Paper deep dive
Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface
Adrita Rahman Tory, ABM Shawkat Ali, Md Abu Layek, Khondokar Fida Hasan
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 9/4/2026, 3:09:32 AM
Summary
This paper investigates the trade-offs between differential privacy (DP), Byzantine robustness, and fairness in Federated Intrusion Detection Systems (NIDS). It introduces 'geometric indistinguishability' to explain how DP-induced noise and robust aggregation (coordinate-wise median) jointly suppress minority-class attack signals. Using the UNSW-NB15 dataset, the authors demonstrate that while epsilon-dependent learning rate calibration mitigates total collapse, a residual performance floor remains for ultra-rare attacks under strong privacy constraints.
Entities (10)
Relation Signals (7)
UNSW-NB15 → usedin → Federated Intrusion Detection
confidence 98% · Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median
DP-SGD → causes → privacy-induced dispersion
confidence 95% · privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve.
Label-flip → istypeof → Adversarial Attack
confidence 95% · evaluate two attack vectors: (1) Label-flip poisoning
Model Poisoning → istypeof → Adversarial Attack
confidence 95% · evaluate two attack vectors: ... (2) Gaussian model poisoning
Coordinate-wise Median → filters → statistical outliers
confidence 92% · Byzantine-robust aggregation rules, such as coordinate-wise median... address this by filtering statistical outliers
Geometric Indistinguishability → explains → suppression of minority-class signals
confidence 90% · privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve.
Cortical Memory System → proposedtoaddress → persistent minority floor
confidence 85% · CMS serves as an exploratory testbed to investigate whether architectural gradient preconditioning... can address the persistent minority floor
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning attacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks relative to majority classes. We also show that part of the observed collapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after epsilon-dependent tuning. These findings motivate studying privacy, robustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy federated NIDS.
Tags
Links
- Source: https://arxiv.org/abs/2609.03420v1
- Canonical: https://arxiv.org/abs/2609.03420v1
Trouble viewing inline? Open PDF directly →
Full Text
39,783 characters extracted from source content.
Expand or collapse full text
Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 1 Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface Adrita Rahman Tory 1 , ABM Shawkat Ali 1 , Md Abu Layek 2 , and Khondokar Fida Hasan 3⋆ 1 Bangladesh University of Business and Technology (BUBT), Mirpur-2, Dhaka-1216, Bangladesh 2 Jagannath University, Dhaka, Bangladesh 3 University of New South Wales (UNSW), ACT 2601, Australia fida.hasan@unsw.edu.au Abstract. Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously sat- isfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning at- tacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks rel- ative to majority classes. We also show that part of the observed col- lapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after ε-dependent tuning. These findings motivate studying privacy, ro- bustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy feder- ated NIDS. Keywords: Federated Learning · Intrusion Detection · Differential Privacy · Byzantine Robustness · Minority Attack Detection · Network Security ⋆ Corresponding author, Email: fida.hasan@unsw.edu.au Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 2 1 Introduction Machine-learning-based Network Intrusion Detection Systems (NIDS) face a per- sistent challenge in recognising attack categories that vary enormously in preva- lence. In operational environments, rare and novel attacks can be disproportion- ately important despite appearing only sparsely in observed traffic. At the same time, any single organization typically sees only a partial slice of the broader threat landscape, creating a strong incentive for collaborative learning across administrative boundaries [9, 12, 14, 15, 18]. In practice, however, network traffic metadata may constitute personal data under regulatory frameworks such as the GDPR, which limits the feasibility of centralizing raw data [7]. Federated Learning (FL), a distributed paradigm where participants share model pa- rameter updates rather than raw data [1], enables such collaboration while respecting data protection constraints. However, FL provides no for- mal privacy guarantees by de- fault; gradient inversion at- tacks can reconstruct sen- sitive training inputs from shared updates [1, 8]. Conse- quently, Differentially Private Stochastic Gradient Descent (DP-SGD) [1, 8, 19] is widely Fig. 1. Geometric Indistinguishability at the Aggre- gation Interface: DP-SGD Noise and Byzantine Fil- tering