Oilfield sites stop handing over traffic: secret shares leave servers one accept bit, holding F1 at 0.641 under 30% attackers

Oilfield sites can train one shared intrusion detector without pooling their network traffic, while poisoned updates are kept out of the aggregate. Byzantine-robust aggregation rules previously had to read every update in the clear, whereas secure aggregation hides updates and with them the evidence needed to detect poisoning. On a 15-class Edge-IIoTset task with ten sites holding differently distributed data and ten random seeds, macro-F1 was 0.708 on clean data, against 0.706 for FedAvg.

Each server receives only one accept bit per site and the final aggregate, not any individual update. Sites additively secret-share their updates, so each server holds one share, and a single share is uniformly distributed and reveals nothing about the original update. An update-inference attacker recovered each site's class mix from plaintext updates with Spearman correlation 0.81, but scored 0.20 from one server's shares.

Whether an accepted update actually entered the published aggregate can be checked from outside. Earlier direction tests gave a site no way to verify that its accepted update entered the published aggregate. Sites post Pedersen commitments and the servers publish Merkle roots and accept bitmaps; the audit and all inclusion proofs passed, and unit tests cover tamper detection.

The aggregator targets settings that can supply two independently operated servers and a small clean root set, for example a corporate security operations centre split from a regional or contractor domain, with the root set taken from a testbed capture. The evaluation uses public Edge-IIoTset traffic with simulated sites and an 80–24–15 multilayer perceptron over 30 rounds and 10 seeds, and no operator data are used. Online communication is 1.72 MiB per round, about 19.4 times the plain FedAvg upload; the authors note this is feasible on corporate WAN links but expensive on low-bandwidth satellite or radio channels to remote wellheads, and suggest running the root-guided cosine test on plaintext updates there or amortizing bandwidth with less frequent rounds.

The privacy guarantee rests on the two servers not colluding and does not cover leakage from the released global model weights; the authors report that if both servers collude, the attacker regains plaintext-level success. Accept bits and the revealed aggregate remain channels visible to one server; at threshold 0.9 the accept bit correlates little with site atypicality and honest rejection stays below 1%, but a tighter norm bound rejects 43.5% of honest updates and leaks their atypicality. Backdoor updates pass the filter with attack success rate 1.000, and the noise mitigation is heuristic, leaving attack success rate 0.091 at noise multiplier 2 with privacy budgets too large to be a meaningful differential-privacy guarantee. The authors also note that the adaptive attacker targets PVBRF-ID's norm bound and reference, while multi-Krum and trimmed mean face only a scaled loss-ascent update, and attacks crafted against distance-based rules are not yet included.