Pruning input layers breaks IoT device intrusion detection accuracy
Input-Layer Starvation: Why Per-Layer Pruning Breaks IoT Intrusion Detectors
Cryptography and SecurityMachine Learning
Summary
Many small devices rely on pruning neural networks to save space while detecting threats, but this causes serious problems hidden by overall accuracy scores. The authors found that pruning the first layer of a network starves some parts of the model, making it fail on many attack types. They show that keeping the first layer unpruned or adjusting normalization fixes these failures without much extra cost. Their findings reveal actual detection errors rather than silent misses, improving trust in IoT security tools.
What this means in practice
- •For iot device makers: Design intrusion detectors by protecting or adjusting the first neural network layer to maintain accuracy after pruning for resource constraints.
- •For network security teams: Improve IoT threat detection tools by recomputing normalization statistics to fix pruning-induced detection failures without retraining weights.
Authors
Md Anas Biswas
Abstract
Intrusion detectors for small Internet-of-Things (IoT) devices are usually compressed by pruning and judged by overall accuracy. We show that this hides a severe class-level failure, find its cause, and give low-overhead prevention and repair. On CICIoT2023, a two-layer convolutional detector pruned with uniform layer-wise magnitude pruning at 80% sparsity loses 16 points of accuracy but half of its macro-F1, the mean per-class F1 (0.542 to 0.271 over five independently trained models); 17 of 34 classes are materially damaged. Remaining weight count does not explain it: a perceptron and a transformer pruned to the same or fewer weights lose at most 0.096. The first layer does. It has 192 weights; uniform pruning leaves 38, 46% of its 64 filters lose every input weight, and fine-tuning under that starvation leaves the running means of the first normalisation layer displaced by up to 0.8 standard deviations in a few surviving channels, on which the deployed model collapses. Protecting those 192 weights, or pruning globally at the same sparsity, prevents the collapse (loss 0.013); recomputing the normalisation statistics on unlabelled training data, with no weight changed, repairs it (loss 0.039) and returns the false-alert rate to 33% (dense 29%). Damage shows a strong increasing dose-response in first-layer sparsity, starving a perceptron's input layer reproduces the collapse, and the pattern holds on TON_IoT. The failure is misattribution and false alerts, not silent evasion: on validation-selected blind spots, uniformly pruned detectors misattribute 72% of the traffic, against 50% with the first layer protected and 47% for the dense model.