Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks
Summary
This paper investigates the cross-domain generalization failure of lightweight ML models for IIoT intrusion detection, finding they rely on coarse port features and that adversarial robustness does not correlate with cross-network performance.
View Cached Full Text
Cached at: 07/02/26, 11:48 AM
Paper page - Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks
Source: https://huggingface.co/papers/2607.00553
Abstract
Lightweight machine learning models for IIoT intrusion detection show limited generalization across networks due to reliance on coarse port-category features and imbalanced class distributions, with adversarial robustness not correlating with cross-network performance.
Lightweight machine learning models are increasingly proposed forintrusion detectioninIndustrial Internet of Things(IIoT) networks due to their suitability for resource-constrainededge deployment. Most reported results evaluate these models only within their training network, leaving behavior on unseen networks unverified. This study trains four lightweight architectures on one IIoT dataset and evaluates them, without retraining, on two structurally distinct IIoT datasets using afeature representationrestricted to attributes available across all three sources.Explainability analysisacross two top-performing models shows both rely overwhelmingly on coarse port-category features; the most influential category occurs in source-domain attack traffic at 96 to 435 times the rate in the two target domains, indicating that coarsening port resolution relocates rather than removes a documented shortcut. Evaluation under naturally imbalanced class distributions reveals a further effect: the evaluation protocol used can reverse which target network appears to pose the greater generalization challenge.Adversarial robustnessand recovery through limited target-domain exposure are also assessed; robustness to adversarial perturbation is unrelated to cross-network generalization, and recovery through adaptation varies considerably by architecture. These findings suggest deployment readiness should be assessed usingcross-network evaluationunder realistic class distributions, rather than within-domain accuracy alone.
View arXiv pageView PDFAdd to collection
Get this paper in your agent:
hf papers read 2607\.00553
Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash
Models citing this paper0
No model linking this paper
Cite arxiv.org/abs/2607.00553 in a model README.md to link it from this page.
Datasets citing this paper0
No dataset linking this paper
Cite arxiv.org/abs/2607.00553 in a dataset README.md to link it from this page.
Spaces citing this paper0
No Space linking this paper
Cite arxiv.org/abs/2607.00553 in a Space README.md to link it from this page.
Collections including this paper0
No Collection including this paper
Add this paper to acollectionto link it from this page.
Similar Articles
The Cross-Domain Generalization Cost of Offensive Language Detection
This paper proposes a diagnosis and optimization framework for cross-domain and cross-lingual generalization in offensive language detection, decomposing performance degradation into dataset and language effects, and quantifying the trade-off between multilingual capability and source-task performance.
A Three-Axis Stress Test of LLM vs Classical ML for Network Intrusion Detection under Distribution Shift and Adversarial Evasion
This paper compares XGBoost and RoBERTa-LoRA for network intrusion detection across same-dataset, cross-dataset transfer, and adversarial evasion axes, showing that no universal winner exists and performance depends on the evaluation condition.
An Adversarial Zero-Shot Learning Approach for Anomaly Detection in Multivariate IoT Traffic Data
This paper proposes a zero-shot learning framework for multivariate IoT traffic anomaly detection using adversarial and contrastive learning within a variational autoencoder, enabling domain adaptation without labeled data and demonstrating strong performance across diverse datasets.
My federated learning project just showed that "high accuracy" can completely hide a model missing every single attack from an entire category, and I think more people should know about this [R]
A federated learning research project reveals that global accuracy can mask catastrophic failure on minority attack classes in network intrusion detection, showing that per-client performance and aggregation method choice are critical for rare attack detection.
An In-Vitro Study on Cross-Lingual Generalization in Language Models
This paper introduces an in-vitro framework with two procedurally generated languages to study cross-lingual generalization in language models, finding that tokenization's preservation of reusable substructure is more critical than lexical similarity or data balance for transferring capabilities across languages.