https://orcid.org/0009-0004-7622-5991
Figures
Abstract
The proliferation of Internet of Medical Things (IoMT) devices has created critical cybersecurity challenges demanding intrusion detection systems that achieve high accuracy across diverse attack taxonomies while preserving patient privacy across institutional boundaries. Existing federated learning (FL) approaches face an inherent tension: Transformer-based architectures achieve strong detection performance but incur quadratic computational complexity and substantial communication overhead, while lightweight classifiers sacrifice representational capacity. Moreover, most FL-based intrusion detection systems lack formal privacy guarantees and robustness against adversarial participants. This paper introduces FedMamba-IoMT, the first federated State Space Model framework for privacy-preserving intrusion detection in IoMT networks, incorporating differential privacy (DP-SGD), Byzantine-resilient aggregation, and multi-level explainability. The proposed architecture reformulates tabular network traffic features as pseudo-sequential tokens processed through stacked selective State Space Model (Mamba) blocks with gated residual connections, achieving linear computational complexity with 78% fewer parameters than Transformer alternatives. We design a novel FedMamba aggregation strategy that weights client contributions by a convex combination of dataset proportion and inverse validation loss, augmented with a cosine similarity-based Byzantine filter that detects and excludes malicious model updates. Integration of DP-SGD with Rényi differential privacy accounting provides formal privacy guarantees (
,
) while maintaining competitive accuracy. Comprehensive evaluation across three benchmark datasets—Edge-IIoTset (2,219,201 samples, 15 classes), CICIoMT2024 (3,204,537 samples, 19 classes), and Gotham Dataset 2025 (496,191 samples, 8 high-level traffic categories)—demonstrates that FedMamba-IoMT achieves
%,
%, and
% multiclass accuracy without DP, and 98.52%, 98.18%, and 97.16% at
, surpassing all prior federated IDS approaches. Byzantine resilience experiments demonstrate that the proposed defense maintains >95% accuracy under 30% malicious clients across label-flipping, model poisoning, and free-rider attacks. Gradient inversion analysis confirms that FedMamba’s compact parameterization (135K parameters, 0.52 MB) provides
higher reconstruction error compared to Transformer-based FL, and the integrated SHAP and LIME explainability framework supports regulatory compliance with the FDA’s 2023 cybersecurity guidance for medical devices.
Citation: Al-Sharo YM, Tawfik M, Almadani AM, Abdelhaliem AH, Fathi IS, Hassan G (2026) FedMamba-IoMT: Federated state space models with differential privacy and byzantine resilience for privacy-preserving intrusion detection in Internet of Medical Things. PLoS One 21(8): e0355601. https://doi.org/10.1371/journal.pone.0355601
Editor: Sohail Saif, Maulana Abul Kalam Azad University of Technology West Bengal, INDIA
Received: April 15, 2026; Accepted: July 23, 2026; Published: August 10, 2026
Copyright: © 2026 Al-Sharo et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: All datasets used in this study are publicly available. The Edge-IIoTset dataset is available on Kaggle at https://www.kaggle.com/datasets/mohamedamineferrag/edgeiiotset-cyber-security-dataset-of-iot-iiot under CC BY-NC-SA 4.0 license. The CICIoMT2024 dataset is available from the Canadian Institute for Cybersecurity at https://www.unb.ca/cic/datasets/iomt-dataset-2024.html and Cybersecurity at https://www.unb.ca/cic/datasets/iomt-dataset-2024.html and IEEE DataPort (DOI: 10.21227/tq0p-ag21). The Gotham Dataset 2025 is available on Zenodo at https://zenodo.org/records/14502760 (DOI: 10.5281/zenodo.14502760) under CC BY 4.0 license.
Funding: The author(s) received no specific funding for this work.
Competing interests: The authors have declared that no competing interests exist.
Introduction
The Internet of Medical Things (IoMT) has fundamentally transformed healthcare delivery by enabling continuous remote patient monitoring [1], real-time diagnostic analytics, and intelligent clinical decision support through networks of interconnected medical devices. A recent comprehensive survey by Ozcelik et al. [2] reported that the global IoMT market is projected to reach USD 370.9 billion, driven by the rapid adoption of wearable biosensors, implantable cardiac monitors, smart infusion pumps, and connected imaging systems that collectively generate massive volumes of sensitive patient data. However, this proliferation has created an expansive attack surface that adversaries are increasingly exploiting with devastating consequences for patient safety and institutional operations.
