Feature Suppression and Differential Privacy for Residential Traffic Classification: A Two-Home Federated Study Márton Pál Lipcsey-Magyar∗ and Adrian Pekar∗† ∗ Budapest University of Technology and Economics, Hungary † CUJO LLC Hungary
arXiv:2609.23521v1 [cs.LG] 20 Sep 2026
E-mail: [email protected], [email protected] Abstract—Residential traffic classification supports service management, but learning across homes must account for heterogeneous traffic and privacy constraints. Privacy-aware training may impose uneven costs across traffic categories. We study this tradeoff in simulated two-client federated learning using 1.62 million preprocessed gateway-collected flows across six categories. We compare a full-feature baseline, feature suppression (FS), and differentially private stochastic gradient descent (DP-SGD) under one fixed record-level privacy setting. FS-mild excludes four timing features from 16 model inputs; it provides no formal privacy guarantee. With size-proportional aggregation, FS-mild achieves higher combined macro-F1 and worst-group F1 (the minimum per-class F1 across homes) than DP-SGD in all five seeds at both model capacities under stratified and temporal splits. The tested DP-SGD configuration incurs pronounced minoritycategory losses, especially in the smaller home, but FS-mild does not uniformly improve on the full-feature baseline. On stratifiedsplit models, loss-based and shadow-model membership probes show near-chance aggregate discrimination without a consistent ranking across probes; this does not establish equivalent privacy. These findings support FS as an input-minimization baseline, not a substitute for formal privacy. Index Terms—Federated learning, traffic analytics, residential gateways, differential privacy, feature suppression, membership inference attack.
I. I NTRODUCTION Home gateways are useful vantage points for service and application management: traffic classification can support troubleshooting, parental controls, policy enforcement, and quality-of-service decisions. Building reliable classifiers requires diverse training examples, but centralizing household flow records raises privacy concerns. Federated learning (FL) [1] enables clients to collaborate through model updates rather than uploading raw training records. Model exchange alone, however, does not guarantee privacy. For service operators, the long tail matters. A classifier that recognizes dominant Web and Network traffic but fails on less frequent categories may miss precisely the traffic relevant to a troubleshooting task. This makes minority-category performance an operational concern beyond aggregate classification quality. Households differ in application mix, volume, and minorityclass coverage, producing statistical heterogeneity (non-IID data). Differential privacy (DP) [2] provides a formal framework for bounding the influence of a protected unit on released
outputs. Differentially private stochastic gradient descent (DPSGD) [3] implements private training through per-example gradient clipping and noise addition, but its utility cost can be uneven under heterogeneity [4], [5], [6], [7]. A distinct design choice is feature suppression (FS): excluding selected flow features from model inputs. Our mild variant, FS-mild, removes four packet inter-arrival-time features from a 16feature baseline. This minimizes the model’s inputs, but does not by itself prevent collection of those features or provide a formal privacy guarantee. We study these choices using traffic collected directly on two residential OpenWrt gateways. Each home’s records form a client partition; FL training and aggregation are simulated on a common compute host, not executed on the gateways. We ask: for privacy-aware residential traffic analytics, what operational cost does DP-SGD impose relative to feature suppression in a small non-IID federation? We evaluate one fixed DP-SGD privacy budget and clipping norm rather than a tuned privacy–utility frontier. Its protected unit is one training flow, not a user or household. The comparison evaluates classification utility and host-side training cost; it neither compares mechanisms at equivalent privacy protection nor measures gateway deployment performance. Our contribution is a measurement and design-guidance study, not a new FL algorithm. Specifically: 1) We characterize 1.62 M preprocessed flows across six traffic categories from two homes, with different dominant categories and minority-category shares differing by up to 8.1×. These captures provide a naturally heterogeneous setting, not a representative residential benchmark. 2) We compare baseline FL, FS-mild, and DP-SGD across five seeds, two model capacities, and stratified and temporal splits. Evaluation covers macro-F1, worst-group F1 (the minimum per-class F1 across the two homes), and per-class behavior. Small-model secondary analyses cover stronger suppression (FS-aggressive), equalweight aggregation, a FedDPA adaptation, and isolated runtime. 3) With size-proportional aggregation, FS-mild exceeds the tested DP-SGD configuration on combined macro-F1 and worst-group F1 in every seed at both capacities