Jointly Suppress Minority-Class Updates. adopted to bound this leakage, providing (ε, δ)-privacy guarantees by clipping per-sample gradients and injecting calibrated Gaussian noise [6,8], albeit at util- ity cost. In parallel, federated deployments also benefits from tolerance to adver- sarial participants who may submit poisoned updates to corrupt the global model [4, 5]. Byzantine-robust aggregation rules, such as coordinate-wise me- dian [17] or Krum [5], address this by filtering statistical outliers, contracting the acceptance region around honest consensus [11]. These mechanisms are often evaluated separately in federated learning. However, in class-imbalanced intru- sion detection, their interaction may be as important as their individual behavior. As illustrated in Fig.1, privacy noise increases update dispersion, while robust aggregation attenuates statistically unusual updates at the server interface. In NIDS, rare-attack signals are already sparse because they are supported by very few samples and occur far less frequently than majority attack categories [9, 18]. Prior work has shown that DP-SGD can disproportionately degrade performance for underrepresented classes, while Byzantine-robust aggregation can suppress legitimate but statistically atypical updates [4, 10, 11, 20]. This paper investigates rare-attack coverage in federated NIDS. We intro- duce Geometric Indistinguishability as a conceptual lens to explain how robust Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 3 aggregation struggles to preserve privacy-perturbed minority updates. We find that combining privacy noise and robust aggregation disproportionately degrades rare-attack detection. Crucially, while part of the apparent performance collapse under strong privacy stems from training miscalibration, a residual detection floor remains for ultra-rare classes even after ε-dependent tuning. Therefore, privacy, robustness, and rare-attack coverage must be evaluated jointly rather than as independent properties. Our contributions are as follows: – We introduce geometric indistinguishability as a working hypothesis for how privacy-induced update dispersion and robust aggregation may jointly sup- press minority-class signals in class-imbalanced federated intrusion detection. – Using UNSW-NB15 with DP-SGD and coordinate-wise median under label- flip and model-poisoning attacks, we provide initial empirical evidence that joint privacy and robustness constraints can disproportionately degrade rare- attack coverage, and that some apparent collapse may be attributable to hyperparameter miscalibration rather than an inherent impossibility. – We argue that trustworthy federated NIDS should evaluate privacy, adver- sarial robustness, and class-wise threat coverage together, and we identify aggregation-aware modeling and sample-aware evaluation as promising di - rections for future work. The remainder of this paper is organized as follows: Section 2 reviews related work; Section 3 formalizes the problem and the geometric-indistinguishability lens; Section 4 details the experimental methodology; Section 5 presents empir- ical results; Section 6 discusses implications and mitigations; Section 7 outlines limitations; and Section 8 concludes the study. 2 Related Works Table 1. Comparison of Related Work Across Key Dimensions Ref. FL-NIDS DP Byz. Rob. CW-Fair [14] ✓ ✗ ✗ ✗ [5] ✓ ✗ Partial ✗ [3] ✓ ✗ ✗ Partial [7] ✗ ✓ ✗ ✗ [16] ✗ ✓ ✗ ✓ [15] ✗ ✗ ✓ ✗ [12] ✗ ✗ ✓ ✗ [13] ✗ ✗ ✓ ✗ [10] ✗ ✗ ✓ ✗ This work ✓ ✓ ✓ ✓ DP = Differential Privacy; Byz. Rob. = Byzantine Robustness; CW-Fair = Class-wise Fairness Federated learning has been widely adopted for collaborative intru- sion detection without central- ising raw traffic data [5], [14]. Prior work has applied FL-based NIDS across IoT, fog, and enter- prise environments [4], [5], and recent studies confirm its viabil- ity on UNSW-NB15 for multi- class detection tasks [3]. How- ever, these works treat privacy, robustness, and fairness as in- dependently composable proper- ties rather than interacting con- straints. The application of DP-SGD to federated learning provides formal (ε, δ)-privacy guarantees [7], but at a known Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 4 Fig. 2. Diagnostic Case Study: Fairness Collapse Under Miscalibration. Detection rates at ε = 1.0 using static LR = 0.05 across 0%, 20%, 40% adversarial clients. Mi- nority classes collapse to near-zero while majority classes maintain > 40%, yielding DI class < 0.05 (panel d). This motivated ε-dependent calibration. Attack categories: Gen (Generic), Exp (Exploits), Fuz (Fuzzers), DoS, Rec (Reconnaissance), Ana (Anal- ysis), Bak (Backdoor), She (Shellcode), Wor (Worms). utility cost. A critical and well-documented consequence is that DP-SGD de- grades underrepresented classes disproportionately [16]: accuracy gaps between majority and minority groups widen as the privacy budget tightens [9], and this disparity is not reliably