Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface

Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface Adrita Rahman Tory1, ABM Shawkat Ali1, Md Abu Layek2, and Khondokar Fida Hasan3⋆ 1

Bangladesh University of Business and Technology (BUBT), Mirpur-2, Dhaka-1216, Bangladesh 2 Jagannath University, Dhaka, Bangladesh 3 University of New South Wales (UNSW), ACT 2601, Australia fida.hasan@unsw.edu.au

Abstract. Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning attacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks relative to majority classes. We also show that part of the observed collapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after ϵ-dependent tuning. These findings motivate studying privacy, robustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy federated NIDS.

Keywords: Federated Learning · Intrusion Detection · Differential Privacy · Byzantine Robustness · Minority Attack Detection · Network Security ⋆ Corresponding author, Email: fida.hasan@unsw.edu.au

Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

1

1

Introduction

Machine-learning-based Network Intrusion Detection Systems (NIDS) face a persistent challenge in recognising attack categories that vary enormously in prevalence. In operational environments, rare and novel attacks can be disproportionately important despite appearing only sparsely in observed traffic. At the same time, any single organization typically sees only a partial slice of the broader threat landscape, creating a strong incentive for collaborative learning across administrative boundaries [9, 12, 14, 15, 18]. In practice, however, network traffic metadata may constitute personal data under regulatory frameworks such as the GDPR, which limits the feasibility of centralizing raw data [7]. Federated Learning (FL), a distributed paradigm where participants share model parameter updates rather than raw data [1], enables such collaboration while respecting data protection constraints. However, FL provides no formal privacy guarantees by default; gradient inversion attacks can reconstruct sensitive training inputs from shared updates [1, 8]. Conse- Fig. 1. Geometric Indistinguishability at the Aggrequently, Differentially Private gation Interface: DP-SGD Noise and Byzantine FilStochastic Gradient Descent tering Jointly Suppress Minority-Class Updates. (DP-SGD) [1, 8, 19] is widely adopted to bound this leakage, providing (ε, δ)-privacy guarantees by clipping per-sample gradients and injecting calibrated Gaussian noise [6,8], albeit at utility cost. In parallel, federated deployments also benefits from tolerance to adversarial participants who may submit poisoned updates to corrupt the global model [4, 5]. Byzantine-robust aggregation rules, such as coordinate-wise median [17] or Krum [5], address this by filtering statistical outliers, contracting the acceptance region around honest consensus [11]. These mechanisms are often evaluated separately in federated learning. However, in class-imbalanced intrusion detection, their interaction may be as important as their individual behavior. As illustrated in Fig.1, privacy noise increases update dispersion, while robust aggregation attenuates statistically unusual updates at the server interface. In NIDS, rare-attack signals are already sparse because they are supported by very few samples and occur far less frequently than majority attack categories [9, 18]. Prior work has shown that DP-SGD can disproportionately degrade performance for underrepresented classes, while Byzantine-robust aggregation can suppress legitimate but statistically atypical updates [4, 10, 11, 20]. This paper investigates rare-attack coverage in federated NIDS. We introduce Geometric Indistinguishability as a conceptual lens to explain how robust Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

2

aggregation struggles to preserve privacy-perturbed minority updates. We find that combining privacy noise and robust aggregation disproportionately degrades rare-attack detection. Crucially, while part of the apparent performance collapse under strong privacy stems from training miscalibration, a residual detection floor remains for ultra-rare classes even after ϵ-dependent tuning. Therefore, privacy, robustness, and rare-attack coverage must be evaluated jointly rather than as independent properties. Our contributions are as follows: – We introduce geometric indistinguishability as a working hypothesis for how privacy-induced update dispersion and robust aggregation may jointly suppress minority-class signals in class-imbalanced federated intrusion detection. – Using UNSW-NB15 with DP-SGD and coordinate-wise median under labelflip and model-poisoning attacks, we provide initial empirical evidence that joint privacy and robustness constraints can disproportionately degrade rareattack coverage, and that some apparent collapse may be attributable to hyperparameter miscalibration rather than an inherent impossibility. – We argue that trustworthy federated NIDS should evaluate privacy, adversarial robustness, and class-wise threat coverage together, and we identify aggregation-aware modeling and sample-aware evaluation as promising directions for future work. The remainder of this paper is organized as follows: Section 2 reviews related work; Section 3 formalizes the problem and the geometric-indistinguishability lens; Section 4 details the experimental methodology; Section 5 presents empirical results; Section 6 discusses implications and mitigations; Section 7 outlines limitations; and Section 8 concludes the study.