under both splits. Class-level costs are uneven, with pronounced losses in the smaller home’s minority categories. Loss-based and shadow-model membership inference on the stratified-split models yields near-chance aggregate AUC without a consistent configuration ranking across probes. These results indicate limited measured attack success, not evidence of equivalent privacy or of privacy gains from FS. The remainder of this paper is organized as follows. Section II describes the two-home dataset and its non-IID structure; Section III presents the federated pipeline, privacy mechanisms, and evaluation protocol; Section IV reports the utility, worst-group, and membership-inference results; Section V surveys related work; and Sections VI and VII draw the lessons, limitations, and conclusions. II. DATASET AND S ETTING We evaluate bilateral FL using traffic captured at two residential home gateways. Each home’s records form a separate client partition. Training and aggregation are simulated on a common compute host, not executed on the gateways; within the simulated protocol, aggregation uses model updates rather than raw flow records. A. Collection and Filtering The gateways run OpenWrt [8], a Linux-based operating system for embedded devices, and use a custom flow metering tool backed by the nDPI 5.0 classification library [9]. The routers generated bidirectional flow records directly, with 80 fields including statistical features and application/category labels. The released Parquet files retain 78 fields after removing the source and destination IP addresses; they are not anonymous, as MAC addresses and timestamps remain. We use category labels rather than a fine-grained task with sparsely represented application labels. Recorded timestamps span 11.9 days for Home A (Feb. 11–23, 2026) and 11.5 days for Home B (Feb. 24–Mar. 8, 2026), using UTC dates. We first require at least two bidirectional packets and retain records marked as deep packet inspection (DPI) classifications by the meter. These are inferred labels, not independently verified ground truth. We define the six-category task using a support rule: each category must have both >0.4% share of the packet- and DPI-filtered records and >1,000 flows in each home. The resulting fixed list is Network, Web, System, Media, Collaborative, and SocialNetwork; all other categories are excluded. This restricts the task without balancing the retained classes. The final dataset contains 996 450 flows from Home A and 619 284 from Home B, retaining 84% of the 1 928 110 captured records. The full-feature baseline represents each flow with 16 compact flow features, including both bidirectional statistics and directional counters, as described in Section III. The artifact records the counts at each filtering stage.
TABLE I C APTURE SPANS AND CLASS DISTRIBUTION AFTER FILTERING . R ATIO = LARGER SHARE / SMALLER SHARE . F EDAVG WEIGHTS ARE FIXED AGGREGATION COEFFICIENTS DERIVED FROM TRAINING - SET SIZES , NOT LEARNED MODEL PARAMETERS .
Category
Home A Count
Network Web System Media Collaborative SocialNetwork
Home B %
Count
Ratio %
547 179 54.9 254 471 41.1 1.3× 326 576 32.8 336 632 54.4 1.7× 45 533 4.6 4 417 0.7 6.4× 38 800 3.9 2 991 0.5 8.1× 21 258 2.1 14 054 2.3 1.1× 17 104 1.7 6 719 1.1 1.6×
Total 996 450 Capture span 11.9 days FedAvg weight 61.7%
619 284 11.5 days 38.3%
– –
B. Natural Non-IID Structure Table I summarizes three forms of observed heterogeneity. First, the dominant categories differ: Network dominates Home A, while Web dominates Home B. Second, minoritycategory shares are highly skewed; System and Media differ by 6.4× and 8.1×. Third, Home A has 1.6× as many retained flows, giving it a 61.7% size-proportional aggregation weight. Because the capture windows do not overlap, these differences combine household and time-window effects. After filtering, Home A has 21 distinct source MAC addresses and Home B has 10; these are address counts, not verified device or user inventories. Home A’s Media records predominantly carry YouTube and RTSP labels, whereas Home B’s Media records are predominantly YouTube-labeled. Slack and GitHub labels occur in both homes. These observations characterize the captured traffic, not a controlled inventory of household devices or activities. III. M ETHODS A. Federated Pipeline We use FedAvg [1] as an operational baseline with both homes participating in all 20 rounds. The three primary configurations—baseline FL, FS-mild, and DP-SGD—use 5 local epochs per round with a fresh Adam optimizer (lr = 10−3 , nominal batch size 256). Aggregation is sizeproportional by default; for the small model, we also repeat these three configurations with equal weights (wA =wB =0.5). FedDPA’s two-stage local schedule is specified below. We do not claim FedAvg is optimal for non-IID data; non-IID-specific aggregation methods are outside the scope of this study. The small multilayer perceptron (MLP) has hidden dimensions [16, 16]; the medium robustness model uses [128, 64]. Both use ReLU activations and cross-entropy loss. With all 16 inputs, they have 646 and 10 822 trainable parameters, respectively. Hidden widths remain fixed within each capacity when features are suppressed; only the input layer loses weights. We retain the natural class imbalance without oversampling or class-weighted loss.
TABLE II T RAINING SETUP. F ED DPA USES FIVE EPOCHS IN EACH OF TWO LOCAL STAGES .
Parameter
Value
Small / medium MLP Rounds / local epochs per stage Batch size / optimizer Train–test split Seeds Target ε / clip norm C δ (approx.), Home A / Home B
[16, 16] / [128, 64] 20 / 5 256 / Adam, lr=10−3 80/20, stratified or temporal 42, 123, 456, 789, 1024 8.0 / 1.0 (1.25, 2.02) × 10−7
Each home is split independently. Main experiments use stratified 80/20 train–test partitions and five seeds. For both capacities, the three primary configurations also undergo an earlier-80%/later-20% split ordered by flow start time within each home. This tests temporal transfer but does not hold out devices or group related sessions. Table II summarizes the training setup. Preprocessing is record-local and uses no fitted statistics. Duration and packet inter-arrival time (PIAT) values are converted from milliseconds to seconds, and byte counts and packet-size statistics to KiB; these features and packet counts are transformed with log(1 + x). The protocol number is divided by 255. The constants are fixed independently of both datasets, so altering one record does not change the representation of other records. All configurations use this same transformation before selecting their input columns. B. Privacy Mechanisms From the 80 captured fields, the baseline feature set uses 16 compact flow features suited to a lightweight model: duration, bidirectional and directional packet/byte counts, packet-size statistics, PIAT statistics, and protocol number. Feature suppression. FS-mild removes the four PIAT features, reducing the input from 16 to 12 features. The choice is motivated by potential behavioral information in timing and the high zero rates of PIAT minima and standard deviations (37–61% across homes). Neither motivation establishes that these features leak private behavior: we do not measure feature-specific leakage or compare against random feature removal. Suppression here excludes features from model inputs; avoiding their persistent collection would additionally require configuring the meter accordingly. FS-aggressive removes the four directional packet/byte counters as well, leaving 8 inputs, and is a secondary check on more extensive suppression. DP-SGD. Differentially private stochastic gradient descent [3] uses Opacus [10] with per-example norm clipping, Gaussian noise, Poisson sampling, and Rényi DP accounting [11]. The protected unit is one training flow under add/remove adjacency, not a device, user, or household. One accountant per home persists across all rounds. For local training size N , the actual sampling rate is 1/⌈N/256⌉; calibration covers all 20 × 5 × ⌈N/256⌉ steps. Noise targets ε=8 with δ= min(10−5 , 1/(10N )), yielding multipliers approximately
0.53 for Home A and 0.56 for Home B. We use one fixed privacy budget and clipping norm without DP-specific tuning or a privacy–utility sweep; measured costs therefore concern this configuration, not an intrinsic limit of DP. FedDPA adaptation. The secondary small-model baseline follows Fisher-based personalization [12]. Each round, the mean squared per-example gradients on up to 5,000 local examples estimate the diagonal Fisher. After per-tensor min– max normalization, values at least τ =0.4 select personal coordinates retained from the previous local model; other coordinates start from the global model. Personal and shared coordinates are trained in separate five-epoch stages with fixed constraint coefficients λ1 =λ2 =0.05. Thus FedDPA performs ten local passes per round, not five. In this adaptation, each client’s entire update is clipped to C=1 and every coordinate is noised before aggregation. Independently observable client releases use replacement sensitivity 2C and per-coordinate noise standard deviation 2Cσ, calibrated over 20 full-participation releases. Accounting protects replacement of one client’s training dataset, conditional on fixed roster and weights, rather than one flow. The same numeric ε and per-home δ as DP-SGD do not imply equivalent privacy protection. FedDPA utility is evaluated on each home’s local post-training model; other configurations use the final global model. The artifact specifies the adaptive constraints and release assumptions; this is a fixed-setting adaptation, not an optimally tuned reproduction. C. Evaluation Protocol We report macro-F1 and worst-group F1 at the final round. Macro-F1 is the unweighted average of per-class F1 within each home, then averaged equally across homes regardless of aggregation weights. Worst-group F1 is the minimum over all home/class pairs within each seed, followed by averaging across seeds. Paired 95% intervals use seed-aligned differences, Student’s t distribution, and sample standard deviations. They quantify variability across these runs, not population uncertainty across households. Round time includes both homes’ training, aggregation, and evaluation. Two membership inference attacks (MIA) evaluate the exact final checkpoints of the three primary configurations under the stratified split, at both capacities. The loss-based probe uses negative cross-entropy as its membership score [13]. The shadow probe trains four shadow FL models per target and fits per-home, per-class logistic regression over loss, confidence, entropy, true-class probability, and margin [14]. Each shadow trains on a random half of each home’s target-training partition; the remaining half supplies its nonmembers. Shadows use the corresponding features, architecture, and training mechanism, with DP noise recalibrated to their sample sizes. Targettest records are excluded from fitting shadows and attack classifiers. This is a controlled diagnostic with training-pool access, not an independently sourced auxiliary-data attack; the shadow/target size mismatch can affect transfer. Both probes evaluate equal numbers of members and nonmembers per home/class, capped at 2,000 each, then
TABLE III S MALL - MODEL UTILITY ( MEAN ± SAMPLE STD , 5 SEEDS ). C OMBINED MACRO -F1 AVERAGES HOMES EQUALLY; WORST- GROUP TAKES THE MINIMUM OVER HOME / CLASS PAIRS WITHIN EACH SEED . FS- MILD /FS- AGGR . RETAIN 12/8 FEATURES (12 F /8 F ). F ED DPA USES PERSONALIZED EVALUATION AND A DIFFERENT PRIVACY UNIT; OTHER ROWS EVALUATE THE GLOBAL MODEL .
