Paper deep dive

PenTiDef: Decentralized Federated Intrusion Detection System with Differential Privacy and Latent-Space Defense via Blockchain Coordination in IIoT

Phan The Duy, Nghi Hoang Khoa, Nguyen Tran Anh Quan, Luong Ha Tien, Ngo Duc Hoang Son, Van-Hau Pham

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 83

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%

Last extracted: 7/20/2026, 11:04:10 PM

Summary

The paper introduces PenTiDef, a decentralized federated intrusion detection system (DFL-IDS) for Industrial IoT (IIoT) environments. It integrates Distributed Differential Privacy (DDP) for gradient protection, a latent-space defense module using AutoEncoders and Centered Kernel Alignment (CKA) for poisoning detection, and a permissioned blockchain (Hyperledger Fabric) for coordination and aggregation. The framework eliminates central servers, handles non-IID data, and resists various poisoning attacks (label-flipping, backdoor, GAN-based) while maintaining high detection accuracy and privacy guarantees.

Entities (12)

PenTiDef · framework · 98%CIC-IDS2018 · dataset · 95%Edge-IIoTset · dataset · 95%Distributed Differential Privacy · technique · 92%Backdoor Attack · attack-type · 90%Hyperledger Fabric · technology · 90%Label-flipping Attack · attack-type · 90%Autoencoder · model-component · 88%GAN-based Attack · attack-type · 88%Centered Kernel Alignment · algorithm · 85%FedCC · baseline-model · 85%FLARE · baseline-model · 85%

Relation Signals (11)

PenTiDef → evaluatedon → CIC-IDS2018

confidence 95% · Extensive experiments on CIC-IDS2018 and Edge-IIoTSet

PenTiDef → evaluatedon → Edge-IIoTset

confidence 95% · Extensive experiments on CIC-IDS2018 and Edge-IIoTSet

PenTiDef → uses → Distributed Differential Privacy

confidence 95% · PenTiDef synergistically integrates three key components: (i) client-side Distributed Differential Privacy (DDP)

PenTiDef → defendsagainst → Label-flipping Attack

confidence 92% · superior robustness against both targeted and untargeted poisoning attacks (label-flipping, weight-scaling, Krum/Med, backdoor, and GAN-based)

PenTiDef → defendsagainst → Backdoor Attack

confidence 92% · superior robustness against both targeted and untargeted poisoning attacks (label-flipping, weight-scaling, Krum/Med, backdoor, and GAN-based)

PenTiDef → uses → Hyperledger Fabric

confidence 92% · leveraging a permissioned blockchain (Hyperledger Fabric) with smart contracts

PenTiDef → defendsagainst → GAN-based Attack

confidence 90% · superior robustness against both targeted and untargeted poisoning attacks (label-flipping, weight-scaling, Krum/Med, backdoor, and GAN-based)

PenTiDef → outperforms →

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:This paper proposes PenTiDef, a fully decentralized, privacy-preserving, and poisoning-resilient framework for decentralized federated IDS (DFL-IDS). PenTiDef synergistically integrates three key components: (i) client-side Distributed Differential Privacy (DDP) with stochastic Gaussian noise to protect gradient leakage, (ii) a lightweight latent-space defense module that extracts and compresses penultimate-layer representations (PLRs) into stable Latent Semantic Representations (LSRs) via AutoEncoder, followed by Centered Kernel Alignment (CKA) and K-Means clustering for robust malicious update detection without auxiliary datasets, and (iii) a permissioned blockchain layer with smart contracts that orchestrates on-chain validation, secure FedAvg aggregation, and immutable auditability, eliminating any central server. Extensive experiments on CIC-IDS2018 and Edge-IIoTSet under both IID and realistic non-IID settings, with adversary ratios up to 40\%, demonstrate that PenTiDef consistently outperforms state-of-the-art baselines (FLARE and FedCC) in detection accuracy and F1-score while maintaining lower training overhead. By jointly addressing privacy, robustness, and decentralization in a unified secure aggregation protocol, PenTiDef provides a practical and scalable solution for trustworthy collaborative intrusion detection in heterogeneous, adversarial IIoT environments.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

81,310 characters extracted from source content.

Expand or collapse full text

PenTiDef: Decentralized Federated Intrusion Detection System with Differential Privacy and Latent-Space Defense via Blockchain Coordination in IIoT Phan The Duy 1,2,3 , Nghi Hoang Khoa 1,2,3 , Nguyen Tran Anh Quan 1,2,3 , Luong Ha Tien 1,2,3 , Ngo Duc Hoang Son 1,2,3 , Van-Hau Pham 1,2,3* 1 Information Security Lab, University of Information Technology, Ho Chi Minh City, Vietnam. 2 Vietnam National University, Ho Chi Minh City, Vietnam. 3 VNU-HCM Information Security Center, Ho Chi Minh City, Vietnam. *Corresponding author(s). E-mail(s): haupv@uit.edu.vn; Contributing authors: duypt@uit.edu.vn; khoanh@uit.edu.vn; 20521793@gm.uit.edu.vn; 20520802@gm.uit.edu.vn; sonndh@uit.edu.vn; Abstract This paper proposes PenTiDef, a fully decentralized, privacy-preserving, and poisoning-resilient framework for decentralized federated IDS (DFL-IDS). Pen- TiDef synergistically integrates three key components: (i) client-side Distributed Differential Privacy (DDP) with stochastic Gaussian noise to protect gradient leakage, (i) a lightweight latent-space defense module that extracts and com- presses penultimate-layer representations (PLRs) into stable Latent Semantic Representations (LSRs) via AutoEncoder, followed by Centered Kernel Align- ment (CKA) and K-Means clustering for robust malicious update detection without auxiliary datasets, and (i) a permissioned blockchain layer with smart contracts that orchestrates on-chain validation, secure FedAvg aggregation, and immutable auditability, eliminating any central server. Extensive experiments on CIC-IDS2018 and Edge-IIoTSet under both IID and realistic non-IID settings, with adversary ratios up to 40%, demonstrate that PenTiDef consistently out- performs state-of-the-art baselines (FLARE and FedCC) in detection accuracy and F1-score while maintaining lower training overhead. By jointly addressing privacy, robustness, and decentralization in a unified secure aggregation protocol, PenTiDef provides a practical and scalable solution for trustworthy collaborative intrusion detection in heterogeneous, adversarial IIoT environments. 1 arXiv:2602.17973v2 [cs.CR] 21 May 2026 Keywords: Intrusion Detection System, Decentralized Federated Learning, Blockchain, Privacy, Poisoning Attacks 1 Introduction The transition toward Industry 4.0 has dramatically increased the connectivity of pro- duction systems by integrating IIoT components such as sensors, actuators, industrial gateways, communication protocols, and edge-side computing resources [1, 2]. These interconnected infrastructures enable real-time monitoring, predictive maintenance, operational efficiency, and data-driven decision-making across industrial sectors [3]. In this context, Intrusion Detection Systems (IDS) play a critical role in safeguarding industrial networks by monitoring traffic and identifying abnormal behaviors across multiple layers, from field-level device communications to gateway-aggregated flows and edge-side monitoring streams [4, 5]. With the advancement of Artificial Intelligence (AI), Machine Learning (ML) techniques have been widely adopted in IDS to learn complex attack patterns from large-scale operational and network data generated by modern industrial systems [6]. However, training effective ML-based IDS models requires extensive data from diverse sources, including multiple attack types, machine-to-machine communications, sen- sor telemetry, and gateway traffic. Data sharing is severely restricted due to privacy and confidentiality concerns. Federated Learning (FL) has emerged as a promising paradigm to address this tension by enabling collaborative model training without exchanging raw data [7–9]. Despite its advantages, FL remains vulnerable to malicious participants. Attack- ers can launch poisoning attacks by uploading manipulated model updates, thereby degrading global model performance and compromising the reliability of intrusion detection in industrial operations. Such threats are particularly concerning in decen- tralized settings. Consequently, integrating blockchain with FL has become a relevant direction to enhance trust, auditability, and resilience in decentralized IIoT secu- rity infrastructures [10]. Recent studies [11–13] have demonstrated the potential of blockchain as a decentralized, tamper-proof ledger for model updates and coordination among multiple production sites or edge domains. Its immutability and transparency help prevent tampering while eliminating single points of failure. Nevertheless, FL still faces significant privacy risks [14, 15]. Model updates can leak sensitive informa- tion about local industrial traffic and device behavior through gradient inversion or membership inference attacks. To mitigate these privacy threats, various cryptographic approaches such as Homo- morphic Encryption (HE) [16] and Secure Multi-Party Computation (SMPC) [17–19] have been proposed. However, these methods incur high computational and communi- cation overhead, making them impractical for resource-constrained IIoT environments. Differential Privacy (DP) offers a more scalable alternative by adding calibrated noise to model updates [20]. In parallel, poisoning attacks remain a major barrier to DFL adoption in IIoT [20–22]. Most existing defenses rely on anomaly detection or robust 2 aggregation [23–28], yet they often suffer from high computational cost, the need for prior knowledge of malicious participants, or poor performance under non-IID data distributions typical in industrial settings [29, 30]. Recent latent-space-based methods, including FedCC [31], FLARE [32], and Fed-LSAE [33], have shown promising results by comparing penultimate layer rep- resentations (PLRs). While FLARE requires auxiliary datasets and FedCC suffers from PLR instability in non-IID scenarios, Fed-LSAE improves stability through AutoEncoder compression. However, these approaches remain limited to central- ized or semi-centralized architectures and lack explicit privacy guarantees or fully decentralized coordination. In this paper, we propose PenTiDef, a novel blockchain-orchestrated, privacy- preserving, and poisoning-resilient framework specifically designed for decentralized federated intrusion detection in heterogeneous Industrial IoT (IIoT) environments. Unlike prior works that address individual aspects of the problem in isolation, Pen- TiDef presents the first holistic architecture that simultaneously tackles centralized single-point-of-failure, gradient leakage, and poisoning attacks under severe non-IID data distributions—challenges that are particularly critical in multi-site industrial deployments. The key contributions of this work are as follows: • A fully decentralized FL-IDS coordination architecture that eliminates any cen- tral aggregation server by leveraging a permissioned blockchain (Hyperledger Fabric) with smart contracts. This design enforces transparent model validation, immutable auditability, and incentive-compatible reward/punishment mechanisms across untrusted administrative domains, significantly enhancing system fault tolerance and trust without sacrificing performance. • A client-level Distributed Differential Privacy (DDP) mechanism with stochastic Gaussian noise injection that provides formal (ε,δ)-privacy guarantees on local model updates while maintaining high model utility. This is the first integration of DDP into a latent-space poisoning defense pipeline for DFL-IDS, effectively mitigating gradient-based inference attacks in resource-constrained IIoT settings. • A latent-space poisoning defense module tailored for decentralized IIoT environ- ments. It integrates AutoEncoder-compressed Latent Semantic Representations (LSRs) from penultimate layers with CKA and unsupervised clustering, specifi- cally hardened for severe non-IID industrial traffic. Unlike FedCC (PLR instability) and Fed-LSAE (centralized), the module operates without auxiliary data or adver- sary knowledge and is tightly coupled with on-chain DDP updates and blockchain validation for robust, privacy-preserving detection. • A synergistic integration of the above components into a lightweight, end-to-end pipeline where DDP-perturbed updates are validated on-chain in the latent space before secure aggregation. This integration achieves superior robustness against both targeted and untargeted poisoning attacks (label-flipping, weight-scaling, Krum/Med, backdoor, and GAN-based) while delivering lower training overhead and better scalability than state-of-the-art defenses. • Extensive empirical validation on two large-scale IDS benchmarks (CIC-IDS2018 and Edge-IIoTSet) under both IID and realistic non-IID settings, with adversary 3 ratios up to 40%. Results demonstrate that PenTiDef consistently outperforms FLARE, FedCC, and other baselines in detection accuracy, F1-score, and con- vergence speed, while providing strong privacy protection and blockchain-level auditability. By jointly addressing decentralization, privacy, and robustness in a single cohesive framework, PenTiDef establishes a new benchmark for deploying trustworthy feder- ated intrusion detection systems in adversarial and heterogeneous IIoT infrastructures. This article is organized as follows in the remaining sections. In Section 2, rele- vant papers on privacy attacks and poisoning attacks against FL-based models, and their defenses are discussed. The threat model is presented in Section 3 to determine the assumption about attackers in our works. Section 4 then discusses the approach and threat model. Next, in Section 5, we outline the research questions and experi- mental scenarios to benchmark the framework. The experimental setups, dataset and evaluation metrics are presented in Section 6. Following that, Section 7 provides the experimental results and analysis of the PenTiDef performance. The discussion on achievement and limitation of our work is mentioned in Section 8. In Section 9, we finally conclude the paper. 2 Related work 2.1 Privacy Attacks in the Context of FL Although FL avoids direct sharing of raw data among participants, it remains sus- ceptible to privacy leakage through exchanged model updates. Prior studies [34–36] have demonstrated that gradients and consecutive model snapshots can inadvertently expose sensitive information about local training data. This vulnerability stems from the fact that deep learning models often encode latent representations beyond the primary task objective. Adversaries can exploit these gradients to perform various inference attacks, aim- ing to recover private information such as class representatives, membership status, sample attributes, and even training inputs or labels. One notable example is the GAN-based attack, where malicious clients leverage Generative Adversarial Networks to synthesize prototypical data from other participants. Another common threat is membership inference, which seeks to determine whether a specific data point was part of a client’s training set. These attacks can be executed passively—by observing model updates or actively, through deliberate manipulation of the training process to amplify information leakage [20]. These findings underscore the importance of incorporating robust gradient protec- tion mechanisms in FL, especially in privacy-sensitive applications such as healthcare, finance, and smart environments. 2.2 Defense Mechanisms Against Privacy Attacks in FL Preserving privacy in FL poses distinct challenges due to decentralized data, sta- tistical heterogeneity, and limited communication reliability. Among the major privacy-preserving strategies proposed, three prominent approaches are Homomorphic 4 Table 1: Comparison between DP categorizations DP type Trusted aggregator Adding noise by Privacy Guarantee CDPYesAggregatorAggregated value LDPNoUserLocally released value DDPNoUserAggregated value Encryption (HE), Secure Multi-Party Computation (SMPC), and Differential Privacy (DP) [20, 40]. HE enables computations on encrypted data without decryption and is catego- rized into Fully, Somewhat, and Partially Homomorphic Encryption. While Fully HE supports arbitrary computations, it is computationally intensive and impractical for real-time FL scenarios. In contrast, Partially HE schemes—such as RSA, El Gamal, and Paillier—are more efficient but limited in function [20]. Despite its theoretical Table 2: Comparison of studies on defending against poisoning attacks in FL Work Attack strategies FL approach Feature Detection mechanism Privacy mechanism Non-IIDDataset ShieldFL [37] +Untargeted: - Label flipping +Targeted: - Label flipping CFL Local model gradient Cosine similarity HE× MNIST KDDCup Amazon FLARE [32] +Untargeted: - Attack-Krum-Untargeted - Attack-TM-Untargeted +Targeted: - Attack-Krum-Backdoor - Attack-Coomed-Backdoor CFLPLR Maximum mean discrepancy -- fMNIST CIFAR-10 Kather FedCC [31] +Untargeted: - Untargeted-Krum - Untargeted-Med +Targeted: - Backdoor CFLPLR CKA similarity with Clustering -- fMNIST CIFAR10 CIFAR100 Liu et al. [38] +Untargeted: - Model poisoning - Plaintext attack - Untargeted-Med +Targeted: - Backdoor injection - GAN DFL Model parameters Low-accuracy detection in (m,n) threshold aggregated models Secret Sharing Differential Privacy Blockchain - KDDCup99 DeepBlockIoTNet [39] +Untargeted: - Model poisoning - Untargeted-Med +Targeted: - Adversarial injection - Server poisoning DFL Encrypted gradient, signature Voting, Model accuracy deviation Public-Key Encryption, Digital Signature, Blockchain - COCO Fed-LSAE [33] +Untargeted: - Label flipping - Weight scaling - Untargeted-Med +Targeted: - GAN CFL Computed LSR from PLR via AE CKA similarity with Clustering of LSRs -× CIC-ToN-IoT N-BaIoT PentiDef (Our) +Untargeted: - Label flipping - Weight scaling - Untargeted-Krum - Untargeted-Med +Targeted: - Backdoor - GAN DFL Computed LSR from PLR via AE CKA similarity with Clustering of LSRs DDP× Edge-IIoTSet CIC-IDS2018 5 appeal, HE incurs substantial memory and runtime overhead, hindering scalability in decentralized FL (DFL). SMPC allows multiple parties to collaboratively compute functions over private inputs without revealing them. For instance, S ̧ahinba ̧s and Catak [41] proposed an SMPC-based framework for FL in healthcare IoT, enabling secure model training while preserving data confidentiality. Similarly, SecureML by Mohassel and Zhang [42] enables distributed model training via secret sharing between non-colluding servers. However, both approaches suffer from high computational and communication costs, making them less suitable for large-scale or resource-constrained environments. In contrast, DP provides a lightweight yet effective privacy mechanism by intro- ducing calibrated noise into data or model updates. DP is commonly categorized into three variants: Centralized DP (CDP), Local DP (LDP), and Distributed DP (DDP), as summarized in Table 1. CDP depends on a trusted aggregator to inject noise after model update collection, which introduces a central point of failure and regulatory concerns. LDP removes the need for a trusted server by having clients perturb data locally; however, it often compromises model accuracy in high-dimensional settings. DDP overcomes the limitations of CDP and LDP by distributing noise addition across participants using stable distributions, such as Gaussian [43] and Binomial [44]. In the context of DFL, DDP enhances privacy without requiring centralized trust, reduces the impact of noise on model utility, and supports scalability. These charac- teristics make DDP particularly suitable for privacy-preserving learning in adversarial and heterogeneous FL environments. 2.3 Poisoning Attacks and Defense Mechanisms in FL Despite its privacy advantages, FL remains vulnerable to poisoning attacks, which aim to degrade global model performance through manipulated client updates. These attacks are typically categorized as data poisoning—where adversaries inject misla- beled or malicious samples into their local datasets—and model poisoning, which involves directly altering model parameters to influence aggregation. Model poison- ing is generally more effective, as it circumvents the need for data manipulation and directly impacts global convergence. Recent studies have explored various attack strategies. Zhang et al. introduced GAN-based attacks [45], where adversaries use the global model as a discriminator to generate malicious samples that appear benign. Building on this, PoisonGAN [46] targets FL in edge computing by injecting adversarial updates crafted via generative models, demonstrating high success rates in both backdoor and label-flipping scenar- ios. Similarly, the PoisonedFL framework [47] utilizes multi-round consistency among malicious clients to evade detection, outperforming multiple state-of-the-art defenses in targeted settings. In response, several defense mechanisms have been proposed. ShieldFL [37] employs homomorphic encryption with cosine similarity scoring and a Byzantine-tolerant aggregation strategy to mitigate poisoning risks. While effective, its cryptographic overhead limits scalability in large-scale deployments. 6 Recent approaches have focused on leveraging latent space representations (LSR) for model-level anomaly detection. FLARE [32] extracts penultimate-layer representa- tions (PLR) using an auxiliary dataset to compute trust scores, filtering out low-trust models. However, its reliance on external data introduces potential privacy leakage and reduces generalizability. FedCC [31] addresses this by using the CKA algorithm to compare local and global PLRs without auxiliary data, clustering models via K- Means. Although FedCC improves resilience against model poisoning, it may suffer from PLR instability in non-IID settings. To overcome these limitations, Fed-LSAE [33] introduces an AutoEncoder-based approach that compresses PLRs into stable LSRs without auxiliary data or prior knowledge. By distinguishing malicious from benign models based on latent character- istics, Fed-LSAE improves detection accuracy in non-IID environments and reduces the risk of false positives. 2.4 Positioning and Advancements over Prior Works While substantial progress has been made in defending federated learning (FL) sys- tems against poisoning attacks, existing solutions remain inadequate for real-world decentralized FL-IDS (DFL-IDS) deployments in heterogeneous Industrial IoT (IIoT) environments. Centralized approaches such as FLARE [32] rely on auxiliary datasets for penultimate-layer representation (PLR) trust scoring, violating strict privacy constraints and limiting generalizability. FedCC [31] mitigates the auxiliary data requirement but suffers from PLR instability under non-IID distributions and still assumes a trusted central aggregator. Although Fed-LSAE [33] advances latent-space inspection via AutoEncoder compression, it inherits the same centralized architecture and lacks explicit privacy guarantees or Byzantine-resilient coordination. PenTiDef advances the state of the art by presenting the first comprehensive framework that simultaneously achieves: • Fully decentralized coordination without any single point of aggregation or trust, enabled by a permissioned blockchain (Hyperledger Fabric) layer with smart- contract-driven model validation, reward/punishment, and immutable audit trails; • Strong client-level privacy through Distributed Differential Privacy (DDP) with stochastic Gaussian noise, providing formal (ε,δ)-guarantees while preserving model utility in high-dimensional IIoT traffic data; • Robust latent-space poisoning detection that extends and stabilizes Fed- LSAE-style representations by integrating AutoEncoder-compressed Latent Seman- tic Representations (LSRs) with Centered Kernel Alignment (CKA) and unsuper- vised clustering—explicitly designed to handle severe non-IID distributions common in multi-site industrial deployments. Crucially, these components are not merely juxtaposed but synergistically inte- grated: DDP-perturbed updates are validated in the latent space on-chain, enabling secure FedAvg aggregation of only benign contributions without auxiliary data or prior knowledge of adversary numbers. This design delivers superior detection 7 performance against both targeted and untargeted poisoning attacks (including adap- tive Krum/Med, backdoor, and GAN-based) under 10–40% adversary ratios, while achieving lower training overhead compared to baselines. Table 2 quantitatively demonstrates that PenTiDef establishes a new Pareto frontier in the joint space of privacy, robustness, decentralization, and scalabil- ity for DFL-IDS—capabilities that no prior work has simultaneously delivered in heterogeneous IIoT settings. 3 Threat model 3.1 Overview For this research, we assume that FL-based IDS is constructed with 20 participating collaborators, setting the number of attackers at 10%, 20% and 40% (equivalent to 2, 4, and 8 attackers, respectively). This proportion ensures that the number of attackers is less than half of the total number of participants. The training consisted of 10 rounds, and the attackers executed poisoning attacks from the very first round until the last. Throughout the global model training process, the remaining participants are considered trustworthy. All trainers are required to participate in FL training, contributing to and fully updating their local models. 3.2 Attack strategy 3.2.1 Untargeted attack 1. Label-flipping attack: is a form of attack where the attacker intentionally changes the labels of training data samples from correct to incorrect, aiming to distort the model training process and reduce the model’s accuracy in classifying data samples. Our ML/DL model is a binary classifier, with benign samples labeled as 0 and attack traffic samples labeled as 1. We simulate an attacker who flips all these labels to their opposite values. 2. Weight Scaling Attack: This attack technique involves the attacker scaling the weights of the local model by a large factor before sending them. The goal of weight scaling is to influence the global model aggregation process, causing undesirable or abnormal changes in the final model. This can lead to a skewed or inaccurate global model, degrading system performance. To simulate this attack, we apply the formula: ̃ w i = λ· w i where: • ̃ w i is the scaled weight of the i-th local model. • w i is the original weight of the i-th local model. • λ is the scaling factor, typically a value greater than 1. 3. Untargeted-Krum [31]: This attack aims to degrade the performance of the global model without a specific target. The attacker sends manipulated but seemingly benign model parameters to maximize their acceptance by the Krum 8 Fig. 1: The PenTiDef architecture for privacy-preserving and anti-poisoning attack mechanisms in DFL-based IDS algorithm. Krum selects the most reliable local model based on the Euclidean dis- tance between model parameters. However, Untargeted-Krum attack attempts to make the malicious parameters resemble benign ones to be selected, harming the global model without easy detection. 4. Untargeted-Med [31]: This attack manipulates model parameters based on the maximum and minimum values of the model parameters so that the median value by coordinate moves in the opposite direction. The goal of Untargeted-Med attacks is to reduce the performance of the global model without a specific target. Attackers can degrade the model’s performance without detection by altering model parameters so that the median coordinate value moves in the opposite direction. This is done by changing parameter values to fall outside the range of benign values. 9 3.2.2 Targeted attack 1. Backdoor [48]: A backdoor attack involves injecting a malicious model into the existing model while maintaining the accuracy of other tasks. This means that the attacked model still performs well on the original tasks, but behaves undesirably when encountering a specific trigger. In our simulation, the backdoor trigger is added to the training data by checking the average value of each sample and chang- ing its label if the average value exceeds a threshold. This can cause the global model to behave unexpectedly when it encounters samples with the trigger during prediction. 2. GAN poisoning attack [49]: This involves using a type of artificial neural network to generate new data that resemble real data. A GAN consists of two sub-networks: a Generator and a Discriminator. The generator creates new data from an input dataset, while the discriminator distinguishes between real and generated data. By introducing fake data, the attacker trains with their malicious local model, thereby degrading and distorting the global model’s classification performance. 4 Proposed Architecture PenTiDef is a fully decentralized, privacy-preserving, and poisoning-resilient frame- work for Federated Intrusion Detection Systems (FL-IDS) in heterogeneous IIoT environments. It integrates three synergistic components into a single secure model aggregation pipeline: (i) client-level Distributed Differential Privacy (DDP) for gradi- ent protection, (i) latent-space anomaly detection for Byzantine robustness, and (i) blockchain-orchestrated coordination for trust and auditability—all executed without a central server or auxiliary datasets. 4.1 Overall Design and Threat Integration Let C = c 1 ,...,c n be the set of collaborating IIoT nodes, each holding a private local dataset D i . At global round t, every node c i computes a local update w t i ← ClientUpdate(w t−1 ,D i ). PenTiDef enforces the following secure aggregation protocol: w t ← PenTiDefAgg ̃ w t i n i=1 , w t−1 where ̃ w t i = w t i + N (0,σ 2 i ) denotes the DDP-perturbed update (detailed in Section 4.3). The aggregation function PenTiDefAgg performs on-chain validation and selective FedAvg as formalized in Algorithm 1. Figure 1 illustrates the end-to-end pipeline. Key architectural components are tightly coupled as follows: • Blockchain Coordination Layer (Hyperledger Fabric): Acts as both immutable ledger and active orchestrator. Smart contracts (chaincode) receive DDP-perturbed updates, invoke latent-space validation, enforce selection of benign models, and record metadata (hash pointers, σ i , trust scores) for auditability. • Latent-Space Defense Module: Extracts penultimate-layer representations (PLRs) from both global model w t−1 and perturbed local models ̃ w t i . These 10 PLRs are compressed into stable Latent Semantic Representations (LSRs) via a lightweight AutoEncoder. Centered Kernel Alignment (CKA) with unsupervised K- Means clustering then identifies and filters poisoned contributions under non-IID conditions. • Privacy Layer (DDP): Gaussian noise is injected locally before any transmission. The perturbed models are used consistently in both latent detection and secure aggregation, ensuring end-to-end privacy without trusted third parties. This design eliminates centralized aggregation risks while guaranteeing that only benign, privacy-protected updates contribute to the global model. 4.2 Unified PenTiDef Aggregation Protocol PenTiDef realizes a fully integrated secure aggregation pipeline that tightly couples client-level privacy protection, latent-space poisoning detection, and blockchain- orchestrated coordination. The complete process is formalized in Algorithm 1. Algorithm 1 PenTiDef: Secure Decentralized Aggregation for Poisoning-Resilient DFL-IDS Require: Global model W t−1 , set of collaborating clients C =c 1 ,...,c n , AutoEn- coder AE Ensure: Aggregated global model W t , index of most aligned client maxidx Phase 0: Client-side Local Training and DDP Perturbation (at each c i ) 1: for each client c i ∈C in parallel do 2: w t i ← ClientUpdate(W t−1 ,D i )▷ local training on private data D i 3: ̃ w t i ← w t i +N (0,σ 2 i I)▷ DDP Gaussian perturbation, σ i ∼ U [0, 0.2] 4:Send ̃ w t i (with signature and σ i ) to blockchain network 5: end for Phase 1: On-chain Latent Representation Analysis 6: for i← 1 to n do 7: plr i ← ̃ w t i [penultimate layer] 8: end for 9: plr g ← W t−1 [penultimate layer] 10: lsr g ← AE.Encoder(plr g ) 11: for i← 1 to n do 12: lsr i ← AE.Encoder(plr i ) 13: cka i ← CKA(lsr g ,lsr i )▷ linear kernel, mean-centered & L2-normalized 14: end for 15: result← KMeans(nclusters = 2,cka i ) 16: benign← result.majority group Phase 2: Secure Aggregation and Blockchain Coordination 17: W t ← FedAvg( ̃ w t i | i∈ benign) 18: maxidx← arg max i cka i 19: Broadcast W t via smart contract to client c max idx for next round return W t , maxidx 11 Algorithm 1 presents the complete PenTiDef protocol. At each client (Phase 0), local model training is immediately followed by Distributed Differential Privacy (DDP) perturbation using the Gaussian mechanism with stochastic noise scale σ i ∈ [0, 0.2]. The resulting perturbed updates ̃ w t i are used consistently in both on-chain latent- space validation (Phase 1) and secure aggregation (Phase 2). This ensures that privacy protection is enforced end-to-end: poisoned or unperturbed updates never enter the aggregation step. The linear-kernel CKA formulation, computed after mean-centering and L2- normalization of the LSRs, provides robust structural similarity measurement that is resilient to both non-IID industrial data distributions and the injected DDP noise. Its superior separation capability compared to cosine or Euclidean metrics has been validated empirically, enabling reliable identification of malicious contributions even under severe heterogeneity and up to 40% adversary ratios. Smart contracts on the permissioned blockchain (Hyperledger Fabric) embed the entire validation logic of Phases 1–2, ensuring that only cryptographically signed, DDP-protected, and latent-verified updates are accepted. This unified design elimi- nates centralized single points of failure while guaranteeing privacy, robustness, and auditability within a single coherent protocol. 4.3 Distributed Differential Privacy Mechanism PenTiDef enforces client-side privacy through Distributed Differential Privacy (DDP) using the Gaussian mechanism. For each local update w t i computed on private dataset D i , the perturbed model is generated as ̃ w t i = w t i +N (0,σ 2 i I), where the noise scale is σ i = p 2 ln(1.25/δ)· ∆ 2 ε , with ∆ 2 being the L 2 -sensitivity of the update function and (ε,δ) the target pri- vacy budget. To increase robustness against adaptive adversaries and free-riders, σ i is stochastically sampled from [0, 0.2] independently at every round and client. This perturbation is applied before transmission (Phase 0 of Algorithm 1), ensur- ing that both latent-space validation and secure aggregation operate exclusively on privacy-protected updates. The chosen noise range maintains model utility while pro- viding meaningful (ε,δ)-guarantees. Each σ i is recorded as on-chain metadata for post-hoc privacy auditing without exposing raw weights. 4.4 Blockchain-Orchestrated Trust Enforcement The blockchain layer serves as the trust and coordination backbone of PenTiDef, replacing any central server. We implement it using a permissioned Hyperledger Fab- ric network with 3 organizations and 6 peer nodes, providing fault tolerance across heterogeneous IIoT administrative domains. 12 Each DDP-perturbed update ̃ w t i is stored off-chain (IPFS) and referenced on-ledger via a cryptographic hash h( ̃ w t i ) together with metadata tuple ⟨h( ̃ w t i ), meta t i ⟩, where meta t i contains round ID, client certificate, σ i , and latent trust score. Smart contracts embed the full validation logic of Algorithm 1 (PLR→LSR→CKA→K-Means filtering) directly into the transaction pipeline: VerifySig(ID i ,τ ) ∧ LatentVerify( ̃ w t i ) ∧ ValidateMeta(meta t i ) =⇒ Append(τ,L). Only verified benign updates proceed to FedAvg aggregation. The resulting global model W t is then distributed via smart contract to the client with the highest CKA score. This design delivers immutable auditability, incentive-compatible participation (through reward/penalty mechanisms), and complete elimination of centralized single points of failure. Together with the DDP mechanism and latent-space module, the blockchain layer forms an interdependent, end-to-end secure protocol that achieves strong pri- vacy, robustness against poisoning, and practical decentralization in adversarial IIoT environments. 4.5 Computational, Communication, and Storage Overhead Analysis To evaluate the practical feasibility of PenTiDef in resource-constrained Industrial IoT (IIoT) and Cyber-Physical Systems (CPS), we analyze its computational, com- munication, and storage overhead based on the unified protocol in Algorithm 1, the experimental setup with n = 20 collaborating clients, and the CNN-based IDS model described in the implementation. Computational Complexity: The dominant cost per global round remains local training at each client (Phase 0), which is identical to standard federated learning: O(E·|B i |· C), where E is the number of local epochs, |B i | is the batch size, and C denotes the cost of a forward-backward pass through the CNN. The additional defense mechanisms introduce the following overhead: • DDP Gaussian perturbation (Phase 0): O(d) per client, where d is the model dimension. • PLR extraction (Phase 1): O(d p ) per model, with d p ≪ d being the penultimate layer dimension. • AutoEncoder encoding for n local models and one global model:O(n·d p ·h), where h is the hidden size of the lightweight AE. • CKA computation (linear kernel) for n clients: O(n · d 2 lsr ), where d lsr is the compressed LSR dimension. • K-Means clustering on n CKA scores with k = 2:O(n·iter) (negligible, as iter < 10). Overall per-round overhead of the latent-space defense and blockchain validation is O(n·d p ·h +n·d 2 lsr ), which is significantly smaller than local training cost. Smart- contract execution on the 6-node Hyperledger Fabric network adds only constant overhead per transaction due to the compact input (CKA scores and metadata). 13 Communication Overhead: Each client uploads exactly one DDP-perturbed model ̃ w t i per round (size ≈ d), the same as vanilla FL. Additional messages consist of signatures, noise parameter σ i , and hash pointers, contributing O(1) per client. The global model broadcast and blockchain consensus occur only within the small permissioned network (6 nodes), not among all n clients. Thus, total communication complexity remains O(n · d) per round, comparable to centralized FL but with- out single-server bottleneck and with validation performed locally within the trusted Fabric network. Storage Overhead: Raw model weights are stored off-chain via IPFS (distributed and content-addressable), while the blockchain ledgerL only maintains compact meta- data and hashes: O(1) storage per update. This results in linear growth of on-chain storage with the number of training rounds, independent of model size. Each edge node only needs to maintain its local model and the latest global model, keeping per-node storage modest and scalable for long-term industrial deployments. In summary, PenTiDef introduces only marginal additional overhead compared to standard FL while delivering substantial gains in privacy, robustness, and decen- tralization. The computational, communication, and storage costs are acceptable for typical IIoT edge gateways and industrial servers, making the framework suitable for practical deployment in heterogeneous Cyber-Physical Systems where both security and operational efficiency are required. 5 Research Questions and Experimental Design 5.1 Research Questions In this section, we address the following research questions (RQ): • RQ1: To what extent does the application of Distributed Differential Privacy (DDP) affect the model’s training performance? • RQ2: How does the PenTiDef framework perform under non-IID data distributions, and how does this performance compare to IID settings? • RQ3: How does PenTiDef compare with existing state-of-the-art defense mecha- nisms in terms of detection accuracy and robustness? • RQ4: How effective is PenTiDef in detecting both untargeted and targeted poisoning attacks under different adversarial conditions? • RQ5: Does PenTiDef achieve cost-efficiency in terms of computational overhead and training time compared to baseline approaches? • RQ6: Is PenTiDef robust across different DL architectures, and does it maintain consistent performance? • RQ7: What is the transaction processing capability of the blockchain coordination layer under different throughput and latency conditions? 5.2 Experimental Scenarios To address the research questions above, we design four experimental scenarios as follows: 14 5.2.1 Scenario 1: Impact of DDP on Model Performance (RQ1) This experiment assesses the effect of applying DDP noise to local models. Specif- ically, we evaluate PenTiDef with and without DDP under controlled noise levels (σ ∈ [0, 0.2]) to determine its impact on convergence and detection accuracy. 5.2.2 Scenario 2: Comparative Evaluation under IID and non-IID Settings (RQ2, RQ3, RQ4, RQ5) This scenario compares PenTiDef with two representative defense mecha- nisms—FLARE [32] and FedCC [31]—under both IID and non-IID data distributions. We simulate poisoning attacks (as defined in Section 3.2) with varying adversary ratios (10%, 20%, 40%) and evaluate the models using multiple performance metrics. Training time is also recorded to assess cost-efficiency. 5.2.3 Scenario 3: Cross-Architecture Robustness Evaluation (RQ5, RQ6) To examine model generalizability, we repeat Scenario 2 using different DL architec- tures—CNN and SqueezeNet. This allows us to evaluate PenTiDef’s stability across heterogeneous model backbones. 5.2.4 Scenario 4: Blockchain Layer Performance Benchmarking (RQ7) This scenario evaluates the transaction processing capacity of the Hyperledger-based blockchain layer used for decentralized coordination. We measure latency, throughput, and success rate under increasing transaction loads (5, 20, and 50 TPS) by executing smart contract operations such as model submission, querying, and verification. 6 Implementation and Evaluation metrics Fig. 2: Details of layers in CNN 6.1 Environmental Setup In this study, our experimental environment is set up on a computer running Windows OS, equipped with an AMD Ryzen 7 6800HS CPU, 16GB DDR RAM. 15 In our implementation, the blockchain coordination layer is realized using Hyper- ledger Fabric, a permissioned blockchain platform that supports modular consensus and fine-grained access control, enabling secure, auditable, and efficient orchestra- tion of decentralized FL processes. For off-chain model parameter storage, PenTiDef integrates the InterPlanetary File System (IPFS) to efficiently manage and retrieve local model updates based on their corresponding hash references maintained on the blockchain ledger. 6.2 Blockchain Architecture and Performance Evaluation Framework In a Hyperledger Fabric network, multiple organizations collaborate to develop and maintain the blockchain system. Each organization typically operates its own cer- tificate authority (CA), which issues identity certificates to both users and system components. Peer nodes, authenticated through their respective organizations’ CAs, maintain copies of the ledger—a distributed and tamper-resistant record of all trans- actions. These nodes are responsible for validating transactions, executing smart contracts (chaincode), and updating their local ledgers accordingly. In addition to peer nodes, the network incorporates an ordering service that sequences transactions chronologically before committing them to the ledger, ensuring consistency across the system. Applications interact with the network through a client software development kit, sending transaction requests to peer nodes and invoking smart contracts to perform operations or query the ledger. Transaction proposals are signed using the user’s iden- tity certificate, endorsed by selected peer nodes, and then submitted to the ordering service. The ordering service packages proposals into blocks, which are distributed to peer nodes for validation and ledger updates. In our study, the network is composed of 3 organizations, each one contains 2 peer nodes. Moreover, to evaluate the network’s performance, we employed Hyperledger Caliper, a benchmarking framework developed by the Linux Foundation that provides standardized and trustworthy performance metrics fully compatible with Hyperledger Fabric. Caliper was used to measure key indicators such as transaction throughput (Transactions Per Second—TPS), transaction latency, and system resource utiliza- tion (CPU and memory consumption), enabling a comprehensive assessment of the system’s deployment efficiency and transaction performance within the Hyperledger Fabric environment. 6.3 Neural Networks for IDS model We use a Convolutional Neural Network (CNN) to carry out the experiment. The model comprises one input layer, 11 hidden layers, and one output layer, as shown in Figure 2. The input layer processes raw data for feature extraction, while the output layer generates classification results. Our model employs the Adam optimizer and the ReLU activation function. Training involves a batch size of 1024 and runs for 5 epochs, with the FL simulation incorporating 20 clients. 16 6.4 Dataset Our benchmarking scenarios utilize two datasets: Edge-IIoTSet [50] and CIC-IDS2018 [51]. After preprocessing, the Edge-IIoTSet dataset consists of 95 features and one label column, with a labeling ratio of roughly 71.4% benign data and 28.6% attack data. In the case of the CIC-IDS2018 dataset, there are 71 features and a label column after preprocessing, with approximately 42.6% benign data and 57.4% attack data. We assign 30% of each dataset for testing to ensure an unbiased evaluation of the per- formance of the model, while the remaining 70% was evenly distributed among the collaborating machines. In addition, we have divided the datasets into IID and non- IID subsets to thoroughly evaluate the performance and robustness of the PenTiDef model under different data distributions. In doing so, our objective is to demonstrate the model’s capability to maintain high accuracy and stability, regardless of the under- lying data distribution, further validating its applicability and reliability in diverse FL applications. The details of the data distribution for the two datasets on iid and non-iid condition are shown in Figure 3 and Figure 4. 6.5 Evaluation Metrics To evaluate the effectiveness of the proposed PenTiDef framework, we adopt four standard metrics commonly used in binary classification tasks: Accuracy, Precision, Recall, and F1-Score. Accuracy measures the overall proportion of correctly classified samples. Precision reflects the proportion of correctly predicted positive instances among all predicted positives. Recall quantifies the model’s ability to identify actual positive instances. F1-Score represents the harmonic mean of Precision and Recall, offering a balanced measure in cases of class imbalance. These metrics are derived from the confusion matrix composed of true positives, true negatives, false positives, and false negatives. They provide a comprehensive view of model performance in distinguishing between benign and malicious traffic. In addition, we employ the Centered Kernel Alignment (CKA) Score to measure the similarity between latent representations of local and global models. This metric is particularly useful for evaluating the consistency of feature space across participants and identifying anomalies introduced by poisoned updates. Based on this measure, we can distinguish and eliminate poisoned models from the update process. A higher CKA score indicates that the local model is closer to the global model. 7 Experimental Results and Analysis 7.1 Result 1 (Answer to Scenario 1): PenTiDef maintains high performance under DDP with minimal accuracy degradation The performance of the PenTiDef model under two conditions, without applying DDP (non-DDP) and with applying DDP, is shown in Figure 5, demonstrating a distinct difference in the initial stage. Initially, when applying DDP, the training performance 17 (a) IID (b) non-IID Fig. 3: Data distribution of the Edge-IIoTSet dataset under IID and non-IID scenarios Table 3: Performance comparison of defense methods on IID datasets for detecting untargeted attacks Adversaries 10%Adversaries 20%Adversaries 40% DatasetAttackNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDef CIC-IDS2018 LF0.770.960.960.970.750.930.950.960.710.920.950.96 WS0.760.950.950.960.760.970.950.960.680.920.960.96 Un-Krum0.730.950.970.960.720.950.960.970.640.960.880.93 Un-Med0.730.960.960.980.650.950.930.980.670.910.920.97 Edge-IIoTset LF0.650.990.980.980.630.920.960.970.570.880.880.92 WS0.640.950.960.950.630.950.970.950.580.910.880.95 Un-Krum0.670.940.940.950.670.980.910.960.580.910.870.93 Un-Med0.730.940.960.970.640.880.930.990.560.880.880.95 18 (a) IID (b) non-IID Fig. 4: Data distribution of the CIC-IDS2018 dataset under IID and non-IID scenarios Table 4: Performance comparison of defense methods on IID datasets for detecting targeted attacks Adversaries 10%Adversaries 20%Adversaries 40% DatasetAttackNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDef CIC-IDS2018 GAN-SL0.680.960.950.970.670.930.950.970.570.900.930.94 GAN-ML0.730.970.960.960.730.950.960.960.630.930.960.97 GAN-Con0.740.950.960.970.740.950.960.970.560.880.930.95 BD0.690.960.960.970.690.960.960.970.590.940.920.94 Edge-IIoTset GAN-SL0.580.930.920.920.580.930.920.930.580.930.930.94 GAN-ML0.630.930.940.930.630.930.950.930.630.920.930.94 GAN-Con0.600.920.920.930.600.960.900.950.600.930.920.94 BD0.590.920.930.930.590.880.910.930.590.940.940.95 19 Fig. 5: Comparison of training results with and without applying DDP Table 5: Performance comparison of defense methods on non-IID datasets for detect- ing untargeted attacks Adversaries 10%Adversaries 20%Adversaries 40% DatasetAttackNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDef CIC-IDS2018 LF0.360.920.930.950.460.910.930.940.410.900.920.93 WS0.420.930.930.940.470.930.910.920.410.900.920.93 Un-Krum0.400.900.930.940.440.920.920.930.400.920.840.89 Un-Med0.430.910.910.940.440.920.920.930.400.870.880.95 Edge-IIoTset LF0.370.910.900.900.370.920.930.940.370.840.850.88 WS0.440.890.910.910.410.910.930.920.440.870.860.91 Un-Krum0.460.900.900.910.430.940.890.920.440.870.830.89 Un-Med0.510.910.890.940.400.840.890.950.420.840.840.91 is lower than non-DDP due to DDP adding noise to the model to protect privacy, resulting in a slower convergence rate. In the early training rounds, the PenTiDef model with DDP shows slower growth and lower metrics compared to non-DDP. However, in the subsequent rounds, the DDP model gradually converges and reaches stability, though still approximately 0.01 lower than non-DDP across all criteria. These results demonstrate that PenTiDef maintains high and stable performance even when applying DDP, reflecting a balance between security and performance. PenTiDef is capable of adapting and operating efficiently in decentralized FL envi- ronments, ensuring security while maintaining high accuracy in detecting network threats. 7.2 Result 2 (Answer to Scenario 2): PenTiDef outperforms state-of-the-art defenses across IID and non-IID data under multiple poisoning attacks Training on IID Datasets The results in Table 3 demonstrate that PenTiDef outperforms other models in most cases for untargeted attacks. Specifically, PenTiDef consistently achieves the highest or near-highest values in evaluation criteria such as Accuracy, Precision, Recall, and F1-Score. This is evident across all levels of adversarial presence, showing that PenTiDef maintains stable and superior performance even as the adversary rate increases. PenTiDef’s performance remains robust when facing 20 various types of attacks, especially in cases like Untargeted-Med and Un-Krum, where it frequently achieves the highest performance. This highlights the effectiveness of PenTiDef in detecting and defending against untargeted poisoning attacks. Table 4 lists the parameters of the defense methods against targeted attacks. Overall, all three defense methods show a comparison to detecting untargeted attacks. This can be explained by the fact that targeted attacks are harder to detect. Tar- geted attacks are designed specifically for each target, utilizing evasion techniques, exploiting zero-day vulnerabilities, and employing APTs. Attackers often patiently gather intelligence, maintain long-term persistence, and leverage insider threats, mak- ing them significantly more challenging to identify. In contrast, untargeted attacks are more widespread, relying on common tools and techniques, which makes them easier to detect. Targeted attacks often have sophisticated characteristics and specific goals, such as skewing predictions for a particular type of input without significantly alter- ing the model’s overall performance. These small and subtle changes require defense methods to be highly sensitive. Nonetheless, our model still achieves the highest performance in most of these attacks. Table 6: Performance comparison of defense methods on non-IID datasets for detect- ing targeted attacks Adversaries 10%Adversaries 20%Adversaries 40% DatasetAttackNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDefNo-DefFlareFedCC PenTiDef CIC-IDS2018 GAN-SL0.550.910.910.920.450.910.910.920.520.880.880.89 GAN-ML0.530.920.940.920.450.910.930.920.500.890.910.89 GAN-Con0.530.940.940.950.460.930.930.500.910.910.920.92 BD0.540.930.930.950.460.930.920.930.510.900.900.92 Edge-IIoTset GAN-SL0.550.910.890.890.460.910.890.900.520.880.860.86 GAN-ML0.560.910.930.910.460.910.930.900.530.880.900.88 GAN-Con0.560.920.920.930.440.920.920.930.530.890.890.90 BD0.550.910.910.950.440.910.910.940.520.880.880.92 Fig. 6: Similarity comparison between the latent space of the global model and each local model’s latent space using CKA scores in PenTiDef and FedCC. 21 To explain the stability in classifying benign and malicious models, as shown in Figure 6, we have compiled the CKA scores for each participant with an attacker ratio of 40% (the last 8 collaborators) using the Untargeted-Krum attack method. These figures were recorded after the final training round. We compare the CKA scores of the two modules, PenTiDef and the module using a similar CKA scoring method, FedCC [31]. It is easily noticeable that there is a significant difference between the CKA scores of benign and malicious LSRs compared to the LSR of the global model. For collab- orators from clients 1 to 12 (assumed to be benign), PenTiDef maintains a high level of similarity with CKA scores mostly above 0.8, demonstrating its ability to maintain stability in identifying benign models. On the contrary, the CKA scores for collab- orators from clients 13 to 20 (assumed to be malicious) show a significant decline, mostly below 0.6, with some even below 0.5. This indicates that PenTiDef can effec- tively distinguish between benign and malicious models, even with an attacker ratio of 40%. Meanwhile, FedCC does not exhibit a clear distinction like PenTiDef, result- ing in poorer classification performance. This explains why PenTiDef achieves higher performance in most scenarios compared to FedCC. Training on non-IID Dataset For the case of training on the non-IID hetero- geneous dataset, the data distribution among the 20 collaborating models is divided as shown in Figure 3b and Figure 4b. Similar to the previous case, the following scenarios are simulated with attacker ratios of 10%, 20%, and 40%. Using a non-IID dataset is crucial because, in real-world FL scenarios, data across different clients is inherently non-IID due to variations in user behavior, device environments, and data collection methods. This non-uniformity presents a greater challenge for defense mech- anisms, as the differences in local data distributions can lead to model divergence and increased vulnerability to adversarial manipulations. Moreover, non-IID data can obscure attack patterns, making it harder for defenses to differentiate between nat- ural variations in data and malicious manipulations. The reason for distributing the Fig. 7: Compare the similarity between the latent space of the global model and each local model’s latent space using CKA scores in PenTiDef and FedCC. 22 dataset in this manner is to clarify the differences between the defense methods in distinguishing malicious models when trained on a non-IID dataset. Regarding the results summarized in Table 5, it can be observed that due to the influence of the heterogeneous data distribution, the performance results of all three defense modules experience a slight decline. However, our PenTiDef model still achieves the highest performance in most attack scenarios. Table 6 shows us that PenTiDef remains the model with the most stable per- formance compared to the other two attack methods, although all three modules experience a decrease in accuracy due to the influence of the non-IID dataset. Specifi- cally, PenTiDef often achieves the highest or near-highest values in most attacks, such as LF, WS, Untargeted-Krum, and Untargeted-Med. This demonstrates PenTiDef’s good capability in distinguishing between benign and malicious models. Even as the ratio of attackers increases, PenTiDef maintains high performance, showing the stabil- ity and effectiveness of this method in protecting the system from poisoning attacks. Compared to other methods, PenTiDef always shows a clear difference in metrics. PenTiDef effectively preserves this consistency by ensuring that benign models retain high CKA scores while isolating adversarial updates. In contrast, FedCC struggles to maintain stable CKA scores, particularly in non-IID environments. The uneven data distribution introduces variations in local model updates, leading to inconsisten- cies that FedCC fails to manage effectively. This lack of stability causes difficulties in distinguishing between benign and malicious models, ultimately reducing FedCC’s detection accuracy. In summary, PenTiDef stands out as a robust and reliable defense method in pro- tecting distributed ML systems from poisoning attacks. Similar to the statistics in the IID case, targeted attacks in the non-IID case also slightly reduce the performance of all three modules. As seen in Figure 7, due to the impact of the uneven data distri- bution, the CKA scores for the benign clients have decreased (by approximately 0.1). The CKA scores of FedCC show a lack of stability and clarity in classifying malicious and benign models. This explains why the PenTiDef model has higher performance in most scenarios compared to FedCC. Finally, to address the question of cost efficiency, Table 7 summarizes the training time of each defense model. It can be seen that our PenTiDef model has a significantly Table 7: Average training time on different datasets with different models DatasetModelTraining Time CIC-IDS2018 Flare3,907s∼ 01h 06m FedCC2,460s∼ 41m PenTiDef 1,988s∼ 33m Edge-IIoTset Flare4,395s∼ 1h 15m FedCC2,825s∼ 47m PenTiDef 1,869s∼ 31m 23 Table 8: Performance Comparison of the PenTiDef module on the CIC-IDS2018 and Edge-IIoTset datasets with two DL models, CNN and SqueezeNet (untargeted attack) DatasetAttack 10% adv20% adv40% adv CNN SqueezeNet CNN SqueezeNet CNN SqueezeNet IID CIC-IDS2018 LF0.970.980.970.980.940.96 WS0.960.950.960.970.960.97 Un-Krum0.960.970.970.980.930.94 Un-Med0.980.970.970.960.970.98 Edge-IIoTset LF0.980.970.970.980.920.95 WS0.980.970.950.960.950.96 Un-Krum0.940.950.930.940.890.90 Un-Med0.980.970.990.980.950.97 non-IID CIC-IDS2018 LF0.950.970.940.950.930.95 WS0.940.930.920.940.930.94 Un-Krum0.940.920.930.950.950.94 Un-Med0.940.930.930.920.950.94 Edge-IIoTset LF0.900.890.940.930.930.94 WS0.910.920.920.910.910.90 Un-Krum0.910.920.920.900.890.90 Un-Med0.940.950.950.930.910.90 faster training time compared to the other two models, namely FedCC and FLARE. This can be explained as follows: • Firstly, the FLARE model uses an algorithm to compute the distance between two PLR vectors. Due to the complexity of this algorithm, FLARE has the slowest training time compared to the other two defense models. • Secondly, the FedCC model operates more similarly to our model than FLARE. However, FedCC calculates similarity based on PLRs using CKA scores, whereas our model computes it based on LSRs extracted from PLRs through an AE. Therefore, our model achieves the fastest training time, addressing the issue of resource cost and enhancing scalability in distributed FL environments. 7.3 Result 3 (Answer to Scenario 3): PenTiDef demonstrates model-agnostic robustness across CNN and SqueezeNet architectures For this scenario, we conduct experiments on the attack scenarios to test the per- formance of the PenTiDef module. This time, we conduct the experiments on two DL models, including CNN and SqueezeNet. This aims to evaluate the detection and 24 Table 9: Performance comparison of the PenTiDef module on the CIC-IDS2018 and Edge-IIoTset datasets with two DL models, CNN and SqueezeNet (untargeted attack) DatasetAttack 10% adv20% adv40% adv CNN SqueezeNet CNN SqueezeNet CNN SqueezeNet IID CIC-IDS2018 GAN-SL0.970.960.970.970.940.95 GAN-ML0.960.950.960.970.970.96 GAN-Con0.970.960.970.980.950.96 BD0.970.960.970.960.940.95 Edge-IIoTset GAN-SL0.920.930.930.940.950.94 GAN-ML0.930.940.930.940.950.94 GAN-Con0.930.950.950.940.950.94 BD0.950.970.970.960.950.94 non-IID CIC-IDS2018 GAN-SL0.920.930.940.930.920.93 GAN-ML0.920.910.920.910.920.94 GAN-Con0.950.930.930.940.950.94 BD0.950.930.930.940.950.94 Edge-IIoTset GAN-SL0.890.880.890.900.890.90 GAN-ML0.910.900.910.900.910.92 GAN-Con0.930.920.920.930.930.90 BD0.950.940.950.940.950.96 Table 10: Benchmark results of the Hyperledger Fabric network with 5000 transac- tions 5 transactions/s NameSuccFailSend Rate (TPS)Max Latency (s)Min Latency (s)Avg Latency (s)Throughput (TPS) CreateModel5000028.12.100.030.2128.0 QueryAllModels5000064.10.290.040.1064.1 QueryLastModel50000127.00.280.020.05126.9 QueryModelsBySelectedClientID50000114.40.250.020.06114.3 QueryModelsByModelIndex5000097.80.340.020.0697.7 QueryModelsByAdversaryClientID5000086.40.490.020.0786.4 QueryModelsByBenignClientID5000078.90.250.020.0878.9 20 transactions/s NameSuccFailSend Rate (TPS)Max Latency (s)Min Latency (s)Avg Latency (s)Throughput (TPS) CreateModel5000086.52.090.030.1284.5 QueryAllModels5000082.10.320.040.1782.1 QueryLastModel50000158.80.270.020.10158.6 QueryModelsBySelectedClientID50000151.10.280.020.10151.0 QueryModelsByModelIndex50000177.70.220.020.09177.5 QueryModelsByAdversaryClientID50000129.80.530.020.10129.6 QueryModelsByBenignClientID50000113.90.460.020.12113.8 25 Table 11: Benchmark results of the Hyperledger Fabric network with 10000 transac- tions 5 transactions/s NameSuccFailSend Rate (TPS)Max Latency (s)Min Latency (s)Avg Latency (s)Throughput (TPS) CreateModel10000027.62.090.020.2227.5 QueryAllModels10000032.80.450.070.1832.8 QueryLastModel10000069.90.250.030.0969.9 QueryModelsBySelectedClientID10000057.20.360.040.1257.2 QueryModelsByModelIndex10000067.70.250.030.1067.7 QueryModelsByAdversaryClientID10000047.00.500.030.1547.0 QueryModelsByBenignClientID10000048.90.430.040.1348.9 20 transactions/s NameSuccFailSend Rate (TPS)Max Latency (s)Min Latency (s)Avg Latency (s)Throughput (TPS) CreateModel10000033.12.070.030.1133.7 QueryAllModels10000039.40.670.070.3539.4 QueryLastModel10000091.50.450.040.1691.5 QueryModelsBySelectedClientID10000043.91.230.050.3643.9 QueryModelsByModelIndex10000071.40.550.030.2171.4 QueryModelsByAdversaryClientID10000045.90.970.050.3445.9 QueryModelsByBenignClientID10000047.41.000.060.3147.4 defense capabilities of PenTiDef on different neural network architectures, thereby determining the stability and effectiveness of the module in various conditions and environments. We conduct experiments on both IID and non-IID cases with (Table 8) and targeted attacks (Table 9). Similar to scenario 3, the model performs most stably in detecting untargeted attacks on the IID dataset and shows the most fluctuation in the non-IID dataset with targeted attacks. Based on the statistics tables, the CNN model often achieves higher or equal results compared to SqueezeNet in many different attack scenarios. This indicates that CNN tends to perform more effectively than SqueezeNet in the tested scenarios. However, both models have good detection and defense capabilities, but the stability and effec- tiveness of the model can be influenced by the type of attack and the data structure used. Notably, our PenTiDef module has demonstrated stability and flexibility by per- forming well across various DL models. This shows that PenTiDef not only has strong detection and defense capabilities but can also be flexibly applied to different neural network architectures. The ability to adapt to different models and maintain stable performance proves that PenTiDef is a comprehensive and effective defense solution in protecting DFL-IDS from potential attacks. 26 7.4 Result 4 (Answer to Scenario 4): The blockchain coordination layer remains efficient and stable under increasing transaction loads In each evaluation, we executed all the tasks defined in the chaincode to interact with the system, including: CreateModel, GetAllModels, GetLastModel, QueryMod- elsBySelectedClientID, QueryModelsByModelIndex, QueryModelsByAdversaryClien- tID, QueryModelsByBenignClientID. Transactions are sent continuously, increasing from 5 to 20 transactions per second, to the system for evaluation. Tables 10 and 11 present the benchmark results of the Hyperledger Fabric net- work with 5000 and 10000 transactions. In terms of stability, both tables show the network’s stability, with all transactions being successful. As the number of transac- tions increased from 5000 to 10000, the sending rate tended to decrease, especially at the rate of 5 transactions per second. The average and maximum latency slightly increased with the higher number of transactions, likely due to the heavier load on the network. The throughput remained relatively high and stable, demonstrating the good performance of the Hyperledger Fabric network in handling transactions. Overall, the Hyperledger Fabric network showed good performance at both load levels of 5000 and 10000 transactions, with all transactions being successful and high throughput. 8 Discussion The experimental results demonstrate that PenTiDef achieves a superior balance among privacy protection, robustness against poisoning attacks, and decentralization for Federated Intrusion Detection Systems (FL-IDS) in heterogeneous Industrial IoT (IIoT) environments. By consistently outperforming FLARE and FedCC across both IID and realistic non-IID settings on CIC-IDS2018 and Edge-IIoTSet, with adver- sary ratios up to 40%, PenTiDef delivers higher detection accuracy and F1-score against a wide spectrum of poisoning attacks, including label-flipping, weight-scaling, Krum/Med variants, backdoor, and GAN-based strategies, while incurring lower overall training overhead. These improvements arise directly from the synergis- tic integration of client-side Distributed Differential Privacy (DDP), latent-space anomaly detection (AE-compressed LSRs with CKA clustering), and blockchain- orchestrated validation, which together enable secure FedAvg aggregation without requiring auxiliary datasets, prior knowledge of adversary numbers, or a central server. From a practical perspective, PenTiDef addresses critical deployment barriers in multi-site IIoT infrastructures. The elimination of centralized aggregation mit- igates single points of failure and enhances fault tolerance across administrative domains. The immutable ledger and smart-contract enforcement provide transpar- ent auditability and incentive-compatible participation, features particularly valuable for collaborative cybersecurity among untrusted industrial partners. Moreover, the stochastic DDP mechanism with bounded noise (σ ∈ [0, 0.2]) delivers meaningful (ε,δ)-guarantees while preserving model utility, as evidenced by only marginal conver- gence degradation. The latent-space module further stabilizes representation learning under severe non-IID distributions—common in heterogeneous sensors, protocols, and 27 production workflows—thereby improving generalizability beyond what centralized or semi-decentralized baselines can achieve. Despite these advancements, several limitations warrant acknowledgment. First, evaluations are currently limited to binary classification tasks. While effective for distinguishing benign versus malicious traffic, extending PenTiDef to multi-class or multi-label attack categorization is necessary for fine-grained threat intelligence in real-world IIoT deployments. Second, although the framework demonstrates strong resilience against the tested poisoning strategies, its performance against highly adap- tive or stealthy attacks—such as dynamic backdoors, model inversion combined with poisoning, or collusion among malicious nodes—remains to be fully characterized. Third, the blockchain layer, while lightweight in the current 6-node Fabric setup, introduces additional communication and computational overhead that may become non-negligible at larger scales (hundreds of edge devices) or under constrained IIoT hardware. Finally, the fixed noise bound in DDP, while practical, creates a potential trade-off surface that could be exploited by free-rider or noise-injection adversaries if not dynamically adjusted based on observed trust scores. Future research directions include: (i) adaptive noise scheduling mechanisms that leverage latent-space trust feedback to optimize the privacy-utility trade-off on-the-fly; (i) integration of explainable AI (XAI) techniques to interpret CKA-based decisions and improve operator trust; (i) large-scale experiments with real IIoT testbeds (e.g., using ns-3 or physical edge devices) to assess energy consumption, straggler toler- ance, and cross-domain generalization; and (iv) formal verification of smart-contract security properties and composition theorems for the end-to-end privacy guarantees. A comprehensive cost-benefit analysis encompassing transaction throughput, latency under varying loads, and resource footprints on resource-constrained gateways would further guide industrial adoption. In conclusion, PenTiDef represents a significant step toward practical, trustworthy decentralized FL-IDS by holistically addressing the intertwined challenges of privacy leakage, poisoning vulnerability, and centralized coordination risks in heterogeneous IIoT ecosystems. With continued refinement and real-world validation, the framework holds strong potential to enable secure collaborative intrusion detection across critical industrial infrastructures. 9 Conclusion and Future Directions This paper presented PenTiDef, a fully decentralized, privacy-preserving, and poisoning-resilient framework for Federated Intrusion Detection Systems tailored to heterogeneous Industrial IoT (IIoT) environments. By synergistically integrating client-side Distributed Differential Privacy (DDP) with stochastic Gaussian noise, a latent-space anomaly detection module based on AutoEncoder-compressed Latent Semantic Representations (LSRs) and Centered Kernel Alignment (CKA) cluster- ing, and a blockchain-orchestrated coordination layer built on Hyperledger Fabric, PenTiDef effectively addresses three fundamental challenges in decentralized FL-IDS: gradient leakage, malicious model updates, and centralized single points of failure. 28 Extensive experiments on CIC-IDS2018 and Edge-IIoTSet under both IID and realistic non-IID data distributions demonstrate that PenTiDef consistently outper- forms state-of-the-art defenses such as FLARE and FedCC. The framework achieves higher detection accuracy and F1-score across diverse poisoning attacks (label-flipping, weight-scaling, Krum/Med, backdoor, and GAN-based) with adversary ratios up to 40%, while maintaining competitive training efficiency and only marginal utility loss from DDP perturbation. These results validate the effectiveness of the proposed unified secure aggregation protocol, which operates without auxiliary datasets, prior adver- sary knowledge, or a trusted central server. While PenTiDef advances the state of the art in decentralized and privacy-preserving FL-IDS, certain limitations remain. The current evaluation focuses on binary classification, and its resilience against highly adaptive or collusive attacks requires further characterization. In addition, the com- putational and communication overhead of the blockchain layer at very large scales needs deeper investigation, particularly on resource-constrained IIoT devices. Future work will extend PenTiDef to multi-class and multi-label intrusion detec- tion, incorporate adaptive noise scheduling and explainable AI techniques to further optimize the privacy-utility trade-off, and conduct large-scale evaluations on physi- cal IIoT testbeds. Formal verification of the smart-contract logic and comprehensive cost-benefit analyses will also be pursued to facilitate industrial adoption. In conclu- sion, PenTiDef provides a practical and scalable foundation for secure collaborative intrusion detection in adversarial, heterogeneous IIoT ecosystems. By holistically addressing privacy, robustness, and decentralization, the framework offers a promising pathway toward trustworthy federated learning solutions for critical cyber-physical systems, including smart manufacturing, energy grids, and other distributed infras- tructures. References [1] Alabadi, M., Habbal, A., Wei, X.: Industrial internet of things: Requirements, architecture, challenges, and future research directions. IEEE Access 10, 66374– 66400 (2022) [2] Chen, B., Wang, Y., Santos, L., Yang, X., Liu, C., Im, S.-K.: A four-paradigm taxonomy and systematic survey of blockchain-enabled intrusion detection sys- tems for iot and iiot. IEEE Internet of Things Journal 13(10), 20312–20338 (2026) https://doi.org/10.1109/JIOT.2026.3662349 [3] Afrin, S., Rafa, S.J., Kabir, M., Farah, T., Alam, M.S.B., Lameesa, A., Ahmed, S.F., Gandomi, A.H.: Industrial internet of things: Implementations, challenges, and potential solutions across various industries. Computers in Industry 170, 104317 (2025) [4] Rezaei, H., Taheri, R., Nowroozi, E., Hajizadeh, M., Shiaeles, S., Bauschert, T.: A survey on security and privacy in federated learning-based intrusion detection systems for 5g and beyond networks. IEEE Open Journal of the Communications Society 7, 253–300 (2026) https://doi.org/10.1109/OJCOMS.2025.3644477 29 [5] Hakeem, S.A.A., Kim, H.: Advancing intrusion detection in v2x networks: A comprehensive survey on machine learning, federated learning, and edge ai for v2x security. IEEE Transactions on Intelligent Transportation Systems (2025) [6] Nkoro, E.C., Njoku, J.N., Nwakanma, C.I., Lee, J.M., Kim, D.-S.: Metawatch: Trends, challenges, and future of network intrusion detection in the metaverse. IEEE Internet of Things Journal 12(16), 32469–32492 (2025) https://doi.org/10. 1109/JIOT.2025.3568477 [7] Agrawal, S., Sarkar, S., Aouedi, O., Yenduri, G., Piamrat, K., Bhattacharya, S., Maddikunta, P.K.R., Gadekallu, T.R.: Federated Learning for Intrusion Detection System: Concepts, Challenges and Future Directions (2021) [8] Khan, L.U., Saad, W., Han, Z., Hossain, E., Hong, C.S.: Federated Learning for Internet of Things: Recent Advances, Taxonomy, and Open Challenges (2021) [9] Vahabi, M., Fotouhi, H., et al.: Federated learning at the edge in industrial inter- net of things: A review. Sustainable Computing: Informatics and Systems 46, 101087 (2025) [10] Issa, W., Moustafa, N., Turnbull, B., Sohrabi, N., Tari, Z.: Blockchain-based federated learning for securing internet of things: A comprehensive survey. ACM Computing Surveys 55(9), 1–43 (2023) [11] Hu, Y., Zhou, Y., Xiao, J., Wu, C.: GFL: A Decentralized Federated Learning Framework Based On Blockchain (2021) [12] Qu, Y., Uddin, M.P., Gan, C., Xiang, Y., Gao, L., Yearwood, J.: Blockchain- enabled federated learning: A survey. ACM Computing Surveys 55(4), 1–35 (2022) [13] Quan, M.K., Pathirana, P.N., Wijayasundara, M., Setunge, S., Nguyen, D.C., Brinton, C.G., Love, D.J., Vincent Poor, H.: Federated learning for cyber physical systems: A comprehensive survey. IEEE Communications Surveys & Tutorials 28, 3751–3790 (2026) https://doi.org/10.1109/COMST.2025.3570288 [14] Fu, J., Hong, Y., Ling, X., Wang, L., Ran, X., Sun, Z., Wang, W.H., Chen, Z., Cao, Y.: Differentially private federated learning: A systematic review. ACM Computing Surveys 58(11), 1–38 (2026) [15] Zuo, J., Zhang, L., Xie, W., Lu, Y., Wen, X.: A data privacy risk assessment model for federated learning in the internet of vehicles. IEEE Transactions on Vehicular Technology, 1–12 (2026) https://doi.org/10.1109/TVT.2026.3665794 [16] Fang, H., Qian, Q.: Privacy preserving machine learning with homomorphic encryption and federated learning. Future Internet 13(4) (2021) 30 [17] Liu, F., Zheng, Z., Shi, Y., Tong, Y., Zhang, Y.: A survey on federated learning: a perspective from multi-party computation. Frontiers of Computer Science 18(1), 181336 (2024) [18] Kalapaaking, A.P., Khalil, I., Yi, X.: Blockchain-based federated learning with smpc model verification against poisoning attack for healthcare systems. IEEE Transactions on Emerging Topics in Computing 12(1), 269–280 (2024) https: //doi.org/10.1109/TETC.2023.3268186 [19] Mohassel, P., Zhang, Y.: SecureML: A System for Scalable Privacy-Preserving Machine Learning. Cryptology ePrint Archive, Paper 2017/396 (2017) [20] Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., Yu, P.S.: Privacy and robustness in federated learning: Attacks and defenses. IEEE Transactions on Neural Networks and Learning Systems, 1–21 (2022) https://doi.org/10.1109/ TNNLS.2022.3216981 [21] Nowroozi, E., Haider, I., Taheri, R., Conti, M.: Federated learning under attack: Exposing vulnerabilities through data poisoning attacks in computer networks. IEEE Transactions on Network and Service Management 22(1), 822–831 (2025) https://doi.org/10.1109/TNSM.2025.3525554 [22] Uddin, M.P., Xiang, Y., Hasan, M., Bai, J., Zhao, Y., Gao, L.: A systematic lit- erature review of robust federated learning: Issues, solutions, and future research directions. ACM Computing Surveys 57(10), 1–62 (2025) [23] Li, X., Qu, Z., Zhao, S., Tang, B., Lu, Z., Liu, Y.: Lomar: A local defense against poisoning attack on federated learning. IEEE Transactions on Dependable and Secure Computing 20(1), 437–450 (2021) [24] Yan, B., Jiang, X., Chen, Y., Gao, C., Liu, X.: Afl-cs: Asynchronous federated learning with cosine similarity-based penalty term and aggregation. In: 2023 IEEE 29th International Conference on Parallel and Distributed Systems (ICPADS), p. 46–53 (2023). https://doi.org/10.1109/ICPADS60453.2023.00016 [25] Jithish, J., Alangot, B., Mahalingam, N., Yeo, K.S.: Distributed anomaly detec- tion in smart grids: A federated learning-based approach. IEEE Access 11, 7157–7179 (2023) https://doi.org/10.1109/ACCESS.2023.3237554 [26] Li, C.-J., Huang, P.-H., Ma, Y.-T., Hung, H., Huang, S.-Y.: Robust aggregation for federated learning by minimum γ-divergence estimation. Entropy 24(5), 686 (2022) [27] Li, S., Ngai, E., Voigt, T.: Byzantine-robust aggregation in federated learning empowered industrial iot. IEEE Transactions on Industrial Informatics 19(2), 1165–1175 (2021) 31 [28] Pillutla, K., Kakade, S.M., Harchaoui, Z.: Robust aggregation for federated learning. IEEE Transactions on Signal Processing 70, 1142–1154 (2022) https: //doi.org/10.1109/TSP.2022.3153135 [29] Zhu, H., Xu, J., Liu, S., Jin, Y.: Federated learning on non-iid data: A survey. Neurocomputing 465, 371–390 (2021) [30] Zhao, Z., Feng, C., Hong, W., Jiang, J., Jia, C., Quek, T.Q., Peng, M.: Federated learning with non-iid data in wireless networks. IEEE Transactions on Wireless communications 21(3), 1927–1942 (2021) [31] Jeong, H., Son, H., Lee, S., Hyun, J., Chung, T.-M.: Fedcc: Robust federated learning against model poisoning attacks. arXiv preprint arXiv:2212.01976 (2022) [32] Wang, N., Xiao, Y., Chen, Y., Hu, Y., Lou, W., Hou, Y.T.: Flare: defending federated learning against model poisoning attacks via latent space representa- tions. In: Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, p. 946–958 (2022) [33] Luong, T.D., Tien, V.M., Quyen, N.H., Hien, D.T.T., Duy, P.T., Pham, V.-H.: Fed-lsae: Thwarting poisoning attacks against federated cyber threat detection system via autoencoder-based latent space inspection. Journal of Information Security and Applications 87, 103916 (2024) [34] Melis, L., Song, C., De Cristofaro, E., Shmatikov, V.: Exploiting unintended fea- ture leakage in collaborative learning. In: 2019 IEEE Symposium on Security and Privacy (SP), p. 691–706 (2019). https://doi.org/10.1109/SP.2019.00029 [35] Phong, L.T., Aono, Y., Hayashi, T., Wang, L., Moriai, S.: Privacy-preserving deep learning via additively homomorphic encryption. IEEE Transactions on Infor- mation Forensics and Security 13(5), 1333–1345 (2018) https://doi.org/10.1109/ TIFS.2017.2787987 [36] Zhu, L., Liu, Z., Han, S.: Deep leakage from gradients. In: Wallach, H., Larochelle, H., Beygelzimer, A., Alch ́e-Buc, F., Fox, E., Garnett, R. (eds.) Advances in Neural Information Processing Systems, vol. 32. Curran Associates, Inc., ??? (2019) [37] Ma, Z., Ma, J., Miao, Y., Li, Y., Deng, R.H.: Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning. IEEE Transactions on Informa- tion Forensics and Security 17, 1639–1654 (2022) https://doi.org/10.1109/TIFS. 2022.3169918 [38] Liu, H., Zhang, S., Zhang, P., Zhou, X., Shao, X., Pu, G., Zhang, Y.: Blockchain and federated learning for collaborative intrusion detection in vehicular edge com- puting. IEEE Transactions on Vehicular Technology 70(6), 6073–6084 (2021) https://doi.org/10.1109/TVT.2021.3076780 32 [39] Rathore, S., Park, J.H.: A blockchain-based deep learning approach for cyber security in next generation industrial cyber-physical systems. IEEE Transactions on Industrial Informatics 17(8), 5522–5532 (2021) https://doi.org/10.1109/TII. 2020.3040968 [40] Shi, Z., Yang, Z., Hassan, A., Li, F., Ding, X.: A privacy preserving federated learning scheme using homomorphic encryption and secret sharing. Telecommu- nication Systems 82(3), 419–433 (2023) [41] Sahinbas, K., Catak, F.O.: Secure multi-party computation-based privacy- preserving data analysis in healthcare iot systems. In: Interpretable Cognitive Internet of Things for Healthcare, p. 57–72. Springer, ??? (2023) [42] Mohassel, P., Zhang, Y.: Secureml: A system for scalable privacy-preserving machine learning. In: 2017 IEEE Symposium on Security and Privacy (SP), p. 19–38 (2017). IEEE [43] Liu, F.: Generalized gaussian mechanism for differential privacy. IEEE Transac- tions on Knowledge and Data Engineering 31(4), 747–756 (2018) [44] Cheu, A., Smith, A., Ullman, J., Zeber, D., Zhilyaev, M.: Distributed differential privacy via shuffling. In: Ishai, Y., Rijmen, V. (eds.) Advances in Cryptology – EUROCRYPT 2019, p. 375–403. Springer, Cham (2019) [45] Zhang, J., Chen, J., Wu, D., Chen, B., Yu, S.: Poisoning attack in federated learn- ing using generative adversarial nets. In: 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/Big- DataSE), p. 374–380 (2019). https://doi.org/10.1109/TrustCom/BigDataSE. 2019.00057 [46] Zhang, J., Chen, B., Cheng, X., Binh, H.T.T., Yu, S.: Poisongan: Generative poisoning attacks against federated learning in edge computing systems. IEEE Internet of Things Journal 8(5), 3310–3322 (2021) https://doi.org/10.1109/JIOT. 2020.3023126 [47] Xie, Y., Fang, M., Gong, N.Z.: Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (2024) [48] Rodr ́ıguez-Barroso, N., Jim ́enez-L ́opez, D., Luz ́on, M.V., Herrera, F., Mart ́ınez- C ́amara, E.: Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges. Information Fusion 90, 148–173 (2023) https://doi.org/10.1016/j.inffus.2022.09.011 [49] Lin, Z., Shi, Y., Xue, Z.: Idsgan: Generative adversarial networks for attack generation against intrusion detection, 79–91 (2022) https://doi.org/10.1007/ 978-3-031-05981-0 7 33 [50] Ferrag, M.A., Friha, O., Hamouda, D., Maglaras, L., Janicke, H.: Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applica- tions: Centralized and Federated Learning. https://doi.org/10.21227/mbc1-1h68 [51] Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A., et al.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1, 108– 116 (2018) 34

Instant research discovery