Adversarial ML for IoT Intrusion Detection

The question

Machine-learning intrusion detection systems can be fooled by adversarial examples: tiny, deliberate changes to traffic features that make malicious flows look benign. The Adversarial Attack Detector (AAD) of Verma et al. (2025) defends against this with three layers in series:

1. A rule-based validator that rejects impossible feature combinations.
2. A random-forest discriminator trained to spot adversarial samples.
3. An enhanced IDS ensemble (EIDS) of MLP, CNN and LSTM models, OR-fused.

The reported numbers are striking: 100% discriminator accuracy, with EIDS restoring detection from about 37% to about 100% under BIM and PGD. My project asks whether those numbers survive a harder test.

The gaps

Reviewing the field turned up five recurring problems:

• Coupled evaluation. The defence is trained on the same four attacks it is scored against.
• No adaptive attacker. The threat model says white-box, but every experiment uses an attacker that doesn’t know the defence exists. Carlini & Wagner and Athalye et al. showed that detection defences routinely collapse under adaptive attacks.
• Unrealizable perturbations. Perturbing extracted features freely can produce “attacks” that no real packet sequence could generate. Hasan et al. estimate up to 80.3% of published adversarial examples fail protocol and semantic constraints.
• Wrong traffic. Defences motivated by constrained IoT deployments are validated on enterprise datasets.
• Unreported cost. Latency, memory and throughput go unmeasured, even though detection-based defences can add 120–150% overhead.

The approach

Evaluate AAD under the conditions it claims to handle:

• Attacks it has never seen.
• An adaptive attacker who knows the defence.
• Perturbations constrained to stay realizable.
• Realistic medical-IoT (IoMT) traffic.

The flow explorer

To make the pipeline legible, I built the AAD+ Flow Explorer. It sends one flow at a time through the same probability model the evaluation bench uses. For each flow you choose:

• the attack (PGD and others);
• what the attacker knows (nothing, or the defence itself);
• the scenario (holds, degrades or breaks);
• the EIDS fusion rule.

You then watch where the flow is stopped. Every verdict comes with the reason behind it, so the aggregate numbers on the bench can be traced back to individual decisions.

Measured results are pending and will be added when the evaluation is complete. I won’t publish numbers before they are real.