TABLE IV P ER - CLASS F1 ( MEAN , 5 SEEDS ) FOR THE THREE PRIMARY SMALL - MODEL CONFIGURATIONS (BL = BASELINE FL, FS = FS- MILD , DP = DP-SGD). B OLD : HIGHEST MEAN WITHIN EACH HOME / CLASS . U NDERLINE : BELOW 0.10.
Home A
Config
A Macro B Macro Combined
Worst
Baseline FL FS-mild (12f) FS-aggr. (8f) DP-SGD FedDPA
.671±.083 .714±.037 .683±.043 .616±.039 .509±.026
.077±.051 .071±.044 .041±.049 .004±.002 .009±.015
Collaborative .333 .307 .098 .132 .153 .074 Media .466 .697 .626 .163 .108 .021 Network .975 .977 .968 .975 .977 .963 SocialNetwork .453 .463 .234 .247 .233 .007 System .911 .940 .884 .666 .725 .332 Web .892 .900 .889 .937 .946 .935
.520±.016 .524±.013 .524±.011 .389±.033 .324±.020
.596±.041 .619±.017 .603±.026 .503±.034 .416±.022
macro-average across classes and homes. We report AUC, TPR@1%FPR, TPR@5%FPR, and maximum empirical TPR − FPR. ROC operating points are descriptive, not independently calibrated attack thresholds. Near-chance scores or intervals spanning zero do not establish privacy equivalence. D. Claim Scope and Reproducibility The probes infer membership from final-model outputs for labeled candidate flows; they do not audit an aggregation server observing intermediate updates. DP accounting concerns the training mechanisms conditional on fixed partitions and public protocol metadata, including roster, sizes, and aggregation weights. It does not cover data-dependent filtering or splitting, publication of evaluation metrics or datasets, or joint release of all runs; FedDPA’s personalized models and metrics are also outside its update-release budget. We use seeded pseudorandomness for reproducible research simulations, not secret cryptographic randomness for a production private release. Reported (ε, δ) values characterize the accounted mechanisms under their randomness assumptions, not end-to-end privacy of the public artifact. FS has no formal privacy guarantee, and this is not an equal-protection comparison. The artifact [15] provides the pipeline, datasets, per-round logs, global target and shadow checkpoints, and analysis scripts. Dataset, partition, source, and checkpoint hashes link the measurements to their generating protocol; library versions and seeds are recorded. Deterministic execution is requested, but numerical identity across hardware and software environments is not assumed. IV. R ESULTS A. Utility and Worst-Group Performance Table III gives the small-model comparison. FS-mild achieves higher macro-F1 than DP-SGD in both homes and higher worst-group F1. Relative to baseline FL, FS-mild has higher mean combined macro-F1 but slightly lower mean worst-group F1: suppressing timing features is not a uniform improvement over using all features. Baseline FL shows substantial between-seed variation on Home A; FS-mild’s higher combined mean does not establish a consistent advantage over the full-feature baseline. DP-SGD’s macro-F1 reduction relative to the baseline is larger in Home B than in Home A.
BL
FS
DP
Home B
Class
BL
FS
DP
FS-mild exceeds DP-SGD on both combined macro-F1 and worst-group F1 in every seed. The paired intervals exclude zero for both metrics (Table V). This supports an advantage over the fixed DP-SGD configuration tested here, not superiority over tuned DP or an equal-privacy alternative. B. Distribution of the Utility Cost Table IV shows that the utility cost is not uniform. Network and Web retain high F1 under DP-SGD, while Home B’s Media and SocialNetwork scores approach zero and its System score is roughly half the baseline’s. Minority-category degradation is not confined to Home B: Home A also loses Collaborative and SocialNetwork performance. Conversely, Home A Media improves over baseline FL under DP-SGD. These differences caution against treating noise as uniformly harmful to every class. The convergence curves in Fig. 1 show lower combined macro-F1 under DP-SGD after the initial rounds. Its mean Home B System F1 rises through the middle rounds but finishes below its peak, with substantial variation across seeds; baseline FL and FS-mild reach higher final scores. These trajectories describe the observed training behavior, but do not isolate clipping from noise or optimization effects. FS-mild also has limits: its Home B Media and SocialNetwork means are below the baseline’s. FS-aggressive further lowers mean combined macro-F1 and worst-group F1 relative to FS-mild, although some individual classes improve. More extensive suppression therefore does not yield uniformly better classification. C. Robustness and Secondary Configurations With the medium model, mean combined macro-F1 and worst-group F1 improve for all three primary configurations. FS-mild remains close to baseline FL on both metrics and exceeds DP-SGD: combined macro-F1 is .746 versus .555, and worst-group F1 is .348 versus .070. The paired differences remain positive across all seeds (Table V). This supports the result beyond the smallest architecture, although gateway execution costs have not been measured. The earlier-80%/later-20% split by flow start time within each home preserves the FS-mild–DP-SGD ordering for both capacities: both metrics favor FS-mild in all five seeds. The
Combined Macro-F1
1.0
TABLE VI I SOLATED SMALL - MODEL RUNTIME : MEDIAN OF 20 ROUNDS , SEED 42, ONE CPU TRAINING THREAD . E STIMATED RUN ( MIN ) = MEDIAN ROUND TIME ( S ) × 20 / 60. F ED DPA USES TWO LOCAL STAGES PLUS F ISHER ESTIMATION .