resolved by hyperparameter retuning alone [8]. In par- allel, Byzantine-robust aggregation rules, including coordinate-wise median [15], Krum [10], and Trimmed Mean [13], defend against poisoned updates by filtering statistical outliers, but uniform post-filtering aggregation weights fail to protect minority-class gradients once label imbalance is present [12]. Recent work fur- ther shows that class imbalance attacks can reduce minority-class accuracy to near-zero under state-of-the-art robust FL methods [11]. Despite growing interest in each of these properties individually, their joint evaluation in a class-imbalanced federated NIDS setting remains scarce. Table 1 summarises the closest related works along the three dimensions central to this paper. As Table 1 shows, no prior work jointly addresses all four dimensions in a federated NIDS context. Regulatory frameworks such as GDPR [6] and the EU AI Act [18] motivate this joint requirement, but do not specify how these properties should be simultaneously realised in a learning system. This paper addresses that gap directly. 3 Problem Formalization 3.1 Minimal System Model We consider a standard Federated Learning setup [13] with N clients, where each client i holds local dataset D i . In standard FL training, each client minimizes local loss via Stochastic Gradient Descent (SGD), computing gradient estimates g i = ∇ θ L(θ; B i ) over mini-batches B i of size B, and transmitting updates ∆θ i = Gen Exp Fuz DoS Rec Ana Bak She Wor Gen Exp Fuz DoS Rec Ana Bak She Wor Gen Exp Fuz Ana Bak She Wor 0% Attacks 20% Attacks 40% Attacks Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 5 i=1 −η local ·g i to the server. The server applies aggregation function A : (R d ) N → R d : θ (t+1) = θ (t) − η · A(∆θ (t) , . . . , ∆θ (t) ) (1) 1 N Following the Byzantine threat model [5], up to αN clients (where α < 0.5) may deviate arbitrarily from this protocol, submitting malicious updates ∆θ adv . 3.2 Mechanisms Differentially Private SGD (DP-SGD) To achieve (ε, δ)-privacy, clients implement Differentially Private SGD (DP-SGD) [1], which modifies standard SGD through two operations: (i) per-sample gradient clipping to bound L 2 - sensitivity by C; and (i) calibrated Gaussian noise injection N (0, σ 2 C 2 I) [6]. This induces variance expansion in the transmitted updates: σ 2 C 2 Var(g ̃) = Var(g) + DP B (2) w √ here σ DP is the noise multiplier calibrated to satisfy (ε, δ)-DP via σ DP ≥ c T log(1/δ)/(εN ) for T rounds and c a constant. 3.3 Byzantine-Robust Aggregation For robustness, the server applies coordinate-wise median aggregation [21], which computes the element-wise median across client updates. Formally, for the j-th coordinate of the parameter vector (j ∈ [d]), the aggregator outputs: A median (∆θ 1 , . . . , ∆θ N ) j = median ( ∆θ i,j N ) (3) where ∆θ i,j denotes the j-th coordinate of the update from client i and N is the number of participating clients. 3.4 Geometric Indistinguishability We use geometric indistinguishability as a conceptual lens for a failure regime that can arise when DP-SGD is combined with Byzantine-robust aggregation in class-imbalanced federated intrusion detection. Prior work suggests that privacy mechanisms may disproportionately affect underrepresented classes, while robust aggregation can attenuate legitimate but statistically atypical updates [3, 21]. Let G min denote the distribution of honest updates associated with minority attack classes, and let G adv denote the distribution of adversarial updates. Under DP-SGD, minority updates are perturbed by Gaussian noise, yielding G DP = G min ∗ N (0, σ 2 I). min DP We say that the system moves toward geometric indistinguishability when privacy- perturbed minority updates overlap more strongly with adversarial updates, Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 6 making minority-class signals harder for robust aggregation to preserve. In this paper, we use this idea as an interpretive hypothesis rather than a formal theo- rem or directly estimated decision rule. This lens is useful for interpreting the empirical results in Section IV. In particular, it helps distinguish artifactual collapse, where poor hyperparameter calibration exaggerates failure, from a more persistent degradation regime in which rare-attack coverage remains fragile even after ε-dependent tuning. 