2

Related Works

Federated learning has been widely adopted for collaborative intruTable 1. Comparison of Related Work Across sion detection without centralKey Dimensions ising raw traffic data [5], [14]. Ref. FL-NIDS DP Byz. Rob. CW-Fair Prior work has applied FL-based ✓ ✗ ✗ ✗ [14] NIDS across IoT, fog, and enter[5] ✓ ✗ Partial ✗ [3] ✓ ✗ ✗ Partial prise environments [4], [5], and [7] ✗ ✓ ✗ ✗ recent studies confirm its viabil[16] ✗ ✓ ✗ ✓ [15] ✗ ✗ ✓ ✗ ity on UNSW-NB15 for multi[12] ✗ ✗ ✓ ✗ class detection tasks [3]. How[13] ✗ ✗ ✓ ✗ [10] ✗ ✗ ✓ ✗ ever, these works treat privacy, This work ✓ ✓ ✓ ✓ robustness, and fairness as independently composable properDP = Differential Privacy; Byz. Rob. = Byzantine ties rather than interacting conRobustness; CW-Fair = Class-wise Fairness straints. The application of DP-SGD to federated learning provides formal (ϵ, δ)-privacy guarantees [7], but at a known Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

3

Gen

Exp

Fuz

Gen

Exp

Fuz

DoS

Rec

Ana

Bak

She

Wor

Gen

Ana

Bak

She

Wor

0% Attacks

Exp

Fuz

DoS

Rec

Ana

Bak

She

20% Attacks

Wor

40% Attacks

Fig. 2. Diagnostic Case Study: Fairness Collapse Under Miscalibration. Detection rates at ϵ = 1.0 using static LR = 0.05 across 0%, 20%, 40% adversarial clients. Minority classes collapse to near-zero while majority classes maintain > 40%, yielding DIclass < 0.05 (panel d). This motivated ϵ-dependent calibration. Attack categories: Gen (Generic), Exp (Exploits), Fuz (Fuzzers), DoS, Rec (Reconnaissance), Ana (Analysis), Bak (Backdoor), She (Shellcode), Wor (Worms).

utility cost. A critical and well-documented consequence is that DP-SGD degrades underrepresented classes disproportionately [16]: accuracy gaps between majority and minority groups widen as the privacy budget tightens [9], and this disparity is not reliably resolved by hyperparameter retuning alone [8]. In parallel, Byzantine-robust aggregation rules, including coordinate-wise median [15], Krum [10], and Trimmed Mean [13], defend against poisoned updates by filtering statistical outliers, but uniform post-filtering aggregation weights fail to protect minority-class gradients once label imbalance is present [12]. Recent work further shows that class imbalance attacks can reduce minority-class accuracy to near-zero under state-of-the-art robust FL methods [11]. Despite growing interest in each of these properties individually, their joint evaluation in a class-imbalanced federated NIDS setting remains scarce. Table 1 summarises the closest related works along the three dimensions central to this paper. As Table 1 shows, no prior work jointly addresses all four dimensions in a federated NIDS context. Regulatory frameworks such as GDPR [6] and the EU AI Act [18] motivate this joint requirement, but do not specify how these properties should be simultaneously realised in a learning system. This paper addresses that gap directly.

3

Problem Formalization

3.1

Minimal System Model

We consider a standard Federated Learning setup [13] with N clients, where each client i holds local dataset Di. In standard FL training, each client minimizes local loss via Stochastic Gradient Descent (SGD), computing gradient estimates gi = ∇θL(θ; Bi) over mini-batches Bi of size B, and transmitting updates ∆θi = Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

4

−ηlocal·gi to the server. The server applies aggregation function A : (Rd)N → Rd: θ(t+1) = θ(t) − η · A(∆θ(t), . . . , ∆θ(t)) 1

N

(1)

Following the Byzantine threat model [5], up to αN clients (where α < 0.5) may deviate arbitrarily from this protocol, submitting malicious updates ∆θadv. 3.2

Mechanisms

Differentially Private SGD (DP-SGD) To achieve (ε, δ)-privacy, clients implement Differentially Private SGD (DP-SGD) [1], which modifies standard SGD through two operations: (i) per-sample gradient clipping to bound L2sensitivity by C; and (ii) calibrated Gaussian noise injection N (0, σ2C2I) [6]. This induces variance expansion in the transmitted updates: σ2 C2 Var(g˜) = Var(g) + DP B

(2)

w√h e r e σDP is the noise multiplier calibrated to satisfy (ε, δ)-DP via σDP ≥ c T log(1/δ)/(εN ) for T rounds and c a constant. 3.3

Byzantine-Robust Aggregation

For robustness, the server applies coordinate-wise median aggregation [21], which computes the element-wise median across client updates. Formally, for the j-th coordinate of the parameter vector (j ∈ [d]), the aggregator outputs: ( ) Amedian(∆θ1, . . . , ∆θN )j = median {∆θi,j }Ni=1

(3)

where ∆θi,j denotes the j-th coordinate of the update from client i and N is the number of participating clients. 3.4

Geometric Indistinguishability

We use geometric indistinguishability as a conceptual lens for a failure regime that can arise when DP-SGD is combined with Byzantine-robust aggregation in class-imbalanced federated intrusion detection. Prior work suggests that privacy mechanisms may disproportionately affect underrepresented classes, while robust aggregation can attenuate legitimate but statistically atypical updates [3, 21]. Let Gmin denote the distribution of honest updates associated with minority attack classes, and let Gadv denote the distribution of adversarial updates. Under DP-SGD, minority updates are perturbed by Gaussian noise, yielding GDP = Gmin ∗ N (0, σ2 I). min

DP

We say that the system moves toward geometric indistinguishability when privacyperturbed minority updates overlap more strongly with adversarial updates, Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

5

making minority-class signals harder for robust aggregation to preserve. In this paper, we use this idea as an interpretive hypothesis rather than a formal theorem or directly estimated decision rule. This lens is useful for interpreting the empirical results in Section IV. In particular, it helps distinguish artifactual collapse, where poor hyperparameter calibration exaggerates failure, from a more persistent degradation regime in which rare-attack coverage remains fragile even after ϵ-dependent tuning.

4

Empirical Validation of Geometric Indistinguishability

4.1

Dataset and Partitioning

We utilize the UNSW-NB15 Federated Learning Experimental Setup dataset (175,341 samples), se- 10 Clients | IID Partitioning | 20 Communication Rounds | Min 8 Participants | Local Training lected specifically to evaluate performance under severe Local Training inter-class imbalance [14]. Minority classes such as Worms (0.2%) and Shellcode (1.5%) reflect operational realities ε=∞ → LR 0.0020 Differential Privacy (DP-SGD) ε=5.0 → LR 0.0010 where rare attacks constitute ε=3.0 → LR 0.0005 critical security threats [18]. ε=1.0 → LR 0.0001 To isolate the geometric interaction between privacy and robustness from data heterogeneity, we partition the dataset across ten clients using IID sampling. This setup Injection (if mal_ratio>0) favors the minority-class gradient survival because each client observes the same distribution, increasing the likelihood that minority signals retain sufficient mass for median computation. In realistic non-IID settings, skewed attack distributions concentrate minority gradients on fewer Fig. 3. Complete Experimental Configuration and clients, further increasing ge- Workflow ometric indistinguishability. Thus, the reported fairness degradation represents a lower bound for practical deployments. Attack Category Classification: We classify the nine attack categories by prevalence and operational significance: – Minority Classes (rare): Analysis (n = 134, 0.76%), Backdoor (n = 125, 0.71%), Shellcode (n = 80, 0.46%), Worms (n = 5, 0.03%) Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

6

– Majority Classes (common): Generic (n = 3, 723, 21.2%), Exploits (n = 2, 236, 12.8%), Fuzzers (n = 1, 279, 7.3%), DoS (n = 816, 4.7%), Reconnaissance (n = 669, 3.8%) This classification reflects operational realities where rare attacks constitute < 2% of traffic yet represent critical security events [1], [3]. Under differential privacy, these imbalanced classes create fairness challenges (Section IV). 4.2

Federated Learning and Privacy Configuration

The complete experimental configuration is detailed in Fig 3. To mitigate local class imbalance, we utilize BCEWithLogitsLoss with positive class weight. Differential privacy is implemented via Opacus DP-SGD with gradient clipping. Calibration addresses a documented challenge in differentially private optimization: DP-SGD noise requires smaller learning rates to maintain convergence stability [1]. Theoretically, the optimal learning rate η scales inversely with the noise multiplier σ to preserve the gradient signal-to-noise ratio [2]. Our schedule (Fig 3) instantiates this principle for the FL-NIDS setting. 4.3

Adversarial Threat Model and Evaluation

We evaluate two attack vectors: (1) Label-flip poisoning (untargeted data poisoning where labels are inverted); and (2) Gaussian model poisoning (direct corruption of update vectors via N (0, 5.02) noise). Aggregation is fixed to Coordinatewise Median, which was selected for its stability and minimal degradation under 40% pressure (0.3% F1 drop) compared to alternatives like Krum or Trimmed Mean in pre-validation (Figure 4). This selection isolates privacy-fairness interactions from aggregation-induced variance. We adopt class-wise fairness metrics to capture disparities in detection rates. 1) Class-wise Disparate Impact (DIclass): We measure fairness as the ratio of minimum to maximum detection rates across attack categories: DIclass =

minc∈Catk DRc

maxc∈Catk DRc

(4)

where Catk = {Generic, Exploits, . . . , Worms} represents the nine attack categories and DRc is the detection rate for class c. Following the four-fifths heuristic commonly used in fairness evaluation, we use DIclass ≥ 0.8 as the fairness threshold, meaning the worst-performing class achieves at least 80% of the best-performing class’s detection rate. This per-class formulation is more conservative than grouped minority/majority ratios, as it captures the single worst-performing category.

Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

7

Fig. 4. F1 Score Across Aggregation Rules (FedAvg, Krum, Median, Trimmed Mean) Under Clean, 20%, and 40% Adversarial Client Ratios.

5

Results

5.1

Original Collapse: The Problem Under Investigation

Our empirical validation proceeds in three stages. In Section 5.1, we identify catastrophic fairness collapse at ϵ = 1.0 under a static learning rate of LR = 0.05 (Fig. 2), establishing the interaction between hyperparameter settings and privacy constraints. In Section 5.2, we introduce ϵ-dependent learning rate scheduling, which restores overall utility (Fig. 5, F 1 = 0.738) but still reveals a minorityclass performance floor. Finally, Section 5.3 demonstrates that a pathway isolation addressing this limitation (Fig. 6). Prior to presenting primary results, this diagnostic case study illustrates a critical practical pitfall. Using a static learning rate (η = 0.05) across privacy regimes results in near-total detection collapse at ϵ = 1.0 (Figure 2). While subsequent calibration (Section 5.2) reveals this as a con- Fig. 5. Utility Recovery After ϵ-Dependent Calibraprivacy budgets with figuration artifact, it demon- tion. F1 and DIclass across √ ∝ 1/ ϵ). Calibration restores F1 LR (η adaptive strates how easily fairness colfrom 0.007 to 0.738 at ϵ = 1.0, but DIclass remains lapse is misattributed to fun- < 0.21 (below fairness threshold 0.8), motivating ardamental privacy-robustness chitectural intervention. tensions. This establishes a systematic methodological lesson: ϵ-dependent hyperparameter calibration is essential for valid evaluation of FL privacy mechanisms. In this setting, detection rates for Exploits, DoS, and Reconnaissance fall below 40%; minority classes collapse near zero across all adversarial scenarios. Consequently, the Disparate Impact (DI) remains negligible and fails to approach the 0.8 fairness threshold regardless of the adversarial ratio. While these results Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

8

initially suggested an irreversible conflict between strict differential privacy and Byzantine robustness, subsequent analysis (Section 6.5) refines this diagnosis as a calibration issue rather than a fundamental theoretical limitation. 5.2

Results After ϵ-Dependent Learning Rate Calibration

With ϵ-dependent learning rate calibration (Fig. 3), the model no longer exhibits the near-total collapse observed under the static schedule in Section IV-A. As shown in Fig. 5, performance degrades more gradually as privacy becomes stronger: F1 declines from 0.9537 at ϵ = ∞ to 0.7379 at ϵ = 1.0, while DIclass decreases from 0.750 to 0.205. Although no differentially private setting satisfies the DIclass ≥ 0.8 threshold, the system remains functional after calibration. Adversarial participation further reduces class-wise fairness, but the postcalibration results suggest that privacy budget is the dominant driver of degradation in this setup. For example, at ϵ = 3.0, DIclass decreases from 0.750 in the non-private setting to 0.516 in the clean private setting, and falls further under attack (e.g., 0.581 under 40% label flipping and 0.509 under model poisoning). We therefore interpret the results as evidence of a threshold-like degradation regime under joint privacy and robustness constraints, rather than as a formally established phase transition. 5.3

Persistent Detection Floor for Ultra-Minority Classes

Fig. 6 isolates the ultra-minority classes Worms (n = 5) and Shellcode (n = 80). Under the strongest privacy setting (ϵ = 1.0), both classes remain substantially weaker than the majority classes even after calibration: Worms stabilizes at 20% detection and Shellcode at 52.5% across the evaluated scenarios. We note that the Worms class contains only five total samples, dis- Fig. 6. Persistent Detection Floor for Ultratributed across ten IID clients; re- Minority Classes. Shellcode (n = 80) and sults for this class should be inter- Worms (n = 5) detection rates across preted as indicative rather than five scenarios at ϵ = 1.0 post-calibration. Cross-scenario consistency (±5pp variance) statistically robust. Because this demonstrates privacy-induced floor, not attackpattern persists across clean and induced. Calibration alone cannot resolve this. adversarial settings, the results suggest that the residual degradation is not explained solely by attack pressure or by the original static-learning-rate miscalibration. At the same time, both classes recover at ϵ = 3.0, with Worms reaching 80–100% detection in the reported scenarios. We therefore interpret the ϵ = 1.0 behavior as initial evidence of a persistent floor under this configuration, likely Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

9

reflecting the interaction of strong privacy noise with extreme sample scarcity. This is a configuration-specific empirical observation rather than a proof of a universal privacy limit. Table 2. Architecture Comparison Across Privacy and Attack Regimes

Clean LP 20% LP 40% MP 20% MP 40%

0.2044 0.4082 0.6685 0.2044 0.2044

0.2048 0.3931 0.4078 0.2048 0.2049

−0.0004 +0.0152 +0.2607 −0.0004 −0.0005

Tie CMS CMS Tie Tie

ε = 3.0 — Moderate Privacy Clean LP 20% LP 40% MP 20% MP 40%

0.5165 0.5116 0.6245 0.4929 0.5631

0.4725 0.4984 0.5806 0.4841 0.5090

+0.0439 +0.0132 +0.0439 +0.0088 +0.0541

CMS CMS CMS CMS CMS

ε = ∞ — No Differential Privacy Clean LP 20% LP 40% MP 20% MP 40%

0.7670 0.7209 0.5512 0.7537 0.7256

0.7498 0.8217 0.8288 0.7631 0.7740

+0.0172 −0.1009 −0.2776 −0.0094 −0.0485

CMS MLP MLP MLP MLP

Notes: ε = 1 denotes strong (tight) privacy, ε = 3 moderate privacy, and ε∞ = no differential privacy. LP = label flipping; MP = model poisoning. ∆ = DIclass(CMS) − DIclass(MLP); positive values favour CMS, negative values favour MLP.

6

Discussion

6.1

Architectural Pre-conditioning: CMS vs. MLP

To investigate whether architectural pre-conditioning might address the persistent minority floor, we designed a prototype system termed the Cortical Memory System (CMS). CMS serves as an exploratory testbed to investigate whether architectural gradient preconditioning (Fig. 7) can address the persistent minority floor by preserving pathway-specific gradient subspaces under the privacyrobustness constraints identified. We benchmark CMS against a standard MLP baseline as an initial feasibility assessment. Mechanism: CMS creates pathway-specific gradient subspaces via: 1. Skip connections (h0 → m2, h0 → m3): Project input directly into 128dim slow pathways, bypassing majority-dominated intermediate layers. 2. Multi-head classification: Four independent classifiers create orthogonal parameter subspaces; DP clipping applies per-parameter, preserving minority gradient directions in m2/m3. 3. Differential dropout (0.10 slow vs. 0.25 fast): Acts as a frequency filter, preserving rare gradients while regularizing majority noise. Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

10

Fig. 7. CMS vs. MLP: Per-Metric Win Rates. Percentage of experimental scenarios where CMS outperforms MLP baseline. Aggregated across∈ ϵ{ 1.0, 3.0, ∞} , attack types, and adversarial ratios. Win defined as metricCM S > metricM LP for each scenario. Metrics:

DIclass

=

minc(DRc) maxc (DRc ) ;

Minority

mean({Analysis, Backdoor, Shellcode, Worms}); Jain FI =

∑ ( DR)2 ∑ n· DR2 .

