Architectural Overhead of Differential Privacy in Federated Intrusion Detection Systems

Abstract

Differential privacy (DP) is widely adopted to protect training data in federated intrusion detection systems (IDS), but the reported accuracy penalties conflate two distinct costs: the architectural cost of making models DP-compatible and the noise cost of gradient perturbation. We decompose the DP penalty on two heterogeneous IDS datasets (UNSW-NB15 and Edge-IIoTset) under federated training with Opacus DP-SGD at three privacy budgets (epsilon = 1, 5, 10). Our key finding is that all three epsilon levels converge to essentially identical performance on both datasets (0.2 pp spread on UNSW-NB15; 1.1 pp on Edge-IIoTset), with the entire measurable penalty (9.6 pp and 23.6 pp, respectively) attributable to BatchNorm removal-the architectural prerequisite for DP compatibility. The gradient noise cost is effectively zero. Complementary membership inference attacks (MIA) and gradient reconstruction attacks (DLG) confirm that even non-DP models are empirically private (MIA advantage ≤ 1.0%, DLG reconstruction fails completely), making DP's accuracy cost a price for formal compliance rather than empirical privacy. These findings suggest that research into DP-compatible normalization layers, not noise reduction, is the primary lever for practical privacy-preserving threat detection.