4 Empirical Validation of Geometric Indistinguishability 4.1 Dataset and Partitioning We utilize the UNSW-NB15 dataset (175,341 samples), se- lected specifically to evalu- ate performance under severe inter-class imbalance [14]. Mi- nority classes such as Worms (0.2%) and Shellcode (1.5%) reflect operational realities where rare attacks constitute critical security threats [18]. To isolate the geometric in- teraction between privacy and robustness from data het- erogeneity, we partition the dataset across ten clients us- ing IID sampling. This setup favors the minority-class gra- dient survival because each client observes the same dis- tribution, increasing the like- lihood that minority signals retain sufficient mass for me- dian computation. In realistic non-IID settings, skewed at- tack distributions concentrate minority gradients on fewer clients, further increasing ge- Fig. 3. Complete Experimental Configuration and Workflow ometric indistinguishability. Thus, the reported fairness degradation represents a lower bound for practical deployments. Attack Category Classification: We classify the nine attack categories by prevalence and operational significance: – Minority Classes (rare): Analysis (n = 134, 0.76%), Backdoor (n = 125, 0 .71%), Shellcode (n = 80, 0.46%), Worms (n = 5, 0.03%) Local Training Differential Privacy (DP-SGD) Injection (if mal_ratio>0) Federated Learning Experimental Setup 10 Clients | IID Partitioning | 20 Communication Rounds | Min 8 Participants | Local Training ε=∞ → LR 0.0020 ε=5.0 → LR 0.0010 ε=3.0 → LR 0.0005 ε=1.0 → LR 0.0001 Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 7 – Majority Classes (common): Generic (n = 3, 723, 21.2%), Exploits (n = 2, 236, 12.8%), Fuzzers (n = 1, 279, 7.3%), DoS (n = 816, 4.7%), Reconnais- sance (n = 669, 3.8%) This classification reflects operational realities where rare attacks constitute < 2% of traffic yet represent critical security events [1], [3]. Under differential privacy, these imbalanced classes create fairness challenges (Section IV). 4.2 Federated Learning and Privacy Configuration The complete experimental configuration is detailed in Fig 3. To mitigate local class imbalance, we utilize BCEWithLogitsLoss with positive class weight. Differential privacy is implemented via Opacus DP-SGD with gradient clip- ping. Calibration addresses a documented challenge in differentially private opti- mization: DP-SGD noise requires smaller learning rates to maintain convergence stability [1]. Theoretically, the optimal learning rate η scales inversely with the noise multiplier σ to preserve the gradient signal-to-noise ratio [2]. Our schedule (Fig 3) instantiates this principle for the FL-NIDS setting. 4.3 Adversarial Threat Model and Evaluation We evaluate two attack vectors: (1) Label-flip poisoning (untargeted data poison- ing where labels are inverted); and (2) Gaussian model poisoning (direct corrup- tion of update vectors via N (0, 5.0 2 ) noise). Aggregation is fixed to Coordinate- wise Median, which was selected for its stability and minimal degradation under 40% pressure (0.3% F1 drop) compared to alternatives like Krum or Trimmed Mean in pre-validation (Figure 4). This selection isolates privacy-fairness inter- actions from aggregation-induced variance. We adopt class-wise fairness metrics to capture disparities in detection rates. 1) Class-wise Disparate Impact (DI class ): We measure fairness as the ratio of minimum to maximum detection rates across attack categories: DI class = min c∈C atk DR c max c∈C atk DR c (4) where C atk = Generic, Exploits, . . . , Worms represents the nine attack cate- gories and DR c is the detection rate for class c. Following the four-fifths heuris- tic commonly used in fairness evaluation, we use DI class ≥ 0.8 as the fair- ness threshold, meaning the worst-performing class achieves at least 80% of the best-performing class’s detection rate. This per-class formulation is more conservative than grouped minority/majority ratios, as it captures the single worst-performing category. Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 8 ∝ Fig. 4. F1 Score Across Aggregation Rules (FedAvg, Krum, Median, Trimmed Mean) Under Clean, 20%, and 40% Adversarial Client Ratios. 5 Results 5.1 Original Collapse: The Problem Under Investigation Our empirical validation proceeds in three stages. In Section 5.1, we identify catastrophic fairness collapse at ε = 1.0 under a static learning rate of LR = 0.05 (Fig. 2), establishing the interaction between hyperparameter settings and pri- vacy constraints. In Section 5.2, we introduce ε-dependent learning rate schedul- ing, which restores overall utility (Fig. 5, F 1 = 0.738) but still reveals a minority- class performance floor. Finally, Section 5.3 demonstrates that a pathway isola- tion addressing this limitation (Fig. 6). Prior to presenting pri- mary results, this diagnos- tic case study illustrates a critical practical pitfall. Us- ing a static learning rate (η = 0.05) across privacy regimes results in near-total detection collapse at ε = 1.0 (Figure 2). While sub- sequent calibration (Section 5.2) reveals this as a con- figuration artifact, it demon- strates how easily fairness col- lapse is misattributed to fun- damental privacy-robustness tensions. This establishes a Fig. 5. Utility Recovery After ε-Dependent Calibra- tion. F1 and DI class across privacy budgets with adaptive LR (η 1/ √ ε). Calibration restores F1 from 0.007 to 0.738 at ε = 1.0, but DI class remains < 0.21 (below fairness threshold 0.8), motivating ar- chitectural