Attribution Drift in Federated Intrusion Detection — code and artifacts

Abstract

Federated learning (FL) trains a shared network-intrusion detector across organisations without pooling raw traffic, and such deployments increasingly demand explainability. Yet FL traffic is deeply **non-IID**, and heterogeneity's effect on a model's *explanations* is uncharacterised. We audit it. Sweeping the Dirichlet concentration α ∈ {0.1, 0.5, 1.0, ∞} across five clients, under two aggregation rules (FedAvg and an entropy-weighted hierarchical rule) and five seeds, we measure task performance, explanation **faithfulness** (via Expected Gradients) and — newly — **global–local attribution divergence** on a fixed probe set. Heterogeneity does **not** erode faithfulness, and it does not change feature *ranking*, which stays at noise level even on classes a client never saw. What it reshapes is attribution *magnitude*: the normalised L1 global–local divergence grows about an order of magnitude from IID to the most heterogeneous split, and class-conditional measurement shows this is dominated by a systematic **30–42% inflation of the local models' attribution mass**, not a redistribution of it. Two experiments separate the effect from the accompanying accuracy drop, which the α-sweep alone cannot: at **matched validation macro-F1** the ordering persists (replicated on held-out seeds), and under a proximal-term intervention that lowers accuracy the α effect retains 80–89% of its size, with divergence moving *opposite* to the performance prediction while weight drift is unchanged. FedAvg and the hierarchical rule are indistinguishable on every explanation axis. A monitoring use was tested and **not supported**: within a heterogeneity level it does not identify under-served clients. A UNSW-NB15 replication and a feature-shuffle control reproduce the signature. Anonymised package accompanying a manuscript under double-blind review