Find papers from 2023-2026 on federated learning intrusion detection (IoT/IIoT) that use SHAP or other feature attributions to screen, weight, or detect malicious or untrustworthy clients. For each paper give: title, authors, venue, year, DOI, the dataset(s), the attacks evaluated, how attributions are used (screening / weighting / explanation only), and whether an adaptive attacker that knows the defense is evaluated. Include Zero-Trust Agentic Federated Learning for Secure IIoT Defense Systems (arXiv 2512.23809) and XAI FL-IDS (arXiv 2605.19448) if they appear.
Papers matching the client-attribution criterion
I searched academic records dated 2023–2026 in Semantic Scholar, OpenAlex, and PubMed. From the retrieved abstracts, I found two direct IoT/IIoT matches where feature attribution is explicitly used to weight client updates or identify malicious clients, plus one adjacent Internet-of-Vehicles (IoV) paper. The available evidence is abstract-level only; the table distinguishes an attack experiment from a test of an attacker who knows and adapts to the defense.
| Paper | Authors; venue; year; DOI | Dataset(s) | Attacks evaluated (as stated in abstract) | Attribution function | Adaptive, defense-aware attacker evaluated? |
|---|---|---|---|---|---|
| Federated Learning for Distributed IoT Security: A Privacy-Preserving Approach to Intrusion Detection | Gutti Chandu, Karthik Thumula, Balbudhe Parag; IEEE Access; 2025; 10.1109/ACCESS.2025.3592481 | CIC-BCCC-NRC TabularIoTAttack-2024; Edge-IIoTset; 100 simulated ARM-class devices. | FGSM and PGD-10 perturbations, plus label-flip attacks. The abstract reports 66–73% accuracy under these attacks, but does not specify a defense-aware adaptive adversary. | Weighting. HADA weights client updates according to SHAP-based feature stability and each client’s differential-privacy budget; this is directly used in aggregation to down-weight noisy/low-privacy updates and is described as hardening against poisoning. [citation_113i4x] | Not reported in the retrieved abstract. Adversarial perturbation and label-flip tests are reported, but not an attacker explicitly adapting with knowledge of HADA. |
| Zero-Trust Agentic Federated Learning for Secure IIoT Defense Systems | Samaresh Kumar Singh, Joyjit Roy, Martin So; arXiv preprint; 2025; DOI not listed in the retrieved record (arXiv:2512.23809). | Edge-IIoTset; CIC-IDS2017; UNSW-NB15. | Byzantine poisoning, including a reported test with 30% Byzantine clients; the abstract also reports adversarial robustness but does not name those attack types. | Screening/detection and weighting. SHAP-weighted aggregation is presented as explainable Byzantine detection under non-IID conditions. [citation_1bcj4b] | Not reported in the retrieved abstract. A 30%-Byzantine evaluation is not, by itself, evidence that the adversary knew or adapted to the defense. |
| Explainable AI for Federated Learning-Based Intrusion Detection Systems in Connected Vehicles (adjacent IoV evidence, not strictly IoT/IIoT) | Ramin Taheri, Raheleh Jafari, Alexander Gegov, Farzad Arabikhan, Alexandar Ichtev; Electronics; 2025; 10.3390/electronics14224508. | CICEVSE2024; CICIoV2024. | The abstract describes anomalies from malicious or corrupted clients and reports stronger resilience, but does not name the attack implementations. | Client-maliciousness detection (claimed), plus explanation. The abstract says SHAP-based feature analysis assists in recognizing anomalies arising from malicious/corrupted clients; it does not provide enough method detail to tell exactly how attribution triggers a decision or update penalty. [citation_202zqo] | Not reported in the retrieved abstract. No defense-aware adaptive-attack protocol is described. |
The Zero-Trust row is the arXiv:2512.23809 item specified in the request.
Requested XAI FL-IDS item
I could not confirm arXiv:2605.19448 in the permitted academic records: the exact ID lookup returned no citable match. Since arXiv is not among the selected sources, I cannot verify that preprint’s title, authors, venue, DOI, datasets, attacks, attribution role, or adaptive-attacker evaluation. The arXiv source was not searched; enabling the relevant source under Settings > Sources would allow that check.
A separate, indexed 2025 conference paper has a very similar title—XAI FL-IDS: A Federated Learning and SHAP-Based Explainable Framework for Distributed Intrusion Detection Systems (Mohammad Hossein Gholamrezazadeh and Ahmadreza Montazerolghaem; ICSPIS 2025; DOI 10.1109/ICSPIS68676.2025.11551742). Its abstract describes SHAP as inspecting detections for feature-level explanation, not screening, weighting, or detecting untrustworthy clients; it uses Edge-IIoTset with 10 clients and reports >99% accuracy. The abstract does not name attack scenarios or describe an adaptive attacker, so this is explanation-only and not a qualifying client-defense match. [citation_14f77b]
Scope and caveats
These are the matches supportable from the retrieved abstracts, not a claim that no other papers exist. The search selected up to 100 records per academic search, but all selected passages were abstract/excerpt-only; the optional lexical-planning lane failed while semantic retrieval continued. Client-Shapley scoring that measures client contribution (rather than feature attribution) was not counted as an attribution-based malicious-client defense.