Robust Federated IIoT Intrusion Detection Under Byzantine Label-Poisoning Attacks: Class-Wise and Client-Wise Analysis on DataSense

The main contribution is empirical, not methodological. The paper shows that global metrics can hide a targeted attack completely. Under Bruteforce→Benign label poisoning, accuracy stays near 94% for all three aggregators. But Bruteforce recall drops to 4.11% under FedAvg. Trimmed Mean recovers it to 47.24%, and FedCARR to 84.65%. The paper backs this with a reproducible 10-client, 8-class non-IID DataSense setup, and with class-wise, client-wise, ROC, and paired statistical diagnostics on one locked experimental grid. The practical takeaway is that robust FL for IIoT intrusion detection must be evaluated per class and per client, since aggregate scores alone will not reveal the failure.