A Novel FedLLM Intrusion Detection Frameworkfor Privacy-Preserving Security in IoT EnabledSmart City Network

A Novel FedLLM Intrusion Detection Frameworkfor Privacy-Preserving Security in IoT EnabledSmart City Network | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article A Novel FedLLM Intrusion Detection Frameworkfor Privacy-Preserving Security in IoT EnabledSmart City Network Shakila Basheer Basheer, Ghadah Aldehim Aldehim, Ala Saleh Alluhaidan Alluhaidan, and 1 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7738954/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 11 You are reading this latest preprint version Abstract The proliferation of Internet of Things (IoT) devices in Smart City infrastructureshas introduced unprecedented opportunities for automation, healthcare,and transportation, while simultaneously exposing the ecosystem to complex andmulti-dimensional cyberattacks. Conventional intrusion detection systems (IDS)either lack semantic reasoning, ignore topological dependencies, or fail to preservedata privacy across heterogeneous networks. To address these challenges, we proposea novel FedLLM-based hybrid IDS framework that integrates large languagemodel (LLM)-driven semantic encoding, feature-based traffic representation, andgraph neural network (GNN) embeddings to capture diverse attack patterns. Theproposed architecture leverages a lightweight Transformer-based fusion detectorfor resource-efficient anomaly detection, while employing federated learningwith differential privacy to enable secure collaborative training without rawdata exchange. Experimental evaluation on benchmark IoT datasets, includingCIC-IDS2017, demonstrates that the framework achieves superior accuracy(98.5%), macro F1-score (97.0%), and AUROC (99.9%) compared to state-ofthe-art baselines. Furthermore, the model exhibits lightweight capacity with only0.61 MB size and 158k parameters, enabling deployment on edge devices withminimal latency. By providing human-interpretable alerts through LLM explanations,the framework ensures both operational reliability and transparency inSmart City environments. The proposed framework establishes state-of-the-art1 performance, combining privacy preservation, high accuracy, and scalability forintrusion detection in IoT-based Smart City environments. Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Editorial decision: Revision requested 30 Dec, 2025 Reviews received at journal 31 Oct, 2025 Reviews received at journal 30 Oct, 2025 Reviewers agreed at journal 23 Oct, 2025 Reviews received at journal 22 Oct, 2025 Reviewers agreed at journal 21 Oct, 2025 Reviewers agreed at journal 21 Oct, 2025 Reviewers invited by journal 21 Oct, 2025 Editor assigned by journal 06 Oct, 2025 Submission checks completed at journal 03 Oct, 2025 First submitted to journal 29 Sep, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7738954","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":537276309,"identity":"297e46f5-309e-435d-aacf-9471aebaacb0","order_by":0,"name":"Shakila Basheer Basheer","email":"","orcid":"","institution":"","correspondingAuthor":false,"prefix":"","firstName":"Shakila","middleName":"Basheer","lastName":"Basheer","suffix":""},{"id":537276312,"identity":"2e14ebc0-90a4-4707-8912-6c21014e513d","order_by":1,"name":"Ghadah Aldehim Aldehim","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA5klEQVRIiWNgGAWjYHACxgM8DEDE3gDhNRCjB6KF5wCJWhgYJBKI1CIf3fzgwJuKOzK6M98ee8zDYCO74QD7ww/4tBjeOWZwcM6ZZzxmt/PSjXkY0ow3HOAxlsCrZUaCwWHetsNALTlm0jwMhxOBWhgIaEn/cJj3H1DLzTMgLf+BWtgf/8DrF4kcoC0NQC03eEBaDgC1MJjhtcVAIqfg4JxjQC1n8tIk5xgkG88Esi3w2jIjfeODNzWH7c2Onz0m8abCTrbvePvjG3htOQBn8oC4QMyMTz3IlgYULaNgFIyCUTAKsAAAvKpQ3tdY/HYAAAAASUVORK5CYII=","orcid":"","institution":"","correspondingAuthor":true,"prefix":"","firstName":"Ghadah","middleName":"Aldehim","lastName":"Aldehim","suffix":""},{"id":537276315,"identity":"bd300b99-1d9e-4ca7-8068-130b79367218","order_by":2,"name":"Ala Saleh Alluhaidan Alluhaidan","email":"","orcid":"","institution":"","correspondingAuthor":false,"prefix":"","firstName":"Ala","middleName":"Saleh Alluhaidan","lastName":"Alluhaidan","suffix":""},{"id":537276317,"identity":"9f43c06c-19cf-4032-8852-81af3aa6484a","order_by":3,"name":"Sapiah Sakri sakri","email":"","orcid":"","institution":"","correspondingAuthor":false,"prefix":"","firstName":"Sapiah","middleName":"Sakri","lastName":"sakri","suffix":""}],"badges":[],"createdAt":"2025-09-29 07:08:20","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7738954/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7738954/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":94820288,"identity":"c6e716ba-1c49-42a3-b296-91e65cf5e108","added_by":"auto","created_at":"2025-10-31 05:54:04","extension":"zip","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":7263126,"visible":true,"origin":"","legend":"","description":"","filename":"WINEArticle2025.zip","url":"https://assets-eu.researchsquare.com/files/rs-7738954/v1/cdf2a81d3ef117d71575067c.zip"},{"id":94820287,"identity":"ca495180-ddfc-4137-befb-9ef93daeab8a","added_by":"auto","created_at":"2025-10-31 05:54:04","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":3600874,"visible":true,"origin":"","legend":"","description":"","filename":"WINEArticle2025.