Large language models (LLMs) are increasingly explored as network intrusion detection classifiers, but their adversarial robustness under realistic attacker constraints remains unclear. We present a controllability-aware black-box transfer framework for LLM-based network traffic classifiers. The framework partitions flow features into directly controllable (DC), indirectly controllable (IC), and uncontrollable (UC) groups according to network communication semantics, then restricts perturbations to DC features while freezing IC/UC features. Using a shared XGBoost surrogate, we generate finite-difference PGD, greedy coordinate-wise, and NES adversarial examples and transfer them to seven LLM targets and two conventional ML targets across five IDS benchmarks from 1999 to 2022. Across 27 valid LLM configurations and over 500,000 adversarial examples, we find that LLM transfer vulnerability is substantial but dataset- and comparator-dependent. Compared with LightGBM, LLMs are more vulnerable on RT-IoT2022 and CIC-IDS-2018, comparable on NSL-KDD and UNSW-NB15, and less vulnerable on HIKARI-2021; compared with the averaged ML baseline, LLMs show higher ASR on all five datasets. We further observe a consistent cross-architecture transfer hierarchy: gradient- and score-based perturbations transfer more effectively than greedy perturbations across all 27 LLM cells and 9/10 ML cells. Cross-surrogate validation with tree, neural, and linear surrogates yields similar LLM ASR, reducing evidence that the findings are XGBoost-specific. Constraint violation rate is 0\% by construction.
Deep learning based network intrusion detection systems (IDS) can achieve strong traffic classification performance, but their resilience to adversarial manipulation remains a critical concern. This study evaluates the adversarial robustness of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models in a multiclass intrusion detection setting using the Train_Test_Network dataset with ten traffic classes. The models were trained on true sliding flow-window sequences under a unified preprocessing pipeline to support fair comparison. Adversarial robustness was first assessed under a white-box Fast Gradient Sign Method (FGSM) setting and then broadened through additional FGSM and Projected Gradient Descent (PGD) stress testing. SHapley Additive exPlanations (SHAP) were further used to analyse explanation instability under clean and adversarial conditions, and explanation-drift features were evaluated as a secondary adversarial detection signal. Under clean evaluation, both models achieved strong and nearly identical performance, with accuracies of 0.9614 for LSTM and 0.9615 for GRU and weighted F1-scores of 0.9597 and 0.9598, respectively. Under the main FGSM condition, performance declined substantially: the LSTM achieved adversarial accuracy of 0.6094 and weighted F1-score of 0.6290 with an evasion rate of 37.38%, while the GRU achieved adversarial accuracy of 0.5130 and weighted F1-score of 0.5690 with an evasion rate of 47.02%. The broader robustness sweep showed that iterative PGD exposed stronger fragility than FGSM alone. SHAP analysis indicated that adversarial perturbation altered both prediction outcomes and local explanation structure. A learned explanation-driven detector improved over the rule-based baseline, while larger-scale validation confirmed that explanation drift remained informative, though not perfectly separable, at broader scale. Overall, the results show that strong clean performance does not imply adversarial robustness, and that explanation drift provides a useful auxiliary signal for adversarial monitoring in recurrent IDS models.
Elijah M. Maseno, Yanxia Sun, Zenghui Wang· International Journal of Inf...· 0 citations
UA-EAD is proposed, an uncertainty-aware evidential adversarial defense that equips the detector with an evidential head yielding calibrated predictive uncertainty in a single forward pass, trains it with an uncertainty-weighted adversarial objective plus a consistency regularizer that concentrates robustness on the most uncertain, near-boundary flows, and uses the resulting uncertainty for selective prediction.
Jiawen Luo, Samuel Price· International Journal of Adv...· 0 citations
Cloud intrusion detection systems increasingly rely on machine learning classifiers trained on flow-level telemetry. Such classifiers can be accurate on clean traffic but fragile under adversarial evasion, because attackers may adjust mutable statistics such as timing, packet counts, or byte rates while preserving malicious functionality. This paper proposes SHAP-RW-AT, an explainable robust intrusion detection framework that combines adversarial augmentation with SHAP-guided feature reweighting. A base detector is first explained with SHAP values to identify decision-dominant features. These explanations are then combined with a domain mutability prior: highly important but easily manipulated flow statistics are attenuated, whereas stable high-importance indicators such as destination-port dispersion, failed-login behavior, and cloud API activity are reinforced. The reweighted representation is trained with diversified evasion examples generated by mean-shift, surrogate-gradient, and SHAP-aware perturbations under semantic constraints. Because public cloud-intrusion datasets could not be redistributed or downloaded inside the execution environment, we evaluate the method on a fully reproducible synthetic cloud-flow benchmark generated by the accompanying code; no result is claimed as a measurement on CICIDS-2017, UNSW-NB15, or CVD. Across three random seeds, SHAP-RW-AT obtains 99.67% clean accuracy and 99.71% average robust accuracy under three evasion strategies, reducing adversarial false negatives from 26.47% for a standard XGBoost detector to 0.18%. The results indicate that explanation-guided feature reweighting can act as a lightweight and auditable robustness mechanism for cloud IDS pipelines, while preserving traceability of the defensive decision logic.