intervention. systematic methodological lesson: ε-dependent hyperparameter calibration is es- sential for valid evaluation of FL privacy mechanisms. In this setting, detection rates for Exploits, DoS, and Reconnaissance fall below 40%; minority classes collapse near zero across all adversarial scenarios. Consequently, the Disparate Impact (DI) remains negligible and fails to approach the 0.8 fairness threshold regardless of the adversarial ratio. While these results Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 9 ± initially suggested an irreversible conflict between strict differential privacy and Byzantine robustness, subsequent analysis (Section 6.5) refines this diagnosis as a calibration issue rather than a fundamental theoretical limitation. 5.2 Results After ε-Dependent Learning Rate Calibration With ε-dependent learning rate calibration (Fig. 3), the model no longer ex- hibits the near-total collapse observed under the static schedule in Section IV-A. As shown in Fig. 5, performance degrades more gradually as privacy becomes stronger: F1 declines from 0.9537 at ε = ∞ to 0.7379 at ε = 1.0, while DI class decreases from 0.750 to 0.205. Although no differentially private setting satisfies the DI class ≥ 0.8 threshold, the system remains functional after calibration. Adversarial participation further reduces class-wise fairness, but the post- calibration results suggest that privacy budget is the dominant driver of degra- dation in this setup. For example, at ε = 3.0, DI class decreases from 0.750 in the non-private setting to 0.516 in the clean private setting, and falls further under attack (e.g., 0.581 under 40% label flipping and 0.509 under model poisoning). We therefore interpret the results as evidence of a threshold-like degradation regime under joint privacy and robustness constraints, rather than as a formally established phase transition. 5.3 Persistent Detection Floor for Ultra-Minority Classes Fig. 6 isolates the ultra-minority classes Worms ( n = 5) and Shellcode ( n = 80). Under the strongest privacy setting ( ε = 1 .0), both classes remain sub- stantially weaker than the ma- jority classes even after calibra- tion: Worms stabilizes at 20% de- tection and Shellcode at 52.5% across the evaluated scenarios. We note that the Worms class con- tains only five total samples, dis- tributed across ten IID clients; re- sults for this class should be inter- preted as indicative rather than statistically robust. Because this pattern persists across clean and adversarial settings, the results Fig. 6. Persistent Detection Floor for Ultra- Minority Classes. Shellcode ( n = 80) and Worms (n = 5) detection rates across five scenarios at ε = 1.0 post-calibration. Cross-scenario consistency ( 5p variance) demonstrates privacy-induced floor, not attack- induced. Calibration alone cannot resolve this. suggest that the residual degradation is not explained solely by attack pressure or by the original static-learning-rate miscalibration. At the same time, both classes recover at ε = 3.0, with Worms reaching 80–100% detection in the reported scenarios. We therefore interpret the ε = 1.0 behavior as initial evidence of a persistent floor under this configuration, likely Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 10 ∞ reflecting the interaction of strong privacy noise with extreme sample scarcity. This is a configuration-specific empirical observation rather than a proof of a universal privacy limit. Table 2. Architecture Comparison Across Privacy and Attack Regimes Clean 0.2044 0.2048 −0.0004 Tie LP 20% 0.4082 0.3931 +0.0152 CMS LP 40% 0.6685 0.4078 +0.2607 CMS MP 20% 0.2044 0.2048 −0.0004 Tie MP 40% 0.2044 0.2049 −0.0005 Tie ε = 3.0 — Moderate Privacy Clean 0.5165 0.4725 +0.0439 CMS LP 20% 0.5116 0.4984 +0.0132 CMS LP 40% 0.6245 0.5806 +0.0439 CMS MP 20% 0.4929 0.4841 +0.0088 CMS MP 40% 0.5631 0.5090 +0.0541 CMS ε = ∞ — No Differential Privacy Clean 0.7670 0.7498 +0.0172 CMS LP 20% 0.7209 0.8217 −0.1009 MLP LP 40% 0.5512 0.8288 −0.2776 MLP MP 20% 0.7537 0.7631 −0.0094 MLP MP 40% 0.7256 0.7740 −0.0485 MLP Notes: ε = 1 denotes strong (tight) privacy, ε = 3 moderate privacy, and ε = no differential privacy. LP = label flipping; MP = model poisoning. ∆ = DI class (CMS) DI class (MLP); positive values favour CMS, negative values favour MLP. 6 Discussion 6.1 Architectural Pre-conditioning: CMS vs. MLP To investigate whether architectural pre-conditioning might address the persis- tent minority floor, we designed a prototype system termed the Cortical Memory System (CMS). CMS serves as an exploratory testbed to investigate whether architectural gradient preconditioning (Fig. 7) can address the persistent minor- ity floor by preserving pathway-specific gradient subspaces under the privacy- robustness constraints identified. We benchmark CMS against a standard MLP baseline as an initial feasibility assessment. Mechanism: CMS creates pathway-specific gradient subspaces via: 1. Skip connections (h 0 → m 2 , h 0 → m 3 ): Project input directly into 128- dim slow pathways, bypassing majority-dominated intermediate layers. 