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7738954/v1/3ba20087932a5766c8d1cd9f.pdf"},{"id":94820286,"identity":"3b9e79ea-ea59-4435-8c2f-cd1f2dcd1a7d","added_by":"auto","created_at":"2025-10-31 05:54:03","extension":"json","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6175,"visible":true,"origin":"","legend":"","description":"","filename":"664206690643406c9b49fe6ebef346a4.json","url":"https://assets-eu.researchsquare.com/files/rs-7738954/v1/a9f7241812e0ba4782369f60.json"},{"id":94826420,"identity":"e25dffa1-bfec-4c2f-bdd1-a100dd0e12da","added_by":"auto","created_at":"2025-10-31 06:51:42","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":2762599,"visible":true,"origin":"","legend":"","description":"","filename":"WINEArticle2025.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7738954/v1_covered_fe5a9697-37f3-4fca-9ec8-71e0816a3c9d.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"A Novel FedLLM Intrusion Detection Frameworkfor Privacy-Preserving Security in IoT EnabledSmart City Network","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"wireless-networks","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"wine","sideBox":"Learn more about [Wireless Networks](http://link.springer.com/journal/11276)","snPcode":"11276","submissionUrl":"https://submission.nature.com/new-submission/11276/3","title":"Wireless Networks","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-7738954/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7738954/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"The proliferation of Internet of Things (IoT) devices in Smart City infrastructureshas introduced unprecedented opportunities for automation, healthcare,and transportation, while simultaneously exposing the ecosystem to complex andmulti-dimensional cyberattacks. Conventional intrusion detection systems (IDS)either lack semantic reasoning, ignore topological dependencies, or fail to preservedata privacy across heterogeneous networks. To address these challenges, we proposea novel FedLLM-based hybrid IDS framework that integrates large languagemodel (LLM)-driven semantic encoding, feature-based traffic representation, andgraph neural network (GNN) embeddings to capture diverse attack patterns. Theproposed architecture leverages a lightweight Transformer-based fusion detectorfor resource-efficient anomaly detection, while employing federated learningwith differential privacy to enable secure collaborative training without rawdata exchange. Experimental evaluation on benchmark IoT datasets, includingCIC-IDS2017, demonstrates that the framework achieves superior accuracy(98.5%), macro F1-score (97.0%), and AUROC (99.9%) compared to state-ofthe-art baselines. Furthermore, the model exhibits lightweight capacity with only0.61 MB size and 158k parameters, enabling deployment on edge devices withminimal latency. By providing human-interpretable alerts through LLM explanations,the framework ensures both operational reliability and transparency inSmart City environments. The proposed framework establishes state-of-the-art1 performance, combining privacy preservation, high accuracy, and scalability forintrusion detection in IoT-based Smart City environments.","manuscriptTitle":"A Novel FedLLM Intrusion Detection Frameworkfor Privacy-Preserving Security in IoT EnabledSmart City Network","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-10-31 05:53:59","doi":"10.21203/rs.3.rs-7738954/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2025-12-30T10:41:47+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-10-31T16:45:46+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-10-30T06:08:54+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"244559586846540811449234147855571354770","date":"2025-10-23T06:14:06+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-10-22T10:35:31+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"306937543445204354969397223406638209464","date":"2025-10-21T12:29:04+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"220141676658892865678426611942267720932","date":"2025-10-21T09:35:49+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-10-21T04:59:17+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-10-06T13:03:28+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-10-03T14:54:17+00:00","index":"","fulltext":""},{"type":"submitted","content":"Wireless Networks","date":"2025-09-29T06:58:06+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"wireless-networks","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"wine","sideBox":"Learn more about [Wireless Networks](http://link.springer.com/journal/11276)","snPcode":"11276","submissionUrl":"https://submission.nature.com/new-submission/11276/3","title":"Wireless Networks","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"23338c26-733e-47ec-811e-366b7922fc9a","owner":[],"postedDate":"October 31st, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-03-30T08:53:16+00:00","versionOfRecord":[],"versionCreatedAt":"2025-10-31 05:53:59","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7738954","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7738954","identity":"rs-7738954","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}