Uncertainty-Guided Cross-Modal Alignment for Diffusion-Based IoT Intrusion Detection

Mahdi Arab Loodaricheh; Anita Raja; Mohammad Hossein Manshaei

cs.LGOct 29, 2026

Uncertainty-Guided Cross-Modal Alignment for Diffusion-Based IoT Intrusion Detection

Authors: Mahdi Arab Loodaricheh, Anita Raja, Mohammad Hossein Manshaei

Organizations: Department of Computer Science, Hunter College and The Graduate Center, CUNY, New York, NY, USA

Abstract

Diffusion models evolve noisy states toward a learned data distribution, so their sampling behavior depends on the geometry of the representation in which denoising occurs. This dependence is especially important for multimodal data: independently trained encoders can map synchronized views to incompatible latent regions, while uniform alignment can let an uncertain view distort the shared geometry. To address this gap, we introduce a novel reliability-guided alignment rule that uses normalized VAE posterior variance to control directional cross-modal influence before diffusion training. We study this issue in minority-attack generation for imbalanced Internet-of-Things intrusion detection. Tabular flow attributes, a DeepInsight image, and a packet sequence are encoded by modality-specific variational autoencoders. Per-modality normalized VAE posterior variances provide bounded, sample-specific weighting signals in an asymmetric stop-gradient alignment objective. We use these quantities as heuristic encoder-derived reliability proxies rather than calibrated probabilistic uncertainties. The full modality-specific latent means obtained after alignment fine-tuning are standardized and modeled jointly by a class-conditional EDM; a second-order sampler then generates paired attack-conditioned latent blocks for the three decoders. In controlled experiments on TON-IoT, uncertainty-aware alignment obtains the highest mean precision, recall, density, and coverage among three diffusion variants. Augmenting only the training split yields ROC-AUC 0.9515, PR-AUC 0.8954, balanced accuracy 0.8395, and attack-class F1 0.7940 on an untouched real test set. Among the two variants with matched alignment fine-tuning, posterior-variance-based weighting improves both tabular generative fidelity and downstream detection relative to uniform weighting.

Figures & tables

Figure 1: The proposed pipeline. Reliability-weighted alignment shapes an auxiliary shared geometry; class-conditional EDM operates on the standardized full latent blocks and decodes synchronized attack views. All fitted transformations and checkpoint decisions use training data only.

Method	Precision	Recall	Density	Coverage
No alignment	$0.6688\pm 0.1015$	$0.8563\pm 0.0775$	$0.6616\pm 0.0969$	$0.7093\pm 0.0897$
Uniform alignment	$0.7248\pm 0.0137$	$0.9054\pm 0.0181$	$0.7090\pm 0.0154$	$0.7696\pm 0.0063$
Uncertainty-aware	$\mathbf{0.7341\pm 0.0316}$	$\mathbf{0.9067\pm 0.0194}$	$\mathbf{0.7229\pm 0.0403}$	$\mathbf{0.7921\pm 0.0185}$

Table 1: PRDC for generated tabular attacks (mean

\pm

standard deviation over three seeds). Higher is better.

Training strategy	ROC-AUC	PR-AUC	BAcc.	F1
Real only	$0.9410\pm 0.0014$	$0.8799\pm 0.0013$	$0.8244\pm 0.0018$	$0.7821\pm 0.0029$
Class weighted	$0.9418\pm 0.0015$	$0.8786\pm 0.0014$	$0.8212\pm 0.0016$	$0.7213\pm 0.0051$
Random oversampling	$0.9416\pm 0.0018$	$0.8783\pm 0.0021$	$0.8207\pm 0.0027$	$0.7209\pm 0.0048$
SMOTE	$0.9376\pm 0.0018$	$0.8716\pm 0.0033$	$0.8310\pm 0.0026$	$0.7349\pm 0.0086$
No-align. diffusion	$0.9381\pm 0.0022$	$0.8747\pm 0.0025$	$0.8243\pm 0.0025$	$0.7800\pm 0.0035$
Uniform-align. diffusion	$0.9386\pm 0.0008$	$0.8750\pm 0.0011$	$0.8245\pm 0.0019$	$0.7797\pm 0.0022$

Table 2: Downstream performance on the untouched real test set (mean

\pm

standard deviation over three seeds). BAcc. denotes balanced accuracy; higher is better.

IoT Intrusion Detection

IoT intrusion detection identifies malicious network activity targeting connected devices and industrial systems using traffic and device data.

See all 52 papers

Sep 26, 2026

AnchorMixGAN: Anchor-Aligned Generative Semi-Supervision for DDoS Detection in Cloud-Integrated IoT Networks

Detecting distributed denial-of-service (DDoS) attacks in cloud-integrated IoT networks is difficult when labeled traffic is scarce. Generative semi-supervised learning can supplement the available training data, but prediction shifts induced by synthetic views may affect the targets assigned to real unlabeled flows. We propose AnchorMixGAN, a generative semi-supervised framework that addresses this problem through anchor-aligned target construction. Its Anchor-MAS module treats each real unlabeled flow as an anchor and creates alternative views by replacing one field group at a time with values from generated traffic. A frozen reference classifier predicts the anchor and its views; averaging and sharpening these predictions produces a soft target for the original flow. The flow and its target are then mixed with a labeled example using MixUp, allowing the detector to learn from both the original labeled records and the mixed examples. We analyze how reference-classifier error, view construction, and sharpening affect the target, and derive a bound on the resulting change in cross-entropy at a fixed detector prediction. At the reported 90% training setting with 20% of the training records labeled, AnchorMixGAN attains accuracies of 97.3%, 97.4%, and 96.5% on NSLKDD, BoT-IoT, and CICIoT2023, respectively, exceeding the corresponding MixGAN results by 1.6, 1.0, and 4.4 percentage points.

Jin Yang, Xufeng Liu, Yong Hu +3

School of Cyber Science and Engineering, Sichuan University, Chengdu, 610207, China · College of Information Science and Technology, Xizang University, Lhasa, 850000, China · Shaanxi Key Laboratory of Intelligent Policing, Shaanxi Police College, Xi’an, 710021, China +2

Network Intrusion Detection Cybersecurity Semi-Supervised Learning Synthetic Data Augmentation Generative Adversarial Networks

Ask PDF

May 8, 2026

Inference-Time Attribute Distribution Alignment for Unconditional Diffusion

Inference-time controllable generation is essential for real-world applications of unconditional diffusion models. However, most existing techniques focus on individual samples, struggling in applications that require the sample population to follow specific attribute distributions (e.g., demographic balance or semantic proportions). We formalize this setting as the inference-time attribute distributional alignment problem for pretrained unconditional diffusion models. To address this, we cast inference-time attribute distributional alignment as an optimal control problem over the reverse diffusion process, viewing the process as the rollout of a dynamical system and augmenting it with additive, time-dependent perturbations as control. We solve for the perturbations using an optimal-control-based algorithm to optimize a differentiable distribution-matching objective while penalizing control effort to preserve data fidelity. Experiment results in image generation demonstrate that our proposed plug-and-play approach can better align attribute distributions to diverse and flexible test-time targets compared to baselines, without retraining or finetuning the pretrained diffusion model.

Hao Luan, See-Kiong Ng, Chun Kai Ling

School of Computing, National University of Singapore · Institute of Data Science, National University of Singapore

Controllable Image Generation Inference-Time Guidance Diffusion Models

Ask PDF

Jul 1, 2026

Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks

Lightweight machine learning models are increasingly proposed for intrusion detection in Industrial Internet of Things (IIoT) networks due to their suitability for resource-constrained edge deployment. Most reported results evaluate these models only within their training network, leaving behavior on unseen networks unverified. This study trains four lightweight architectures on one IIoT dataset and evaluates them, without retraining, on two structurally distinct IIoT datasets using a feature representation restricted to attributes available across all three sources. Explainability analysis across two top-performing models shows both rely overwhelmingly on coarse port-category features; the most influential category occurs in source-domain attack traffic at 96 to 435 times the rate in the two target domains, indicating that coarsening port resolution relocates rather than removes a documented shortcut. Evaluation under naturally imbalanced class distributions reveals a further effect: the evaluation protocol used can reverse which target network appears to pose the greater generalization challenge. Adversarial robustness and recovery through limited target-domain exposure are also assessed; robustness to adversarial perturbation is unrelated to cross-network generalization, and recovery through adaptation varies considerably by architecture. These findings suggest deployment readiness should be assessed using cross-network evaluation under realistic class distributions, rather than within-domain accuracy alone.

MD Azizul Hakim, Md Shihab Uddin, Talha Ibne Anis

Department of Computer Science and Technology, Bangladesh Sweden Polytechnic Institute Kaptai, Rangamati, Chittagong 4530, Bangladesh · Department of Electrical Engineering, Bangladesh Sweden Polytechnic Institute Kaptai, Rangamati, Chittagong 4530, Bangladesh

IoT Intrusion Detection Network Intrusion Detection Cross-Domain Generalization Edge ML Shortcut Learning Industrial Internet of Things

Ask PDF

Abstract

IoT Intrusion Detection

Explore similar work

AnchorMixGAN: Anchor-Aligned Generative Semi-Supervision for DDoS Detection in Cloud-Integrated IoT Networks

Inference-Time Attribute Distribution Alignment for Unconditional Diffusion

Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks