Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks

• URL: http://arxiv.org/abs/2607.00553v1
• Date: Wed, 01 Jul 2026 07:43:26 GMT
• Title: Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks
• Abstract summary: Lightweight machine learning models are increasingly proposed for intrusion detection in Industrial Internet of Things (IIoT) networks.<n>Most reported results evaluate these models only within their training network, leaving behavior on unseen networks unverified.<n>This study trains four lightweight architectures on one IIoT dataset and evaluates them, without retraining, on two structurally distinct IIoT datasets.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Lightweight machine learning models are increasingly proposed for intrusion detection in Industrial Internet of Things (IIoT) networks due to their suitability for resource-constrained edge deployment. Most reported results evaluate these models only within their training network, leaving behavior on unseen networks unverified. This study trains four lightweight architectures on one IIoT dataset and evaluates them, without retraining, on two structurally distinct IIoT datasets using a feature representation restricted to attributes available across all three sources. Explainability analysis across two top-performing models shows both rely overwhelmingly on coarse port-category features; the most influential category occurs in source-domain attack traffic at 96 to 435 times the rate in the two target domains, indicating that coarsening port resolution relocates rather than removes a documented shortcut. Evaluation under naturally imbalanced class distributions reveals a further effect: the evaluation protocol used can reverse which target network appears to pose the greater generalization challenge. Adversarial robustness and recovery through limited target-domain exposure are also assessed; robustness to adversarial perturbation is unrelated to cross-network generalization, and recovery through adaptation varies considerably by architecture. These findings suggest deployment readiness should be assessed using cross-network evaluation under realistic class distributions, rather than within-domain accuracy alone.

Related papers

• When In-Distribution Gains Fail: Evaluating Weak-to-Strong Reward Models under Preference Shift [72.0686608132772]
  We study W2S preference learning under zero-shot distribution shift.<n>We find that strong students trained on weak preference labels can appear successful in-distribution while failing to transfer across preference datasets.<n>We propose Representation Anchoring (Anchor), a simple yet effective regularizer that constrains excessive drift from the pretrained strong model's representation space.
  arXiv  Detail & Related papers  (2026-05-25T09:30:49Z)
• NetDiffuser: Deceiving DNN-Based Network Attack Detection Systems with Diffusion-Generated Adversarial Traffic [1.8225278540778656]
  This paper proposes NetDiffuser, a framework for generating natural adversarial examples (NAEs) capable of deceiving Network Intrusion Detection System (NIDS)<n>NetDiffuser achieves up to a 29.93% higher attack success rate and reduces AE detection performance by at least 0.267 (in some cases up to 0.534) in the Area under the Receiver Operating Characteristic Curve (AUC-ROC) score compared to the baseline attacks.
  arXiv  Detail & Related papers  (2026-03-09T20:13:51Z)
• AI-Based Culvert-Sewer Inspection [0.0]
  Culverts and sewer pipes are critical components of drainage systems, and their failure can lead to serious risks to public safety and the environment.<n>This thesis proposes three methods to significantly enhance defect segmentation and handle data scarcity.<n>ForTRESS is a novel architecture that combines depthwise separable convolutions, adaptive Kolmogorov-Arnold Networks (KAN), and multi-scale attention mechanisms.
  arXiv  Detail & Related papers  (2026-01-21T16:33:33Z)
• SINDER: Repairing the Singular Defects of DINOv2 [61.98878352956125]
  Vision Transformer models trained on large-scale datasets often exhibit artifacts in the patch token they extract. We propose a novel fine-tuning smooth regularization that rectifies structural deficiencies using only a small dataset.
  arXiv  Detail & Related papers  (2024-07-23T20:34:23Z)
• Doubly Robust Causal Effect Estimation under Networked Interference via Targeted Learning [24.63284452991301]
  We propose a doubly robust causal effect estimator under networked interference. Specifically, we generalize the targeted learning technique into the networked interference setting. We devise an end-to-end causal effect estimator by transforming the identified theoretical condition into a targeted loss.
  arXiv  Detail & Related papers  (2024-05-06T10:49:51Z)
• Exploring the Relationship between Samples and Masks for Robust Defect Localization [1.90365714903665]
  This paper proposes a one-stage framework that detects defective patterns directly without the modeling process. Explicit information that could indicate the position of defects is intentionally excluded to avoid learning any direct mapping. Results show that the proposed method is 2.9% higher than the SOTA methods in F1-Score, while substantially outperforming SOTA methods in generalizability.
  arXiv  Detail & Related papers  (2023-06-19T06:41:19Z)
• TWINS: A Fine-Tuning Framework for Improved Transferability of Adversarial Robustness and Generalization [89.54947228958494]
  This paper focuses on the fine-tuning of an adversarially pre-trained model in various classification tasks. We propose a novel statistics-based approach, Two-WIng NormliSation (TWINS) fine-tuning framework. TWINS is shown to be effective on a wide range of image classification datasets in terms of both generalization and robustness.
  arXiv  Detail & Related papers  (2023-03-20T14:12:55Z)
• Triggering Failures: Out-Of-Distribution detection by learning from local adversarial attacks in Semantic Segmentation [76.2621758731288]
  We tackle the detection of out-of-distribution (OOD) objects in semantic segmentation. Our main contribution is a new OOD detection architecture called ObsNet associated with a dedicated training scheme based on Local Adversarial Attacks (LAA) We show it obtains top performances both in speed and accuracy when compared to ten recent methods of the literature on three different datasets.
  arXiv  Detail & Related papers  (2021-08-03T17:09:56Z)
• Coarse to Fine: Domain Adaptive Crowd Counting via Adversarial Scoring Network [58.05473757538834]
  This paper proposes a novel adversarial scoring network (ASNet) to bridge the gap across domains from coarse to fine granularity. Three sets of migration experiments show that the proposed methods achieve state-of-the-art counting performance.
  arXiv  Detail & Related papers  (2021-07-27T14:47:24Z)
• Adversarial Robustness via Fisher-Rao Regularization [33.134075068748984]
  Adrial robustness has become a topic of growing interest in machine learning. Fire is a new Fisher-Rao regularization for the categorical cross-entropy loss.
  arXiv  Detail & Related papers  (2021-06-12T04:12:58Z)
• Anomaly Detection on Attributed Networks via Contrastive Self-Supervised Learning [50.24174211654775]
  We present a novel contrastive self-supervised learning framework for anomaly detection on attributed networks. Our framework fully exploits the local information from network data by sampling a novel type of contrastive instance pair. A graph neural network-based contrastive learning model is proposed to learn informative embedding from high-dimensional attributes and local structure.
  arXiv  Detail & Related papers  (2021-02-27T03:17:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.