0.8 0.6
Config
0.4
Baseline FL FS-mild DP-SGD
0.2
Home B System F1
0.0 1.0
Round time (s) Est. run (min)
Baseline FL FS-mild FS-aggressive DP-SGD FedDPA
54.6 54.7 54.7 184.7 124.4
18.2 18.2 18.2 61.6 41.5
0.8 D. Runtime
0.6 0.4 0.2 0.0
2.5
5.0
7.5 10.0 12.5 15.0 17.5 20.0
FL Round
Fig. 1. Small-model convergence under the stratified split (mean ± sample std, 5 seeds). Top: combined macro-F1. Bottom: Home B System F1. DPSGD reaches lower final scores; the curves alone do not identify the cause of the gap.
TABLE V FS- MILD MINUS DP-SGD: MEAN DIFFERENCE [ PAIRED 95% CI], 5 SEEDS . M AIN = STRATIFIED , SIZE - PROPORTIONAL AGGREGATION . B OTH METRICS FAVOR FS- MILD IN ALL SEEDS EXCEPT EQUAL - WEIGHT WORST- GROUP (4/5).
Table VI separates timing from the utility experiment: configurations are measured sequentially on an AMD EPYC 7702 CPU host with one training thread, using seed 42. Each round includes both clients’ training, aggregation, and evaluation. Estimated run time is 20 times the median round time, not measured end-to-end latency. The five-seed utility and attack logs were collected under a ten-worker schedule and are not used for this timing table. FedDPA executes two five-epoch stages plus Fisher estimation per round, so its workload is not identical to the other configurations. These are host-side simulation costs, not gateway benchmarks. Baseline FL and both FS variants have similar per-round costs. DP-SGD takes approximately 3.4× as long per round as FS-mild in this isolated measurement. FedDPA also takes longer than the baseline, but its additional training stage and Fisher estimation prevent interpreting the difference as privacy overhead alone. E. Membership Inference Findings
Setting Small, main Medium, main Small, temporal Medium, temporal Small, equal-weight
Combined macro-F1
Worst-group F1
.116 [.055, .178] .191 [.135, .247] .093 [.065, .120] .175 [.162, .189] .060 [.034, .087]
.067 [.015, .118] .279 [.214, .344] .079 [.004, .154] .210 [.159, .262] .014 [−.033, .061]
temporal check therefore supports transfer to a later window within these captures, not to unseen homes or devices. Under equal-weight aggregation, the small-model macro-F1 advantage also persists. Worst-group evidence is weaker in that ablation: four seeds favor FS-mild, but the paired interval includes zero. The FedDPA adaptation learns a nontrivial classifier, but its combined macro-F1 is below the three primary smallmodel configurations and its worst-group F1 remains low (Table III). Its client-dataset replacement guarantee, personalized evaluation, and two-stage training differ from DP-SGD. This fixed-setting result neither ranks the mechanisms at equivalent privacy nor demonstrates a fundamental limit of adaptive DP in bilateral FL.
Table VII reports loss-based and shadow-model MIA results for the small model. Aggregate AUC remains near chance for the three primary configurations at both capacities, with means between .500 and .503. All paired AUC intervals comparing FS-mild with baseline FL or DP-SGD include zero. Some unadjusted low-FPR intervals exclude zero, but do not establish a consistent ranking: in the small model, lossbased TPR@5%FPR favors DP-SGD over FS-mild, whereas the shadow probe favors FS-mild. Full per-home and mediummodel outputs are provided in the artifact. These results establish limited measured attack success, not absence of leakage or equivalence of protection. The shadow probe uses access to the target-training pool, and neither probe tests intermediate-update exposure or temporalsplit models. DP-SGD’s accounted record-level guarantee is a distinct property even when these empirical probes offer little separation; FS has no such guarantee. The operational comparison is therefore a measured utility cost at one DP setting, not evidence that privacy protection has no benefit. V. R ELATED W ORK DP in heterogeneous FL. Cheng et al. [5] analyze how statistical heterogeneity affects the utility loss from clipping
TABLE VII MIA METRICS FOR THE SMALL MODEL ( EQUAL - HOME AVERAGE , MEAN ± SAMPLE STD , 5 SEEDS ). L OSS = LOSS - BASED ATTACK ; S HADOW = SHADOW- MODEL ATTACK . TPR COLUMNS USE 1%/5% FPR; A DV. IS MAXIMUM EMPIRICAL TPR−FPR. VALUES ARE ROUNDED TO THREE DECIMALS .