DR

=

4. GroupNorm: Per-sample normalization prevents minority statistics from being averaged away by the majority class. Results show that at ϵ = 3.0, CMS achieves a 100% win rate on Shellcode (5/5 scenarios), with a +6.5pp mean and +8.75pp maximum advantage, and a 50% overall minority win rate (10/20) with no losses. At ϵ = 1.0, CMS yields a +20pp gain on Worms in label-flip scenarios, although both architectures struggle. Metric-level analysis indicates that CMS performs strongest in precision (73% win rate), followed by F1 (60%), while minority detection favors MLP (47% win rate for CMS). Thus, CMS improves precision and reduces false positives, whereas MLP provides more consistent minority coverage, making architectural choice dependent on deployment priorities. 6.2

Operational Regime Classification

Table 2 summarizes the results across operational regimes defined by privacy budget ϵ and adversarial pressure, using class-wise disparate impact (DIclass), where positive ∆ favors CMS. At ϵ = 1.0 under clean and model poisoning settings, both models collapse below the fairness threshold (DIclass ≈ 0.20), showing that strong DP noise (σ = 0.189) suppresses minority gradients irrespective of architecture, establishing a privacy-induced floor. Under ϵ = 1.0 with 40% label poisoning, CMS achieves a 3.3× fairness gain over MLP (0.67 vs 0.41), indicating that pathway isolation better preserves minority signals under combined DP and adversarial stress. At moderate privacy (ϵ = 3.0), CMS wins all comparisons (5/5), with a maximum +0.044 advantage, as reduced noise enables Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

11

pathway-specific gradient accumulation. Without privacy (ϵ = ∞), CMS maintains a small edge in clean settings (∆ = +0.017), but MLP outperforms under adversarial conditions (3/4 wins), where architectural simplicity aids recovery. Overall, CMS advantages concentrate at moderate privacy and at the privacyattack intersection, while benefits diminish at privacy extremes. 6.3

Threshold-Like Degradation at the Aggregation Interface

Our results suggest a threshold-like degradation regime at the federated aggregation interface rather than a smooth decline in rare-attack coverage. In the reported experiments, the transition from functional detection to severe minorityclass degradation appears between 20% and 40% adversarial participation. We interpret this pattern as being consistent with the geometric indistinguishability hypothesis: as DP-SGD increases the dispersion of honest minority updates, robust aggregation may attenuate those updates more strongly when they become statistically atypical relative to the dominant client update pattern. This interpretation should be read as empirical and configuration-specific. We do not claim a formally established phase transition; rather, the current results indicate that privacy noise, robust aggregation, and class imbalance can combine to produce sharp degradation in rare-attack coverage under the studied setting. 6.4

Regulatory Motivation and Joint Evaluation

The observed interaction also has an important systems implication. In practice, federated NIDS may be expected to satisfy privacy requirements, tolerate adversarial participants, and maintain reliable coverage across attack categories. Regulatory frameworks such as the GDPR and the EU AI Act provide motivation for these goals, but they do not specify how such properties should be jointly realized in a learning system [7, 16]. Our results therefore support a narrower claim than a legal compliance conclusion. They suggest that evaluating privacy and robustness in isolation may miss failure modes that become visible only when class-wise threat coverage is examined jointly. In this paper, we use privacy, robustness, and rare-attack coverage as technical evaluation dimensions rather than as a complete legal compliance model. From that perspective, the main implication is methodological: trustworthy federated NIDS should assess these properties together rather than assuming they compose cleanly by default. 6.5

Insufficiency of Conventional Mitigations

Standard mitigation strategies fail because they do not address the underlying geometric conflict: – Geometric Methods: Class-aware privacy budgets typically leak information about rare attack distributions, violating the composition properties Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

12

required for GDPR defensibility. Similarly, noise-adaptive filtering thresholds assume non-adaptive adversaries; sophisticated attackers can exploit expanded acceptance regions by mimicking privacy-perturbed minority gradients [3, 5]. – Data-Level Methods: Techniques like SMOTE fail because DP-SGD operates on gradient geometry, not raw data. Even with balanced inputs, the resulting gradients from minority samples remain high-variance and sparse, leading to rejection by the aggregator [3]. 6.6

