Trust-based defenses help against small backdoors in federated intrusion detection
When Does Trust Help? A Leakage-Free Evaluation of Representation- and Aggregation-Based Defenses Against Backdoors in Federated Intrusion Detection
Cryptography and Security
Summary
Intrusion detection systems that learn together from private network data can be tricked by attackers inserting hidden backdoors. The paper shows that some defenses which trust a small clean dataset can reduce backdoor attacks, but only when the attack signals are small or subtle. Larger or stronger attacks still succeed despite these defenses. The authors provide a careful evaluation method that avoids common flaws and release it so future work can better test defense strategies.
What this means in practice
- •For network security engineers: Evaluate and select client scoring defenses for federated intrusion detection when backdoor triggers are weak or clients are heterogeneous.
- •For cybersecurity operations teams: Use the released evaluation protocol to rigorously test federated IDS defenses against adaptive poisoning attacks in realistic settings.
Authors
Shiddarth Dey Tusar, Zawad Yalmie Sazid
Abstract
Federated learning (FL) lets distributed intrusion-detection systems (IDS) train on private traffic, but exposes the global model to poisoning and backdoor attacks under non-IID client data. A popular defense family scores or filters clients using a small trusted "root" dataset and the similarity of client behaviour to a trusted reference. I re-examine these trust-based defenses under a protocol designed to remove common evaluation artifacts: train-only feature standardization, a server root set disjoint from client data, multi-seed (n=6) runs with paired significance tests, formal (varepsilon, delta) accounting for DP-SGD, and a defense-aware adaptive attacker. Across three NIDS datasets (CSE-CIC-IDS2018, NF-ToN-IoT, NF-UNSW-NB15-v2) I find: (1) a representation-similarity aggregator (RepGuard) significantly improves classification utility and seed-stability over FLTrust under heavy non-IID poisoning, and - under severe heterogeneity or many adversaries - also lowers backdoor ASR substantially (e.g., 0.48 vs FLTrust 0.86 at Dirichlet alpha=0.1); (2) at strong trigger magnitudes no defense reduces backdoor attack success rate (ASR approx 0.95); (3) a controlled trigger-magnitude sweep shows defenses help only for small triggers (ASR 0.10 for RepGuard at magnitude 0.5, vs. 0.40 undefended) and collapse to ASR approx 1.0 by magnitude 2; (4) a triggered-canary check that assumes knowledge of the attacker's trigger - the assumption behind much prior "success" - lowers ASR from 0.49 to 0.12, i.e., trigger knowledge, not representation scoring, suppresses the backdoor; (5) correctly-accounted DP-SGD (varepsilon in [0.3, 16]) costs little utility but does not mitigate the backdoor. I release the protocol so future FL-IDS defenses can be evaluated without the leakage and oracle assumptions that inflate reported robustness.