Attack
Config
AUC
TPR@1% TPR@5%
Adv.
Loss
Baseline FL .501±.003 .007±.001 FS-mild .502±.003 .008±.000 DP-SGD .500±.002 .006±.001
.042±.003 .023±.005 .039±.003 .022±.005 .035±.004 .021±.003
Baseline FL .502±.001 .010±.001 Shadow FS-mild .500±.003 .008±.001 DP-SGD .501±.004 .010±.001
.049±.003 .023±.002 .044±.003 .021±.002 .049±.001 .023±.003
Feature selection and data minimization. Hu et al. [24] use particle swarm optimization for federated feature selection with a trusted third party. FedSDG-FS [25] combines feature selection with local-embedding perturbation for DP in vertical FL. FedFed [26] distills and shares noised features to mitigate heterogeneity, evaluating membership inference as well as utility; it does not simply discard input columns. These works optimize feature selection or representation sharing. We instead evaluate fixed feature-family exclusions in horizontal FL, alongside DP-SGD and two membership probes. The distinction is the residential measurement question, not a new feature-selection algorithm or a demonstrated privacy guarantee from suppression. VI. D ISCUSSION AND L ESSONS
and noise, while Xiong et al. [16] study inference risk and propose local- and server-side noise addition for non-IID FL. Mitigation approaches include noise-aware aggregation in Robust-HDP [17], Fisher-based personalization and adaptive constraints in FedDPA [12], and adaptive server optimization in AdDPNFL [18]. These approaches show why one fixed DPSGD configuration cannot characterize the best achievable DP utility. Our FedDPA adaptation is a secondary evaluation, not a comparison covering all these alternatives. Unequal utility costs. Bagdasaryan et al. [4] demonstrate disproportionate DP-SGD accuracy losses for underrepresented classes and subgroups. In FL, Amiri et al. [6] examine performance and fairness under non-IID data, while Du et al. [7] study and mitigate disparities in model performance across clients. Our home/category F1 analysis is an operational robustness measure, not a demographic fairness evaluation. It adds evidence from residential flow records about how the tested configurations distribute utility across traffic categories. Federated traffic classification. PrivPkt [19] studies DPSGD and shadow-model membership inference for packetbased encrypted traffic classification, including federated training. It reports greater membership vulnerability for smaller classes in its non-private, unbalanced setting and evaluates differential privacy and training-data balancing as mitigations. FedPacket [20] uses HTTP keys rather than sensitive values in its federated packet-classification features. It also demonstrates feature inference by an honest-but-curious server, illustrating that feature restriction alone does not prevent leakage. FEAT [21] estimates traffic-data skewness and selects clients to improve classification under heterogeneity. Our study instead examines fixed feature suppression alongside DP-SGD on gateway-collected residential flow statistics in a simulated federation, emphasizing home/category classification utility and temporal transfer. It is a different task and protocol, not an accuracy ranking against these systems. Non-IID FL optimization. FedProx [22] addresses statistical and systems heterogeneity, while SCAFFOLD [23] uses control variates to correct client drift. We keep FedAvg fixed as an operational reference, rather than claim it is the best nonIID optimizer. Whether these alternatives narrow the measured FS-mild–DP-SGD gap requires a separate comparison.