Artifactual vs. Fundamental Fairness Limits

A critical distinction must be made between configurationinduced failure and an empirical floor under our configuration. Initial collapse at ε = 1.0 was partly driven by static learning rates that destabilized under high noise. By implementing an ε-dependent adaptive schedule combined with pos_weight loss reweighting (Fig. 8), we successfully restored F1 scores from near-zero to 0.85 at ε = 3.0. However, Fig. 8 also reveals a persistent floor in our sweep: despite calibration, ultra-minority classes (e.g., Fig. 8. Impact of Calibration on Four Minority Worms, n = 5) remain be- Classes. Detection rates before (red: static LR) low 20% detection. This indi- vs. after (blue: calibrated LR + loss reweighting). Calibration eliminates collapse for Analycates that while hyperparamesis/Backdoor but floor persists for Worms, conter calibration eliminates arti- firming sample-scarcity boundary. factual collapse, it does not remove the empirical signal-to-noise boundary induced by strong DP noise for extremely rare events.

7

Limitations and Future Work

This study operates under four specific constraints. First, the use of IID client partitioning establishes a conservative fairness baseline. Real-world heterogeneous traffic distributions would likely reduce minority gradient contributions further, suggesting that the reported fairness collapse represents a lower bound on severity. Second, the restriction to coordinate-wise median aggregation limits immediate generalization to other Byzantine-robust rules like Krum or FLTrust. Third, findings rely exclusively on the UNSW-NB15 benchmark, leaving featurespace generalization unvalidated. Finally, the Cortical Memory System (CMS) Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

13

evaluation reflects a preliminary, fixed configuration rather than the output of an exhaustive hyperparameter search. Research should prioritize three areas. First, artifactual collapse demonstrates the need to derive principled functional relationships between ε, noise multipliers, and learning rates to standardize privacy-preserving deployment protocols. Second, development must shift toward fairness-constrained aggregation designs capable of distinguishing privacy-perturbed minority gradients from adversarial outliers. While CMS improves the Jain Fairness Index relative to MLP baselines, systematic evaluation against adaptive adversaries and non-IID partitions is required. Lastly, the field necessitates sample-aware fairness metrics to rigorously distinguish detection gaps caused by fundamental sample scarcity from those resulting from architectural failure.

8

Conclusion

Federated learning is a promising approach for collaborative network intrusion detection, but its deployment is shaped by competing requirements for privacy, adversarial robustness, and reliable coverage of rare attack categories. This paper examined that interaction in a class-imbalanced federated NIDS setting using DP-SGD and coordinate-wise median on UNSW-NB15 under label-flip and model-poisoning attacks. We introduced geometric indistinguishability as a conceptual lens for understanding how privacy-perturbed minority updates may become harder for robust aggregation to preserve. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade rare-attack coverage relative to majority classes. They also highlight an important diagnostic distinction: part of the apparent collapse under strong privacy can arise from training miscalibration, while a more persistent degradation regime may remain for ultra-rare classes even after ϵ-dependent tuning. These findings should be interpreted as an initial empirical case study rather than a universal theorem. The main implication is methodological: privacy, robustness, and class-wise threat coverage should be evaluated jointly in federated NIDS rather than treated as independently composable properties. More broadly, the results suggest that aggregation-aware modeling, clearer privacy specification, and sample-aware evaluation remain important directions for building trustworthy federated intrusion detection systems. Disclosure of Interests. The authors have no competing interests to declare that are relevant to the content of this article.

References 1. Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. pp. 308–318 (2016) Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

