Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure
The paper proposes adding a physics-based admission gate to federated intrusion/anomaly detection for water infrastructure, where clients must show their local telemetry obeys mined process invariants before their model updates are accepted. The neat part is that it moves poisoning defense out of pure gradient/update space and ties it to verifiable cyber-physical consistency, even sketching zk-SNARK-based privacy-preserving compliance, though its protection is only as strong as the mined invariants, which catch only a subset of real attacks and likely depend on clean training data and system-specific physics.
Abstract
Federated learning enables industrial operators to train shared intrusion detection models without disclosing proprietary operational telemetry. However, existing defenses operate strictly in update space, leaving aggregators blind to data poisoning; model updates derived from fabricated telemetry remain indistinguishable from honest contributions. We repurpose cyber-physical process invariants, such as conservation laws and actuator couplings, from runtime detection heuristics into a verifiable admission requirement for federated updates, mined automatically from clean operational data. We evaluate this admission gate across two physical water testbeds (SWaT, WADI) and a distribution benchmark (BATADAL), testing seven aggregation rules against telemetry fabrication, exposure-only replay poisoning, and an invariant-aware adaptive adversary. Across three testbeds the mined invariants reject none of 100 honest shards and all naively fabricated ones, including optimised perturbations that FoolsGold admits in full. On real telemetry, five mined invariants detect 12 of SWaT's 35 attacks, while nine invariants detect 20, with no honest shard rejected. With nine rules, the physics gate recovers 69--100% of the targeted-attack recall lost to replay poisoning, and 54--100% of that lost to fabricated telemetry, across five standard aggregators. To reconcile physical admission control with federated data privacy, we show invariant compliance using zero-knowledge proofs (zk-SNARKs) to allow clients to prove batch adherence without revealing operational telemetry.