and opening checks in full; disabling them in training does not change accept bits or the aggregate.Source: Implemented and idealized components · p. 8

Data and features

The evaluation uses sampled Edge-IIoTset traffic split across class-skewed simulated sites, compares several aggregation rules under defined attacks, and measures detection performance and privacy-related outcomes.

Data and features

  • The sampled Edge-IIoTset DNN data contain 222,947 flows across 15 classes, with 20% per class held out for testing and a stratified 1,500-flow root set withheld from training.Features are engineered from text and low-cardinality fields, then reduced to the 80 highest one-vs-rest-correlation features; ranking on all sampled rows introduces a small optimistic bias affecting all conditions equally.Source: Data and features · p. 8

Sites, model and training

  • Ten sites receive class-skewed partitions from a Dirichlet distribution with concentration 0.5; the 80–24–15 multilayer perceptron has 2,319 parameters and trains for 30 rounds.Each round uses 30 local SGD steps with batch size 128 and learning rate 0.1; site holdings range from 6,572 to 38,532 flows, with attack shares of 14%–95%.Source: Sites, model and training · p. 8

Baselines

  • The comparisons include pooled and local-only training, FedAvg, trimmed mean, multi-Krum, secure norm-only aggregation, and PVBRF-ID with previous-aggregate or root references.PVBRF-ID root-reference comparisons use τ = 0 and τ = −0.3; trimmed mean and multi-Krum are configured for up to three attackers in every scenario.Source: Baselines · p. 8

Attacks

  • Attacks include sign-flip, label-flip, targeted flip, backdoor, boosted backdoor, and an adaptive attacker that targets the known bound, threshold, and reference.The adaptive attacker uses norm 0.95B_t and aims for cosine τ + 0.02; three of ten sites attack where the 30% condition is stated.Source: Attacks · pp. 8–9

Privacy attacker

  • The privacy attacker is evaluated on plaintext updates or one server’s share vectors plus accept bits, using class-mix, site-similarity, and accept-bit correlation measures.The colluding view combines both shares; the evaluation uses the first 10 rounds for update views and all 30 rounds for accept-bit correlation.Source: Privacy attacker · p. 9

Metrics and statistics

  • Macro-F1 on held-out data is primary, while backdoor ASR and ε are secondary; reported means use t-based 95% confidence intervals over 10 paired seeds.Runs used Python 3.13.9, NumPy 2.3.5, and pandas 2.3.3; the 870 main and 160 supplementary runs are deterministic given the listed seeds.Source: Metrics and statistics · p. 9

Results

PVBRF-ID preserved clean-data performance and improved robustness under sign-flip and adaptive attacks, but its filter did not stop backdoors. Privacy and fairness outcomes also depended on the server view and norm bound.

Federation recovers rare attack classes

  • FedAvg reached macro-F1 0.706 ± 0.008 versus 0.536 ± 0.019 for local-only training, with recall gains for rarely seen MITM, DDoS-ICMP, and Password classes.The reported per-class recall rose from 0.73 to 1.00 for MITM, 0.77 to 0.99 for DDoS-ICMP, and 0.38 to 0.61 for Password.Source: Federation recovers rare attack classes · p. 9

Non-adaptive attacks

  • 0.696 ± 0.013 macro-F1 under sign-flip attacks left PVBRF-ID on par with multi-Krum and above FedAvg at 0.091; clean performance was indistinguishable from FedAvg.Label-flip and targeted-flip attacks caused little damage, although PVBRF-ID rejected 90% and 87% of their updates.Source: Non-adaptive attacks · p. 9, Table 1 · p. 10

Adaptive attackers and reference capture

  • At 30% adversaries, secure-clipped PVBRF-ID reached 0.641±0.027 macro-F1; FedAvg reached 0.046, and multi-Krum exceeded it by 0.052 ± 0.032.The tolerance-exploiting attackers were not rejected; robustness came from bounding their influence. Tightening the threshold reduced tolerance-related loss but increased honest-update rejections.Source: Adaptive attackers and reference capture · pp. 10–11

Backdoors

  • ASR was 1.000 for PVBRF-ID, FedAvg, and norm-only aggregation; combined clipping, noise, and aggregate clipping lowered it to 0.150 at z=1, with clean macro-F1 0.680.The authors characterize noise as heuristic protection rather than a meaningful differential-privacy guarantee.Source: Backdoors · p. 11, Figure 4 · p. 12

