BRFID: Toward Byzantine-Robust Federated Intrusion Detection

Asmah Muallem; Firdous Kausar; Sajid Hussain; Lei Qian

cs.CRSep 23, 2026

BRFID: Toward Byzantine-Robust Federated Intrusion Detection

Authors: Asmah Muallem, Firdous Kausar, Sajid Hussain, Lei Qian

Organizations: Computer Science and Data Science Meharry Medical College Nashville, TN, USA

Abstract

Flipping 60% of training labels from a single Byzantine client using label-flipping model poisoning self-degrades an attacker's own federated detection accuracy, $99.96\%$ (at no poisoning rate) to $84.33\%$ in a three-client federated IDS. Where the Federated global ensemble maintains stable accuracy across all tested poison rates, without a defense mechanism in place and without coordination between attackers. In this paper, we present empirical results quantifying the impact of label-flipping poisoning attacks on a three-client federated IDS trained on CICIDS2017 with non-IID attack subtype distributions across clients. We demonstrate that the signal of the adversarial self-compromise represents a detectable anomaly for exploitation for Byzantine client identification in the absence of target data exfiltration. We note that the aggregation step uses a Federated Forest (tree concatenation) rather than a parametric FedAvg; the results therefore measure the impact of poisoning on per-client performance under ensemble aggregation, and extension to genuine FedAvg with a parametric classifier is planned for future work.

Figures & tables

Fig. 1: System architecture. Three clients train local classifiers on partitioned network traffic and send model updates to a FedAvg aggregation server. Client $C_{0}$ sends a poisoned update $\tilde{\mathbf{w}}_{0}$ after flipping $r\%$ of its training labels (Eq. ( 2 )). The server has no built-in mechanism to detect or reject the poisoned update, and aggregates it identically to the two honest contributions. Figure developed with AI assistance and reviewed and adapted by the authors who take full responsibility for the content.

Client	Accuracy	F1	Recall
Client 0	0.9989	0.9992	0.9984
Client 1	0.9996	0.9995	0.9990
Client 2	0.9991	0.9990	0.9980
Fed. Avg	0.9992	0.9992	0.9985

TABLE I: FL-IDS Baseline, No Attack (

r=0.0

)

Poison	Fed.	$\Delta$ Acc.	Fed.	Attacker
rate $r$	Acc.	(pp)	F1	Acc.
$0\%$	0.9996	(none)	0.9996	0.9996
$20\%$	0.9994	$-0.02$	0.9995	0.9982
$40\%$	0.9994	$-0.02$	0.9995	0.9765
$60\%$	0.9996	$+0.00$	0.9996	0.8433

TABLE II: Federated IDS Accuracy Under Label-Flipping Attack (Client 0 Byzantine, FedAvg, No Defense)

Fig. 2: Federated IDS accuracy under label-flipping attack. $C_{0}$ Byzantine ( $1/3$ clients), Federated Forest aggregation, no defense. Global federated accuracy (solid) remains stable while the attacker’s own accuracy (dashed) drops from $0.9996$ to $0.8433$ at $r=60\%$ , a $15.63$ pp self-degradation. CICIDS2017, non-IID attack subtype partitioning.

Explore similar work

Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface
Sep 3, 2026Adrita Rahman Tory, ABM Shawkat Ali, Md Abu Layek +1Federated Learning Intrusion Detection
Bangladesh University of Business and Technology (BUBT), Mirpur-2, Dhaka-1216, Bangladesh · Jagannath University, Dhaka, Bangladesh · University of New South Wales (UNSW), ACT 2601, Australia
FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matching
Apr 16, 2026He Yang, Dongyi Lv, Wei Xi +3Federated Learning Byzantine Attacks
FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks
Aug 4, 2026An Khanh Bui, Cong Thanh Nguyen, Hoang-Anh Pham +2Federated Learning Intrusion Detection
UTS-HCMUT JTIRC, Ho Chi Minh City University of Technology (HCMUT), Ho Chi Minh City 700000, Vietnam. · Vietnam National University Ho Chi Minh City (VNU-HCM), Ho Chi Minh City 700000, Vietnam. · School of Electrical and Data Engineering, University of Technology Sydney, Sydney, NSW 2007, Australia.

Sep 3, 2026, cs.CRJ/K move · Enter open · S save

Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface

Adrita Rahman Tory, ABM Shawkat Ali, Md Abu Layek, Khondokar Fida Hasan

Bangladesh University of Business and Technology (BUBT), Mirpur-2, Dhaka-1216, Bangladesh · Jagannath University, Dhaka, Bangladesh · University of New South Wales (UNSW), ACT 2601, Australia

Federated Learning Intrusion Detection Privacy Byzantine Attacks Indistinguishability Trade-Off

Open paper AskPDF arXiv

Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning attacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks relative to majority classes. We also show that part of the observed collapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after epsilon-dependent tuning. These findings motivate studying privacy, robustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy federated NIDS.

Abstract

Explore similar work

Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interface

FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matching

FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks