Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure

What it is

PA-FL (Physics-Attested Federated Learning), proposed by Nijsse et al. (RMIT/AUT), targets a specific gap: seven named Byzantine-robust aggregation rules — FedAvg, Krum, Multi-Krum, coordinate-wise median, trimmed mean, norm clipping, FLTrust, and FoolsGold — all operate only on submitted update vectors, never on the training data behind them.

How it works

Process invariants (e.g., Δlevel = inflow − outflow) are mined automatically from clean operational data before training. Each client must prove in zero-knowledge (zk-SNARK, using Groth16-style proofs with Poseidon hashing) that its local training batch satisfies these invariants before its update is admitted — a batch that violates physics simply cannot produce a valid proof, so that client sits out the round. The server verifies a proof rather than seeing raw telemetry.

Preconditions / Affected

Applies to federated intrusion-detection training on industrial telemetry where invariants are affine (reducible to bounded range checks) and instrumented — coverage is explicitly bounded by sensor placement. Cho et al.'s prior SWaT audit (cited by the authors) found mined invariants catch only 13–16 of 36 physical attacks; this paper's own mined set catches 12/35 with five invariants, rising to 20/35 with nine invariants, as a point of comparison for what the gate alone can see.

What to do / Key results

• Four of the seven aggregation rules admitted physics-violating fabricated updates at 73–100% rates — including an optimized perturbation that FoolsGold admitted in full (its temporal-collinearity check never inspects data validity).
• The invariant gate rejected 0/100 honest shards and 100% of fabricated ones across SWaT, WADI, and BATADAL.
• Against an adaptive adversary who projects corrupted batches back onto the invariants, the gate still recovered 69–100% of targeted-detection recall lost to replay poisoning and 54–100% lost to fabrication, across five aggregators.
• zk-SNARK proofs were benchmarked at 806B per proof with a 32B batch-hash commitment, intended to fit within practical FL round timeouts.

flowchart LR
    A[Client trains on local batch] --> B{Batch satisfies invariants?}
    B -- No / no proof --> C[Excluded before aggregation]
    B -- Yes, zk-proof verifies --> D[Update admitted]
    D --> E[Aggregation rule: FedAvg/Krum/FLTrust/etc]
    E --> F[Shared detector broadcast]

Caveats

The authors state detection coverage is capped by instrumentation: the gate "can neutralise only those poisoning attempts whose underlying telemetry contradicts instrumented physical laws" — attacks on unmetered stages or within normal noise bypass it entirely. End-to-end training itself is not proven in ZK (only batch compliance over sampled rows) because full backpropagation proof is computationally prohibitive. This is a feasibility demonstration (PA-FLLite), not a production deployment.