Privacy against update inference

  • 0.81 ± 0.02 Spearman correlation let an attacker recover class mix from plaintext updates, while one server’s share yielded 0.00 ± 0.06; collusion restored plaintext-level success.The one-server result follows from a single additive share being uniformly distributed; non-collusion is an assumption of PVBRF-ID.Source: Privacy against update inference · p. 12, Table 3 · p. 12

Fairness and the norm bound

  • At κ=3.5, PVBRF-ID accepted atypical and typical sites at 99.6% and 99.2% (ρ = −0.01), while multi-Krum accepted them at 40.7% and 93.5% (ρ = −0.62).At κ=1.5, PVBRF-ID rejected 43.5% of honest updates; multi-Krum’s exclusion of atypical sites affects sites carrying rare attack classes.Source: Fairness and the norm bound · pp. 12–13, Table 4 · p. 13

Communication cost

  • 1.72 MiB per round was the online communication cost at model dimension 2,319 and ten sites, 19.4 times plain FedAvg’s upload.Commitment verification took 8.1 s and the audit 0.8 s per round in a toy 512-bit group; these timings are upper bounds.Source: Communication cost · p. 13

Discussion

PVBRF-ID preserves clean-data performance and resists adaptive attacks with secure clipping, but its deployment depends on a clean root set and independently operated servers. Its scope is bounded by simulated-site evaluation, idealized cryptographic components, and unresolved privacy and backdoor limitations.

Discussion

  • PVBRF-ID exposes one accept bit per site and a verifiable transcript, unlike FLOD’s aggregate-only disclosure.This makes each accepted update’s inclusion checkable by sites and auditors.Source: Discussion · p. 13
  • At 30% adversaries, plaintext multi-Krum is the more robust choice, but the comparison is asymmetric because only PVBRF-ID faces the adaptive attacker targeting its norm bound and reference.Attacks crafted against distance-based rules would test the baselines on more equal terms.Source: Discussion · p. 14
  • Deployment assumes two independently operated servers and a clean root set; communication overhead is roughly 19–27 times FedAvg and is costly on low-bandwidth links.A contractor or regional security operations centre could operate the second server; less frequent rounds could amortize bandwidth costs.Source: Discussion · pp. 13–14
  • Evaluation uses one public dataset with simulated sites, and κ and τ were selected on that data, limiting evidence that robustness ordering transfers.A second IIoT dataset and an operator-traffic pilot would test transfer; held-out seeds would remove the stated tuning optimism.Source: Discussion · p. 14
  • Four cryptographic components are idealized, and the audit binds aggregate shares to committed inputs but does not certify accept decisions.A server could change a decision inside secure comparison while keeping bitmaps consistent; authenticated shares or a zero-knowledge proof could close this gap.Source: Discussion · p. 14
  • Privacy assumes non-colluding servers and does not cover released-model leakage; backdoors pass the filter, while noise mitigation is heuristic at ε ≥16.9.Further work includes stronger backdoor defenses and a pilot on operator data.Source: Discussion · pp. 14–15
  • 0.641 macro-F1 with secure clipping under a 30% adaptive attacker, versus 0.046 for FedAvg; clean-data macro-F1 was 0.708.The evaluation also reports that plaintext multi-Krum is more robust at 30% adversaries.Source: Discussion · p. 14
  • PVBRF-ID’s stated next steps include a real comparison protocol with zero-knowledge range proofs and a Zero Trust policy plane using accept bits and norm statistics.The paper also proposes stronger backdoor defenses and a pilot on operator data.Source: Discussion · p. 15

Supplementary Information

The supplementary note corrects the adaptive attacker’s placement within the acceptance region and reports the resulting macro-F1 costs.

Supplementary Information

  • Table S1 lists experimental parameters from a notebook configuration that was identical across all runs.Source: Table S1 · p. 16

Supplementary Note S1

  • 0.034 ± 0.018 macro-F1 at 20% and 0.075 ± 0.034 at 30% adversaries was lost when the adaptive attacker exploited the τ = −0.3 tolerance.The supplementary run placed the attacker at cosine τ + 0.02 and repeated adaptive scenarios on the same ten seeds.Source: Supplementary Information · p. 16
  • The supplementary run covered only adaptive scenarios for τ = −0.3 designs and four baselines; baseline results reproduced the main run on every seed.The note reports 160 supplementary runs.Source: Supplementary Information · p. 16

Related papers

Loading 2610.12704v1…