The answer to our research question is conditional on the tested training configuration. With size-proportional aggregation, DP-SGD yields lower combined macro-F1 and worstgroup F1 than FS-mild at both capacities under both split protocols. Its accounted record-level protection is a distinct benefit, not something the near-chance MIA results invalidate. Runtime is assessed separately in Table VI; the utility differences should not be read as an equal-protection comparison. We draw three lessons for privacy-aware residential traffic analytics. Lesson 1: DP cost is class-dependent. DP-SGD does not lower all scores uniformly. In the primary small-model comparison, Home B loses more macro-F1 than Home A relative to baseline FL, with pronounced losses in minority categories while Network and Web remain strong. Some categories nevertheless improve relative to baseline FL. The slightly higher noise multiplier for Home B does not by itself explain this pattern: clipping, sampling, optimization, and class composition are not separately varied. For service management, the practical lesson is to inspect per-category performance rather than choose a configuration solely by its aggregate score. Lesson 2: feature suppression is a practical baseline, not formal privacy. FS-mild uses fewer input features and has runtime close to baseline FL in the isolated small-model measurement. It performs better than the tested DP-SGD configuration, but does not uniformly improve on the fullfeature baseline. Our experiments exclude timing features from learning; they neither demonstrate reduced feature-specific leakage nor remove those fields from the captured dataset. Avoiding their collection would require a corresponding metering policy. If formal protection is required, feature suppression alone is insufficient: the protected unit and all observable releases must be specified, and DP settings should be tuned against the application’s utility requirements. Lesson 3: the tested MIA probes provide limited discrimination. Aggregate AUC remains near chance across the primary configurations and both capacities. The low-FPR comparisons sometimes distinguish configurations, but their directions are not consistent across probes. This supports limited measured attack success, not privacy equivalence or
TABLE VIII S ETTING - SPECIFIC OPERATIONAL GUIDANCE , NOT A RANKING AT EQUIVALENT PRIVACY PROTECTION .
Deployment priority
Candidate
Training-flow privacy guarantee DP-SGD Minority-category utility
FS-mild
Low training-time overhead
FS-mild
Fewest retained inputs
FS-aggressive
Personalized DP
FedDPA adaptation
Evidence and boundary Record-level accounting under the assumptions in Section III; not end-to-end privacy of the artifact Higher worst-group F1 than tested DP-SGD under size-proportional aggregation; not uniformly better than baseline FL Baseline-like isolated small-model runtime on the CPU host; no gateway timing evidence Eight features; lower mean combined macro-F1 and worst-group F1 than FS-mild in the small model, without demonstrated privacy gain Secondary fixed-setting evidence with low worst-group F1; different privacy unit and evaluation from DP-SGD
absence of memorization. The shadow probe’s target-trainingpool access and smaller shadow training sets constrain its interpretation; neither probe evaluates an observer of intermediate updates. Attack evaluation complements, rather than replaces, mechanism-level accounting. Table VIII condenses these lessons into deploymentoriented guidance. Limitations. The evidence comes from two homes, full participation, six retained categories, and two MLP capacities. Non-overlapping capture windows confound household and temporal effects; DPI-derived labels are not independently verified ground truth. Stratified flow splits may share related traffic across training and test sets. Both capacities retain the FS-mild–DP-SGD ordering under temporal splitting, but this tests only later windows within the same captures, not unseen devices, grouped sessions, or new households. Fiveseed intervals quantify run variability, not population-level generality. Equal-weight aggregation retains the macro-F1 advantage, while its worst-group interval includes zero. We use one DP-SGD budget and clipping norm without DPspecific tuning, and do not evaluate non-IID-specific aggregators or random-feature-removal controls. These choices leave open how much of the utility gap is avoidable and whether PIAT suppression is preferable to other feature choices. FedDPA is a fixed-setting adaptation with a different privacy unit and personalized evaluation, not an equal-protection comparison. Training is simulated on a compute host, and isolated timing uses one seed rather than a multi-host benchmark. The public datasets and seeded checkpoints are reproducibility artifacts, not an end-to-end DP release. These boundaries make the study evidence for this operating setting, not a universal recommendation against DP. VII. C ONCLUSION This study contributes a gateway-collected two-home dataset and a reproducible comparison of feature suppression and fixed-setting DP-SGD, with explicit boundaries on privacy protection and generalization. With size-proportional aggregation, FS-mild achieved higher combined macro-F1 and worst-group F1 than DP-SGD in every seed at both model capacities under stratified and temporal splits. The measured
utility advantage does not establish equivalent privacy: the two MIA probes show limited aggregate discrimination, while FS provides no formal guarantee. Feature suppression is therefore a useful input-minimization baseline to evaluate, not a replacement for DP when formal protection is required. Next steps are DP-specific tuning, matched feature-removal controls, independent attack data, and validation across additional homes and non-IID-specific aggregators. ACKNOWLEDGEMENT We thank Balázs Pejó for early discussions that motivated the comparison between feature suppression and differential privacy. We thank Gergely Biczók for comments on an earlier draft. Supported by the CELTIC-NEXT project Robust and AI Native 6G for Green Networks (RAI6-Green, C2023/1-9), funded by the National Research, Development and Innovation Fund of Hungary under Grant-2024-1.2.6-EUREKA-2024-00009. R EFERENCES [1]
[2] [3]
[4] [5] [6]
[7] [8]
B. McMahan et al., “Communication-Efficient Learning of Deep Networks from Decentralized Data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, ser. Proceedings of Machine Learning Research, vol. 54, 2017, pp. 1273–1282. C. Dwork and A. Roth, “The algorithmic foundations of differential privacy,” Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3-4, pp. 211–487, 2014. DOI: 10.1561/0400000042 M. Abadi et al., “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’16, 2016, pp. 308–318. DOI: 10.1145/2976749.2978318 E. Bagdasaryan et al., “Differential privacy has disparate impact on model accuracy,” in Advances in Neural Information Processing Systems, vol. 32, 2019. S. Cheng et al., “Differentially private federated learning with nonIID data,” Computing, vol. 106, no. 7, pp. 2459–2488, 2024. DOI: 10.1007/s00607-024-01257-2 S. Amiri et al., “On the impact of non-IID data on the performance and fairness of differentially private federated learning,” in 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), 2022, pp. 52–58. DOI: 10.1109/ DSN-W54100.2022.00018 B. Du et al., “Mitigating unfairness in differentially-private federated learning,” ACM Trans. Model. Perform. Eval. Comput. Syst., vol. 10, no. 2, 2025. DOI: 10.1145/3725847 OpenWrt Project. “OpenWrt: Linux operating system for embedded devices.” https : / / github. com / openwrt / openwrt, Accessed: Sep. 18, 2026.