14

2. Andrew, G., Thakkar, O., McMahan, B., Ramaswamy, S.: Differentially private learning with adaptive clipping. Advances in neural information processing systems 34, 17455–17466 (2021) 3. Bagdasaryan, E., Poursaeed, O., Shmatikov, V.: Differential privacy has disparate impact on model accuracy. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 32, pp. 15479–15488 (2019) 4. Bagdasaryan, E., Veit, A., Hua, Y., Shmatikov, V.: How to backdoor federated learning. In: Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS). vol. 108, pp. 2938–2948. PMLR (2020) 5. Blanchard, P., El Mhamdi, E.M., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems 30 (2017) 6. Dwork, C., Roth, A.: The algorithmic foundations of differential privacy. Foundations and trends® in theoretical computer science 9(3-4), 211–487 (2014) 7. European Parliament, Council of the European Union: Regulation (eu) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/ec (general data protection regulation). Official Journal of the European Union L 119, 1–88 (May 2016) 8. Fu, J., Hong, Y., Ling, X., Wang, L., Ran, X., Sun, Z., Wang, W.H., Chen, Z., Cao, Y.: Differentially private federated learning: A systematic review (2025), https://arxiv.org/abs/2405.08299 9. Gaber, M.G., Ahmed, M., Janicke, H.: Malware detection with artificial intelligence: A systematic literature review. ACM Computing Surveys 56(6), 1–33 (2024). https://doi.org/10.1145/3638552 10. Hasan, K.F., Shajeeb, H.H., Abeydeera, C., Turnbull, B., Warren, M.: Isadm: An integrated stride, att&ck, and d3fend model for threat modeling against real-world adversaries. IEEE Access 13, 217316–217348 (2025) 11. Li, S., Ngai, E.C.H., Voigt, T.: An experimental study of byzantine-robust aggregation schemes in federated learning. IEEE Transactions on Big Data 10(6), 975–988 (2024). https://doi.org/10.1109/TBDATA.2023.3237397 12. Makris, I., Karampasi, A., Radoglou-Grammatikis, P., Episkopos, N., Iturbe, E., Rios, E., Piperigkos, N., Lalos, A., Xenakis, C., Lagkas, T., Argyriou, V., Sarigiannidis, P.: A comprehensive survey of federated intrusion detection systems: Techniques, challenges and solutions. Computer Science Review 56, 100717 (2025). https://doi.org/https://doi.org/10.1016/j.cosrev.2024.100717, https://www.sciencedirect.com/science/article/pii/S157401372400100X 13. McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. pp. 1273–1282. Pmlr (2017) 14. Mishra, P., Varadharajan, V., Tupakula, U., Pilli, E.S.: A detailed investigation and analysis of using machine learning techniques for intrusion detection. IEEE Communications Surveys & Tutorials 21(1), 686–728 (2019). https://doi.org/10.1109/COMST.2018.2847722 15. Moustafa, N., Slay, J.: Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In: 2015 Military Communications and Information Systems Conference (MilCIS). pp. 1–6 (2015). https://doi.org/10.1109/MilCIS.2015.7348942 16. Nolte, H., Rateike, M., Finck, M.: Robustness and cybersecurity in the EU Artificial Intelligence Act. In: Proceedings of the 2025 ACM Conference on Fairness, Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

15

Accountability, and Transparency (FAccT ’25). Association for Computing Machinery, New York, NY, USA (6 2025). https://doi.org/10.1145/3715275.3732020, https://doi.org/10.1145/3715275.3732020 17. Pillutla, K., Kakade, S.M., Harchaoui, Z.: Robust aggregation for federated learning. IEEE Transactions on Signal Processing 70, 1142–1154 (2022). https://doi.org/10.1109/TSP.2022.3153135 18. Thakkar, A., Lohiya, R.: Attack classification of imbalanced intrusion data for iot network using ensemble-learning-based deep neural network. IEEE Internet of Things Journal 10(13), 11888–11895 (2023). https://doi.org/10.1109/JIOT.2023.3244810 19. Tory, A.R., Hasan, F.K.: An evaluation framework for network ids/ips datasets: Leveraging mitre att&ck and industry relevance metrics. Computers & Security p. 104777 (2025) 20. Tory, A.R., Hasan, K.F., Rahman, M.S., Koroniotis, N., Moni, M.A.: Mind the gap: Missing cyber threat coverage in nids datasets for the energy sector. In: International Conference on Big Data, IoT and Machine Learning. pp. 434–447. Springer (2025) 21. Yin, D., Chen, Y., Kannan, R., Bartlett, P.: Byzantine-robust distributed learning: Towards optimal statistical rates. In: International conference on machine learning. pp. 5650–5659. Pmlr (2018)

Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026

16

Related documents

• CC-FIDS: a federated intrusion detection system with low false negative rates via category consensus and hierarchical filtering#462550
• Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface#926341
• FL-TWIN: a unified federated learning system for intrusion detection with digital twins modelling.#685904
• Enhancing IoT Security through Federated Transfer Learning Approaches#725932
• Robust Unsupervised Network Intrusion Detection via Federated Learning with Selective Aggregation under Anomalous Sample Contamination#410993