Search papers, labs, and topics across Lattice.
This paper investigates the interplay between privacy, robustness, and fairness in federated intrusion detection systems (NIDS), revealing that treating these properties as independently composable can lead to significant performance degradation, especially for rare attack categories. By introducing geometric indistinguishability, the authors demonstrate that privacy noise can hinder the detection of minority-class signals during robust aggregation. Their empirical evaluation using the UNSW-NB15 dataset shows that the joint application of differential privacy and robust aggregation techniques can disproportionately affect the detection of rare attacks, highlighting the need for a more integrated approach to these competing requirements.
Privacy noise in federated learning can severely compromise the detection of rare attacks, challenging the assumption that privacy and robustness can be optimized independently.
Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning attacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks relative to majority classes. We also show that part of the observed collapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after epsilon-dependent tuning. These findings motivate studying privacy, robustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy federated NIDS.