[9] [10] [11] [12]
[13]
[14] [15] [16] [17]
[18]
ntop. “nDPI 5.0: Deep packet inspection library.” https://github.com/ ntop/nDPI/releases/tag/5.0, Accessed: Sep. 18, 2026. Opacus Development Team, Opacus: Training PyTorch models with differential privacy, https://github.com/pytorch/opacus, 2021. I. Mironov, “Rényi differential privacy,” in 2017 IEEE 30th Computer Security Foundations Symposium (CSF), 2017, pp. 263–275. DOI: 10. 1109/CSF.2017.11 X. Yang et al., “Dynamic personalized federated learning with adaptive differential privacy,” in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 72 181–72 192. DOI: 10.52202/ 075280-3160 S. Yeom et al., “Privacy risk in machine learning: Analyzing the connection to overfitting,” in 2018 IEEE 31st Computer Security Foundations Symposium (CSF), 2018, pp. 268–282. DOI: 10 . 1109 / CSF.2018.00027 R. Shokri et al., “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP), 2017, pp. 3–18. DOI: 10.1109/SP.2017.41 FlowFrontiers. “Feature suppression and differential privacy for residential traffic classification: A two-home federated study — code and data artifact.” https://github.com/FlowFrontiers/residential-fl-study. Z. Xiong et al., “Privacy threat and defense for federated learning with non-i.i.d. data in AIoT,” IEEE Transactions on Industrial Informatics, vol. 18, no. 2, pp. 1310–1321, 2022. DOI: 10.1109/TII.2021.3073925 S. Malekmohammadi et al., “Noise-aware algorithm for heterogeneous differentially private federated learning,” in Proceedings of the 41st International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 235, 2024, pp. 34 461–34 498. L. Chen et al., “Differentially private federated learning on nonIID data: Convergence analysis and adaptive optimization,” IEEE Transactions on Knowledge and Data Engineering, vol. 36, no. 9, pp. 4567–4581, 2024. DOI: 10.1109/TKDE.2024.3379001
[19] [20]
[21]
[22] [23]
[24]
[25]
[26]
I. Akbari and E. Tahoun, PrivPkt: Privacy preserving collaborative encrypted traffic classification, Preprint, 2019. DOI: 10.13140/RG.2. 2.22431.59046 E. Bakopoulou et al., “FedPacket: A federated learning approach to mobile packet classification,” IEEE Transactions on Mobile Computing, vol. 21, no. 10, pp. 3609–3628, 2022. DOI: 10.1109/TMC.2021. 3058627 Y. Guo and D. Wang, “FEAT: A federated approach for privacypreserving network traffic classification in heterogeneous environments,” IEEE Internet of Things Journal, vol. 10, no. 2, pp. 1274– 1285, 2023. DOI: 10.1109/JIOT.2022.3204975 T. Li et al., “Federated optimization in heterogeneous networks,” in Proceedings of Machine Learning and Systems, vol. 2, 2020, pp. 429– 450. S. P. Karimireddy et al., “SCAFFOLD: Stochastic controlled averaging for federated learning,” in Proceedings of the 37th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 119, 2020, pp. 5132–5143. Y. Hu et al., “A federated feature selection algorithm based on particle swarm optimization under privacy protection,” KnowledgeBased Systems, vol. 260, p. 110 122, 2023. DOI: 10.1016/j.knosys. 2022.110122 A. Li et al., “Efficient and privacy-preserving feature importancebased vertical federated learning,” IEEE Transactions on Mobile Computing, vol. 23, no. 6, pp. 7238–7255, 2024. DOI: 10.1109/TMC. 2023.3333879 Z. Yang et al., “FedFed: Feature distillation against data heterogeneity in federated learning,” in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 60 397–60 428. DOI: 10.52202/0752802639