2. Multi-head classification: Four independent classifiers create orthogonal parameter subspaces; DP clipping applies per-parameter, preserving minor- ity gradient directions in m 2 /m 3 . 3. Differential dropout (0.10 slow vs. 0.25 fast): Acts as a frequency filter, preserving rare gradients while regularizing majority noise. − Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 11 ∈ ∞ max c (DR c ) ( ∑ DR) 2 Fig. 7. CMS vs. MLP: Per-Metric Win Rates. Percentage of experimental scenarios where CMS outperforms MLP baseline. Aggregated across ε 1.0, 3.0, , attack types, and adversarial ratios. Win defined as metric CM S > metric M LP for each scenario. Metrics: DI class = min c (DR c ) ; Minority DR = mean(Analysis, Backdoor, Shellcode, Worms); Jain FI = n· ∑ DR 2 . 4. GroupNorm: Per-sample normalization prevents minority statistics from being averaged away by the majority class. Results show that at ε = 3.0, CMS achieves a 100% win rate on Shellcode (5/5 scenarios), with a +6.5p mean and +8.75p maximum advantage, and a 50% overall minority win rate (10/20) with no losses. At ε = 1.0, CMS yields a +20p gain on Worms in label-flip scenarios, although both architectures strug- gle. Metric-level analysis indicates that CMS performs strongest in precision (73% win rate), followed by F1 (60%), while minority detection favors MLP (47% win rate for CMS). Thus, CMS improves precision and reduces false positives, whereas MLP provides more consistent minority coverage, making architectural choice dependent on deployment priorities. 6.2 Operational Regime Classification Table 2 summarizes the results across operational regimes defined by privacy budget ε and adversarial pressure, using class-wise disparate impact (DI class ), where positive ∆ favors CMS. At ε = 1.0 under clean and model poisoning set- tings, both models collapse below the fairness threshold (DI class ≈ 0.20), showing that strong DP noise (σ = 0.189) suppresses minority gradients irrespective of architecture, establishing a privacy-induced floor. Under ε = 1.0 with 40% label poisoning, CMS achieves a 3.3× fairness gain over MLP (0.67 vs 0.41), indi- cating that pathway isolation better preserves minority signals under combined DP and adversarial stress. At moderate privacy (ε = 3.0), CMS wins all com- parisons (5/5), with a maximum +0.044 advantage, as reduced noise enables Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 12 pathway-specific gradient accumulation. Without privacy (ε = ∞), CMS main- tains a small edge in clean settings (∆ = +0.017), but MLP outperforms under adversarial conditions (3/4 wins), where architectural simplicity aids recovery. Overall, CMS advantages concentrate at moderate privacy and at the privacy- attack intersection, while benefits diminish at privacy extremes. 6.3 Threshold-Like Degradation at the Aggregation Interface Our results suggest a threshold-like degradation regime at the federated aggre- gation interface rather than a smooth decline in rare-attack coverage. In the re- ported experiments, the transition from functional detection to severe minority- class degradation appears between 20% and 40% adversarial participation. We interpret this pattern as being consistent with the geometric indistinguishability hypothesis: as DP-SGD increases the dispersion of honest minority updates, ro- bust aggregation may attenuate those updates more strongly when they become statistically atypical relative to the dominant client update pattern. This interpretation should be read as empirical and configuration-specific. We do not claim a formally established phase transition; rather, the current results indicate that privacy noise, robust aggregation, and class imbalance can combine to produce sharp degradation in rare-attack coverage under the studied setting. 6.4 Regulatory Motivation and Joint Evaluation The observed interaction also has an important systems implication. In prac- tice, federated NIDS may be expected to satisfy privacy requirements, tolerate adversarial participants, and maintain reliable coverage across attack categories. Regulatory frameworks such as the GDPR and the EU AI Act provide moti- vation for these goals, but they do not specify how such properties should be jointly realized in a learning system [7, 16]. Our results therefore support a narrower claim than a legal compliance con- clusion. They suggest that evaluating privacy and robustness in isolation may miss failure modes that become visible only when class-wise threat coverage is examined jointly. In this paper, we use privacy, robustness, and rare-attack coverage as technical evaluation dimensions rather than as a complete legal com- pliance model. From that perspective, the main implication is methodological: trustworthy federated NIDS should assess these properties together rather than assuming they compose cleanly by default. 