Hugo Laurent, Paula Silva· Computer Life· 0 citations
As large language models (LLMs) are deployed in security-critical environments, evaluating their robustness against adversarial threats is essential. We present a two-phase evaluation of ten Llama variants using the OWASP Top 10 for LLM Applications. In Phase I we benchmark 100 OWASP-based adversarial prompts; Llama-Guard-3-1B leads (76% detection, 0.165 s latency, 0.94 GB VRAM), while base models detect nothing. In Phase II we apply nine encoding obfuscations to the same prompts (9,000 inferences): Base64 stays detectable (up to 100%), hexadecimal collapses to 2%, and ASCII art fully bypasses all text-only models. Model scale alone does not ensure robustness; targeted safety training and encoding-aware defenses are required. Both benchmark datasets are released for reproducibility [3].
Nourin Shahin, I. Alsmadi· Practice and Experience in A...· 0 citations
Lightweight, privacy-aware and adversarial robust intrusion detection is required for the proliferation of Internet of Things (IoT) devices. In the Industrial Internet of Things (IIoT), centralized detectors can be compromised by adversarial perturbations via gradient-based attacks, making them susceptible to raw traffic. We suggest Federated Learning-Adaptive Gated Recurrent Unit (FL-AdGRU), a Federated approach that combines a lightweight Gated Recurrent Unit (GRU) classifier with alternating adversarial fine-tuning on each client using FGSM and PGD, without any communication overhead. A two-stage resampling scheme (UCAS-SMOTE) reduces the class-imbalance ratio from 4081:1 to ≈4:1, followed by 61 features being reduced to 40 by a mutual-information selector (MI-SelectK). Under this scenario, FL-AdGRU achieves 99.9% accuracy and 0.999 weighted F1 (+6.5 p.p. over the federated DNN baseline), with no loss of accuracy when facing clean attacks, and boosts Fast Gradient Sign Method FGSM/Projected Gradient Descent (PGD) robustness by +19.3/+19.0 p.p. at the same level of ϵ = 0.1, thus effectively balancing the accuracy–robustness trade-off. It is robust (97.8%/84.2% on UNSW-NB15) and generalizes well to UNSW-NB15, while decaying slowly in skeptical scenarios (≈99.9% weighted F1 for moderate skew, 93.9%/86.7% for severe). Assuring data-locality privacy through exchange of only model weights; defenses against inference attack are left for future work. FL-AdGRU, with a total communication of 43.8 MB (≈50× less than centralized training), is deployable on bandwidth-constrained IIoT networks.
Lightweight machine learning models are increasingly proposed for intrusion detection in Industrial Internet of Things (IIoT) networks due to their suitability for resource-constrained edge deployment. Most reported results evaluate these models only within their training network, leaving behavior on unseen networks unverified. This study trains four lightweight architectures on one IIoT dataset and evaluates them, without retraining, on two structurally distinct IIoT datasets using a feature representation restricted to attributes available across all three sources. Explainability analysis across two top-performing models shows both rely overwhelmingly on coarse port-category features; the most influential category occurs in source-domain attack traffic at 96 to 435 times the rate in the two target domains, indicating that coarsening port resolution relocates rather than removes a documented shortcut. Evaluation under naturally imbalanced class distributions reveals a further effect: the evaluation protocol used can reverse which target network appears to pose the greater generalization challenge. Adversarial robustness and recovery through limited target-domain exposure are also assessed; robustness to adversarial perturbation is unrelated to cross-network generalization, and recovery through adaptation varies considerably by architecture. These findings suggest deployment readiness should be assessed using cross-network evaluation under realistic class distributions, rather than within-domain accuracy alone.