FedContrast-Shot: Privacy-Preserving Federated Contrastive Meta-Learning for Few-Shot Anomaly Detection in Cloud–Edge IIoT

Abstract

Cloud-based deployments of Industrial Internet of Things (IIoT) systems have become more common for real-time monitoring and control of critical systems. However, anomaly detection in such environments remains challenging because labeled attack data are scarce, operational data are distributed across privacy-sensitive edge nodes, and detection models must adapt rapidly to unseen or evolving attack patterns. Existing approaches typically address these challenges separately, limiting their effectiveness when few-shot learning, privacy preservation, and rapid adaptation are required simultaneously. This paper proposes FedContrast-Shot (FCS), a privacy-preserving federated few-shot learning framework for anomaly detection in IIOT by employing a single FedContrastMeta (FCM) optimization objective. FCS builds on a hierarchical dual-stream encoder model using graph attention networks to model relationships among different sensors and temporal transformers to model sequential patterns, with cross-attention fusion. Rapid adaptation to emerging attack patterns is achieved through second-order MAML, while privacy is enforced using Rényi differential privacy and additive homomorphic encryption–based secure aggregation. Experiments on the SWaT and WADI industrial control system benchmarks, using only 1–5 labeled samples per attack class, yielded F1-scores of 97.41% and 95.60%, respectively, under an of ε=1.0 and δ=10⁻⁵ differential privacy guarantees. Compared with the strongest evaluated baselines, FCS achieved relative F1-score improvements of 9.1% on SWaT and 13.3% on WADI. The framework converged within 95 federated communication rounds, reduced communication cost by 48.3% relative to the reference federated baseline, and achieved an average inference latency of 12.8 ms. These findings support its potential for real-time anomaly detection in cloud–edge IIoT environments.