6.5 Insufficiency of Conventional Mitigations Standard mitigation strategies fail because they do not address the underlying geometric conflict: – Geometric Methods: Class-aware privacy budgets typically leak informa- tion about rare attack distributions, violating the composition properties Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 13 required for GDPR defensibility. Similarly, noise-adaptive filtering thresh- olds assume non-adaptive adversaries; sophisticated attackers can exploit expanded acceptance regions by mimicking privacy-perturbed minority gra- dients [3, 5]. – Data-Level Methods: Techniques like SMOTE fail because DP-SGD op- erates on gradient geometry, not raw data. Even with balanced inputs, the resulting gradients from minority samples remain high-variance and sparse, leading to rejection by the aggregator [3]. 6.6 Artifactual vs. Fundamental Fairness Limits A critical distinction must be made between configuration- induced failure and an empirical floor under our configuration. Initial collapse at ε = 1.0 was partly driven by static learn- ing rates that destabilized under high noise. By implementing an ε-dependent adaptive schedule combined with pos_weight loss reweighting (Fig. 8), we successfully restored F1 scores from near-zero to 0.85 at ε = 3.0. However, Fig. 8 also reveals a persistent floor in our sweep: despite calibra- tion, ultra-minority classes (e.g., Worms, n = 5) remain be- low 20% detection. This indi- cates that while hyperparame- ter calibration eliminates arti- Fig. 8. Impact of Calibration on Four Minority Classes. Detection rates before (red: static LR) vs. after (blue: calibrated LR + loss reweight- ing). Calibration eliminates collapse for Analy- sis/Backdoor but floor persists for Worms, con- firming sample-scarcity boundary. factual collapse, it does not remove the empirical signal-to-noise boundary in- duced by strong DP noise for extremely rare events. 7 Limitations and Future Work This study operates under four specific constraints. First, the use of IID client partitioning establishes a conservative fairness baseline. Real-world heteroge- neous traffic distributions would likely reduce minority gradient contributions further, suggesting that the reported fairness collapse represents a lower bound on severity. Second, the restriction to coordinate-wise median aggregation limits immediate generalization to other Byzantine-robust rules like Krum or FLTrust. Third, findings rely exclusively on the UNSW-NB15 benchmark, leaving feature- space generalization unvalidated. Finally, the Cortical Memory System (CMS) Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 14 evaluation reflects a preliminary, fixed configuration rather than the output of an exhaustive hyperparameter search. Research should prioritize three areas. First, artifactual collapse demon- strates the need to derive principled functional relationships between ε, noise multipliers, and learning rates to standardize privacy-preserving deployment pro- tocols. Second, development must shift toward fairness-constrained aggregation designs capable of distinguishing privacy-perturbed minority gradients from ad- versarial outliers. While CMS improves the Jain Fairness Index relative to MLP baselines, systematic evaluation against adaptive adversaries and non-IID par- titions is required. Lastly, the field necessitates sample-aware fairness metrics to rigorously distinguish detection gaps caused by fundamental sample scarcity from those resulting from architectural failure. 8 Conclusion Federated learning is a promising approach for collaborative network intrusion detection, but its deployment is shaped by competing requirements for privacy, adversarial robustness, and reliable coverage of rare attack categories. This pa- per examined that interaction in a class-imbalanced federated NIDS setting us- ing DP-SGD and coordinate-wise median on UNSW-NB15 under label-flip and model-poisoning attacks. We introduced geometric indistinguishability as a con- ceptual lens for understanding how privacy-perturbed minority updates may become harder for robust aggregation to preserve. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can dis- proportionately degrade rare-attack coverage relative to majority classes. They also highlight an important diagnostic distinction: part of the apparent collapse under strong privacy can arise from training miscalibration, while a more persis- tent degradation regime may remain for ultra-rare classes even after ε-dependent tuning. These findings should be interpreted as an initial empirical case study rather than a universal theorem. The main implication is methodological: pri- vacy, robustness, and class-wise threat coverage should be evaluated jointly in federated NIDS rather than treated as independently composable properties. More broadly, the results suggest that aggregation-aware modeling, clearer pri- vacy specification, and sample-aware evaluation remain important directions for building trustworthy federated intrusion detection systems. Disclosure of Interests. The authors have no competing interests to declare that are relevant to the content of this article. References 1. Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. p. 308–318 (2016) Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 15 2. Andrew, G., Thakkar, O., McMahan, B., Ramaswamy, S.: Differentially private learning with adaptive clipping. Advances in neural information processing systems 34, 17455–17466 (2021) 3. Bagdasaryan, E., Poursaeed, O., Shmatikov, V.: Differential privacy has disparate impact on model accuracy. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 32, p. 15479–15488 (2019) 4. Bagdasaryan, E., Veit, A., Hua, Y., Shmatikov, V.: How to backdoor federated learning. In: Proceedings of the 23rd International Conference on Artificial Intelli- gence and Statistics (AISTATS). vol. 108, p. 2938–2948. PMLR (2020) 5. Blanchard, P., El Mhamdi, E.M., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems 30 (2017) 6. Dwork, C., Roth, A.: The algorithmic foundations of differential privacy. Founda- tions and trends® in theoretical computer science 9(3-4), 211–487 (2014) 7. European Parliament, Council of the European Union: Regulation (eu) 2016/679 of the european parliament and of the council of 27 april 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/ec (general data protection regulation). Official Journal of the European Union L 119, 1–88 (May 2016) 8. Fu, J., Hong, Y., Ling, X., Wang, L., Ran, X., Sun, Z., Wang, W.H., Chen, Z., Cao, Y.: Differentially private federated learning: A systematic review (2025), https://arxiv.org/abs/2405.08299 9. Gaber, M.G., Ahmed, M., Janicke, H.: Malware detection with artificial intel- ligence: A systematic literature review. ACM Computing Surveys 56(6), 1–33 (2024). https://doi.org/10.1145/3638552 10. Hasan, K.F., Shajeeb, H.H., Abeydeera, C., Turnbull, B., Warren, M.: Isadm: An integrated stride, att&ck, and d3fend model for threat modeling against real-world adversaries. IEEE Access 13, 217316–217348 (2025) 11. Li, S., Ngai, E.C.H., Voigt, T.: An experimental study of byzantine-robust aggrega- tion schemes in federated learning. IEEE Transactions on Big Data 10(6), 975–988 (2024). https://doi.org/10.1109/TBDATA.2023.3237397 12. Makris, I., Karampasi, A., Radoglou-Grammatikis, P., Episkopos, N., Iturbe, E., Rios, E., Piperigkos, N., Lalos, A., Xenakis, C., Lagkas, T., Argyriou, V., Sarigiannidis, P.: A comprehensive survey of federated intrusion detec- tion systems: Techniques, challenges and solutions. Computer Science Review 56, 100717 (2025). https://doi.org/https://doi.org/10.1016/j.cosrev.2024.100717, https://w.sciencedirect.com/science/article/pii/S157401372400100X 13. McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. p. 1273–1282. Pmlr (2017) 14. Mishra, P., Varadharajan, V., Tupakula, U., Pilli, E.S.: A detailed investi- gation and analysis of using machine learning techniques for intrusion de- tection. IEEE Communications Surveys & Tutorials 21(1), 686–728 (2019). https://doi.org/10.1109/COMST.2018.2847722 15. Moustafa, N., Slay, J.: Unsw-nb15: a comprehensive data set for network intru- sion detection systems (unsw-nb15 network data set). In: 2015 Military Com- munications and Information Systems Conference (MilCIS). p. 1–6 (2015). https://doi.org/10.1109/MilCIS.2015.7348942 16. Nolte, H., Rateike, M., Finck, M.: Robustness and cybersecurity in the EU Arti- ficial Intelligence Act. In: Proceedings of the 2025 ACM Conference on Fairness, Accepted in the 8th International Conference on Machine Learning for Cyber Security 2026 16 Accountability, and Transparency (FAccT ’25). Association for Computing Ma- chinery, New York, NY, USA (6 2025). https://doi.org/10.1145/3715275.3732020, https://doi.org/10.1145/3715275.3732020 17. Pillutla, K., Kakade, S.M., Harchaoui, Z.: Robust aggregation for feder- ated learning. IEEE Transactions on Signal Processing 70, 1142–1154 (2022). https://doi.org/10.1109/TSP.2022.3153135 18. Thakkar, A., Lohiya, R.: Attack classification of imbalanced intrusion data for iot network using ensemble-learning-based deep neural net- work. IEEE Internet of Things Journal 10(13), 11888–11895 (2023). https://doi.org/10.1109/JIOT.2023.3244810 19. Tory, A.R., Hasan, F.K.: An evaluation framework for network ids/ips datasets: Leveraging mitre att&ck and industry relevance metrics. Computers & Security p. 104777 (2025) 20. Tory, A.R., Hasan, K.F., Rahman, M.S., Koroniotis, N., Moni, M.A.: Mind the gap: Missing cyber threat coverage in nids datasets for the energy sector. In: Interna- tional Conference on Big Data, IoT and Machine Learning. p. 434–447. Springer (2025) 21. Yin, D., Chen, Y., Kannan, R., Bartlett, P.: Byzantine-robust distributed learning: Towards optimal statistical rates. In: International conference on machine learning. p. 5650–5659. Pmlr (2018)