🤖 AI

Tri-LLM Cooperative Federated Zero-Shot Intrusion Detection with Semantic Disagreement and Trust-Aware Aggregation

This paper proposes a Tri-LLM cooperative federated learning framework that leverages semantic disagreement and trust-aware aggregation to enable robust, privacy-preserving zero-shot intrusion detection for previously unseen attacks in heterogeneous IoT networks.

Original authors: Saeid Jamshidi, Omar Abdul Wahab, Foutse Khomh, Kawser Wazed Nafi

Published 2026-02-03

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Saeid Jamshidi, Omar Abdul Wahab, Foutse Khomh, Kawser Wazed Nafi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, global neighborhood where everyone is trying to keep their homes safe from burglars. In the past, to catch a thief, all the neighbors would have to send their security camera footage to a central police station. But in the modern world, sending all that video is too slow, uses too much internet, and violates everyone's privacy.

So, instead of sending the video, the neighbors agree to train their own local security guards. They send only the "lessons learned" (not the video) to a central coordinator, who mixes them together to make everyone smarter. This is called Federated Learning.

However, there's a big problem: the old security guards were trained only on a list of known burglars (like "The Man in the Red Hat"). If a new type of thief shows up wearing a disguise the guards have never seen, the old guards get confused and might confidently say, "That's definitely the Man in the Red Hat!" even though it's a stranger. They can't handle the "unknown."

This paper proposes a new, smarter system called Tri-LLM Cooperative Federated Zero-Shot Intrusion Detection. Here is how it works, using simple analogies:

1. The Three Wise Judges (The Tri-LLM)

Instead of just one security guard, the system uses a panel of three different "Super-Intelligences" (Large Language Models, or LLMs): GPT-4o, DeepSeek-V3, and LLaMA-3-8B.

Think of these three as expert detectives who have read every book on crime but have never seen a specific crime scene.

Detective A is great at understanding the motive (why the thief did it).
Detective B is great at spotting the symptoms (what the thief left behind).
Detective C is great at understanding the strategy (how the thief planned the escape).

When a new, unknown attack happens, these three detectives don't just look at a checklist. They read a description of the attack and create a "mental sketch" (a semantic prototype) of what it looks like.

2. The "Disagreement" Alarm (Epistemic Uncertainty)

Here is the clever part: The system doesn't just ask, "What is this?" It asks, "Do the three detectives agree?"

Scenario A: All three detectives agree, "This looks like a classic bank robbery." The system is confident.
Scenario B: Detective A says, "This looks like a bank robbery," but Detective B says, "No, this looks like a computer virus," and Detective C is confused. The system notices this disagreement.

In this new system, disagreement is not a mistake; it's a warning signal. If the experts can't agree on what the new threat is, the system knows, "We don't know what this is yet. This is a 'Zero-Day' (brand new) threat." It flags it as high risk instead of guessing wrong.

3. The Trustworthy Neighborhood Watch (Trust-Aware Aggregation)

In a real neighborhood, some security guards might be lazy, unreliable, or even working for the burglars (poisoned clients). If the central coordinator blindly mixes everyone's lessons, the whole system could get corrupted.

This paper introduces a Trust Score.

Imagine the coordinator checks each guard's work. If a guard's "lessons" fit perfectly with the group's shared understanding of crime, they get a high trust score.
If a guard's lessons are weird, inconsistent, or don't match the group's "mental sketches," their trust score drops.
The coordinator then gives more weight to the trustworthy guards and ignores the unreliable ones. This keeps the system safe even if some participants are broken or malicious.

4. The Result: Seeing the Unseen

The paper tested this system and found:

It works on new threats: It can identify attack patterns it has never seen before (Zero-Shot) with over 80% accuracy.
It knows when it's unsure: It successfully spots "Zero-Day" attacks (brand new, unknown threats) about 10% better than older systems that just try to match patterns.
It stays stable: Even when some neighbors have bad internet or unreliable data, the system keeps learning correctly because it trusts the reliable data more.

Summary

Think of this system as a global neighborhood watch that doesn't rely on a list of known faces. Instead, it uses three expert detectives to describe crimes in plain language. If the detectives agree, they catch the thief. If they argue, the system knows it's a new, dangerous threat and raises the alarm. It also ignores the unreliable neighbors to ensure the whole group stays smart and safe.

This allows cyber-security systems to protect networks without needing to share private data, while staying alert to brand-new types of attacks that have never been seen before.

Technical Summary: Tri-LLM Cooperative Federated Zero-Shot Intrusion Detection

Problem Statement
Current Federated Learning (FL) based Intrusion Detection Systems (IDS) face two critical limitations in modern cyber-physical and IoT environments. First, most operate under closed-set assumptions, relying on fixed label spaces and static signatures that fail to detect zero-day or previously unseen attack behaviors. Second, existing frameworks often lack principled mechanisms for calibrated uncertainty estimation and struggle with heterogeneous, unreliable clients in non-identically distributed (non-IID) settings. While Large Language Models (LLMs) offer strong semantic reasoning capabilities, their integration into federated pipelines for open-world security remains largely unexplored, particularly regarding how to handle semantic ambiguity and client trust without centralized data access.

Methodology
The paper proposes a semantics-driven federated IDS framework that decouples semantic knowledge generation from the federated optimization process. The core architecture consists of three main components:

Tri-LLM Semantic Prototype Construction:
Instead of federating the LLMs, the framework utilizes a centralized ensemble of three distinct models—GPT-4o, DeepSeek-V3, and LLaMA-3-8B—to generate semantic attack prototypes. For each attack category, the models process three distinct textual perspectives (offensive goals, defensive symptoms, and adversarial strategies) to produce embeddings. These are fused into a single semantic prototype ( $z_a$ ) representing the attack concept in a shared embedding space. Crucially, the semantic disagreement ( $D_a$ ) among the three models is explicitly calculated as an epistemic uncertainty signal.
Trust-Aware Federated Aggregation:
Clients train lightweight local semantic projection models ( $W_i$ ) to map low-level telemetry features into the shared semantic space defined by the LLM prototypes. The framework introduces a trust-aware aggregation mechanism where client updates are weighted based on their semantic alignment loss. Clients with lower loss (better alignment with global prototypes) receive higher trust scores. This process includes temporal smoothing to ensure stability and monitors trust entropy to detect convergence and the concentration of trust on reliable participants, thereby mitigating the impact of drifting or compromised clients.
Zero-Shot Inference and Risk Estimation:
During inference, incoming traffic is projected into the semantic space and matched against language-derived prototypes via cosine similarity. The system computes a Zero-Day Score (ZDS) that combines semantic similarity confidence with the inter-LLM semantic disagreement. High disagreement and low similarity result in a high ZDS, flagging the observation as a potential zero-day threat with calibrated uncertainty, rather than forcing a confident but potentially incorrect classification.

Key Contributions

Tri-LLM Semantic Supervision: The introduction of a federated paradigm that integrates language-derived semantic prototypes to enable zero-shot attribution under open-set conditions, moving beyond statistical feature learning.
Disagreement-Aware Risk Modeling: A novel metric that treats inter-LLM semantic disagreement as a direct signal of epistemic uncertainty, enabling calibrated zero-day risk estimation without labeled zero-day samples.
Trust-Aware Aggregation: A loss-driven weighting mechanism that dynamically adjusts client influence based on semantic alignment quality, enhancing robustness against non-IID data and unreliable participants.

Experimental Results
The framework was evaluated against protocol-compatible federated baselines (e.g., FedAvg variants) and representative FL-IDS frameworks. Key findings include:

Zero-Shot Performance: The full framework achieved over 80% zero-shot detection accuracy on unseen attack patterns, significantly outperforming similarity-only baselines and closed-set federated methods.
Uncertainty Calibration: A strong inverse relationship was observed between semantic disagreement and detection confidence ( $\partial C / \partial D_a < 0$ ). The system successfully identified zero-day risks by leveraging disagreement, improving zero-day discrimination by more than 10% compared to baselines.
Convergence and Stability: Trust entropy analysis demonstrated a monotonic decline, indicating stable convergence where trust concentrates on reliable clients. Semantic alignment improved steadily across federated rounds, confirming that heterogeneous clients can converge to a coherent global semantic space without raw data exchange.
Diversity as an Asset: The study found a weak but positive correlation between semantic diversity (measured by trust entropy) and detection accuracy, suggesting that controlled heterogeneity enhances generalization rather than degrading performance.

Significance and Claims
The paper claims to establish a new paradigm for adaptive, interpretable, and privacy-aware IDS. By unifying LLMs, FL, and semantic reasoning, the framework addresses the "open-world" challenge where attack labels are incomplete or unavailable. The authors emphasize that their approach shifts the design focus from marginal closed-set accuracy to calibrated open-world behavior, providing a principled method for zero-day risk assessment. The work posits that semantic diversity, when regulated through trust-aware fusion, acts as a systemic advantage for generalization. The proposed system is presented as a theoretically grounded solution for next-generation cybersecurity that operates effectively under dynamic threat landscapes without requiring centralized data collection or retraining on labeled zero-day examples.

Limitations and Future Directions
The authors acknowledge that the current implementation relies on pre-trained LLMs not specifically fine-tuned for network security semantics and focuses on semantic-level rather than raw packet-level features. They note that the trust mechanism assumes honest-but-curious clients and does not fully address targeted poisoning of semantic embeddings. Future work is proposed to explore adaptive trust modeling via reinforcement learning, multimodal telemetry integration, and large-scale deployment studies in real-world industrial IoT environments.