The healthcare sector has become one of the most targeted industries for cyberattacks. Jiang et al. [3] conducted a cross-sectional analysis of all HIPAA-covered ransomware incidents from 2010 to 2024, published in JAMA Network Open, revealing that hacking incidents rose from 4% to 81% of all healthcare data breaches over this period, with 732 million patient records compromised. The 2024 Change Healthcare attack alone affected 100 million individuals and incurred USD 2.4 billion in response costs. A systematic review by Ewoh and Vartiainen [4] identified five structural factors explaining healthcare vulnerability: human error, chronic underinvestment in cybersecurity infrastructure, the growing complexity of network-connected medical devices, dependence on legacy systems, and the pace of digitalization outstripping security measures. These converging threats have prompted regulatory action: the U.S. Food and Drug Administration (FDA) issued finalized guidance on cybersecurity in medical devices in September 2023 [5], mandating Software Bills of Materials (SBOMs), Secure Product Development Frameworks (SPDFs), and enforcing a Refuse to Accept (RTA) policy for premarket submissions of cyber-connected devices, establishing unprecedented requirements for demonstrating that security mechanisms—including machine learning-based detection systems—are transparent, interpretable, and clinically trustworthy.
Machine learning and deep learning approaches have demonstrated exceptional performance for IoT intrusion detection in centralized settings. A comprehensive survey by Liao et al. [6] reviewed deep learning architectures including CNNs, RNNs, autoencoders, and deep belief networks for IoT IDS, documenting accuracies exceeding 99% on standard benchmarks. In IoT-based healthcare specifically, hybrid schemes coupling metaheuristic feature selection with lightweight classifiers have proven highly effective; the HIIDS framework, for instance, achieved up to 99.88% attack-class accuracy on NSL-KDD using genetic-algorithm-selected features with decision trees [7]. Recent centralized approaches have continued to push this frontier: Tawfik [8] proposed an autoencoder–CatBoost feature-selection pipeline combined with a transformer–CNN–LSTM ensemble for IoT and fog-computing IDS, reporting over 99% accuracy across NSL-KDD, UNSW-NB15, and AWID. The present work builds on this trajectory but addresses the orthogonal challenge of cross-institution training: while centralized ensembles achieve high accuracy on a single training pool, regulated healthcare environments cannot legally aggregate traffic across organizational boundaries, motivating the federated formulation pursued here. This concern is not hypothetical: cross-institutional evaluations of clinical deep learning models routinely reveal substantial generalization gaps when a model trained at one site is deployed at another [9], underscoring the value of collaborative training that exposes the model to multiple institutional distributions. However, centralizing network traffic from multiple hospitals or clinics into a single training server violates regulatory frameworks including HIPAA and GDPR, which impose strict constraints on transferring identifiable health information across institutional boundaries [10]. Pati et al. [10] demonstrated that even de-identified medical data can be re-identified through linkage attacks, and that federated approaches must incorporate formal privacy guarantees to satisfy regulatory requirements across jurisdictions.
Federated learning (FL), introduced by McMahan et al. [11] through the FedAvg algorithm, addresses this privacy constraint by enabling collaborative model training across distributed institutions without sharing raw data. A systematic review by Teo et al. [12], which screened 22,693 articles and analyzed 612 FL studies in healthcare, confirmed that FL achieves comparable performance to centralized approaches while preserving data locality, though it identified communication overhead and statistical heterogeneity as persistent barriers to clinical deployment. These barriers are particularly acute in IoMT environments where medical edge gateways have limited bandwidth and where institutions exhibit highly heterogeneous device populations and attack exposure profiles. Almanifi et al. [13] systematically reviewed communication efficiency in FL for IoT, documenting that model parameter transmission dominates overhead, motivating compact architectures for federated deployment. Ye et al. [14] surveyed heterogeneous FL, establishing that non-IID data distributions cause 3–15% accuracy loss compared to IID settings.
Critically, however, vanilla federated learning without additional privacy mechanisms remains vulnerable to gradient inversion attacks. Zhu et al. [15] demonstrated Deep Leakage from Gradients (DLG), showing that shared model gradients can be exploited to reconstruct individual training samples with high fidelity. This vulnerability necessitates the integration of formal privacy guarantees such as differential privacy (DP) into FL frameworks, particularly in healthcare settings where the sensitivity of patient data demands mathematically provable protections. Furthermore, FL systems are susceptible to Byzantine adversaries—malicious participants who may submit poisoned model updates to degrade global model performance or inject backdoors [16]. Fang et al. [17] demonstrated that adaptive poisoning attacks can defeat many existing defenses. These security challenges motivate the development of FL frameworks that simultaneously address privacy, robustness, and efficiency.
The Mamba architecture, grounded in selective State Space Models (S6), has recently emerged as a compelling solution to the efficiency-accuracy tension in FL. Originally proposed by Gu and Dao [18] for language modeling (COLM 2024 Outstanding Paper), Mamba has demonstrated remarkable versatility across domains: Zhu et al. [19] introduced Vision Mamba at ICML 2024, achieving competitive performance against Vision Transformers on ImageNet classification, COCO object detection, and ADE20k semantic segmentation with faster inference, demonstrating that the selective scan mechanism generalizes effectively beyond sequential data. By replacing quadratic-complexity attention mechanisms with input-dependent state transitions and hardware-aware parallel scanning, Mamba achieves linear computational complexity
while matching or exceeding Transformer performance—with the critical advantage that Mamba models typically require
fewer parameters than equivalent Transformers, directly reducing communication overhead in federated settings. Initial applications to cybersecurity have shown promising results, including NetMamba [20] demonstrating
faster inference than Transformer-based traffic classifiers. However, no published work has combined Mamba with federated learning for intrusion detection in any domain, nor addressed the associated privacy and Byzantine resilience challenges, leaving a significant research gap.
This paper introduces FedMamba-IoMT, the first federated State Space Model framework for privacy-preserving and Byzantine-resilient intrusion detection in Internet of Medical Things networks. The principal contributions are threefold:
- We propose a novel Mamba-based IDS architecture that reformulates tabular network traffic features as pseudo-sequential tokens processed through stacked selective State Space Model blocks with gated residual connections, achieving competitive detection accuracy with approximately 135K parameters—78% fewer than comparable Transformer architectures and 57% fewer than CNN-BiLSTM alternatives. The architecture is embedded within a federated learning framework incorporating a novel FedMamba aggregation strategy that weights client contributions by a convex combination of dataset proportion and inverse validation loss, enabling privacy-preserving collaborative training across heterogeneous IoMT institutions with non-IID data distributions simulated via Dirichlet partitioning (
).
- We provide a comprehensive security framework comprising two integrated defense mechanisms: (i) differential privacy through DP-SGD with per-sample gradient clipping and calibrated Gaussian noise injection, providing formal
-differential privacy guarantees tracked via Rényi Differential Privacy accounting across T federated rounds with systematic evaluation of the privacy–utility tradeoff at
; and (ii) a cosine similarity-based Byzantine resilience mechanism that detects and filters malicious client updates, comprehensively evaluated against three attack vectors—label-flipping, model poisoning, and free-rider attacks—at 10–30% adversarial participation rates, including an honest analysis of the FedMamba aggregation’s specific vulnerability to free-rider exploitation.
- We conduct the first comprehensive evaluation on the Gotham Dataset 2025, a federated-learning-ready IoT benchmark with per-device non-IID partitions from 78 emulated devices and 18 sub-attack labels grouped into 8 high-level traffic categories, alongside CICIoMT2024 (3,204,537 samples, 19 classes) and Edge-IIoTset (2,219,201 samples, 15 classes), establishing cross-dataset baselines that surpass existing FL-IDS approaches. The Gotham evaluation uses 8 high-level traffic categories that group the dataset’s native 18 sub-attack labels (per the dataset authors’ own taxonomy). We further integrate multi-level explainability through SHAP (global feature importance) and LIME (local per-sample explanations), identifying the discriminative features driving detection decisions to support regulatory compliance with the FDA’s 2023 cybersecurity guidance on ML-enabled medical device security.
Related work
This section reviews the state-of-the-art across five interrelated research threads: (1) intrusion detection systems for IoT/IoMT networks, (2) federated learning-based IDS approaches, (3) Mamba and State Space Models for cybersecurity, (4) Kolmogorov–Arnold Networks for IDS, and (5) privacy and security in federated learning. Tables 1 and 2 summarize the reported performance of existing methods on the Edge-IIoTset and CICIoMT2024 benchmarks, respectively.
Intrusion detection in IoT and IoMT networks
Machine-learning IDS research for medical cyber-physical systems predates the current deep learning wave. Beyond conventional classifiers, hybrid metaheuristic–neuro-fuzzy detectors have targeted the routing layer of wireless body area networks: the DHOA-ANFIS model reached 97.70% accuracy against wormhole, blackhole, Byzantine, and scheduling attacks with a 0.90% false alarm rate [21], demonstrating that medical sensor networks demand detection models tailored to their specialized telemetry. The present work focuses on the network-traffic level of IoT/IoMT infrastructures, where large public benchmarks enable systematic comparison.
The Edge-IIoTset dataset has become one of the most widely cited IoT/IIoT intrusion detection benchmarks since its release in 2022, with over 20 papers reporting evaluation results. The original paper by Ferrag et al. [22] established baselines where a DNN achieved 96.01% multiclass accuracy and Random Forest reached 99% F1-score, alongside FL-DNN baselines at approximately 98.60%. Subsequent centralized approaches have progressively improved: Sufyan et al. [23] combined PCA and PCC with multi-dimensional CNNs achieving 99.41% accuracy; Elshewey [24] employed CNN-DNN with SMOTE reporting 99.80%; and Alshehri et al. [25] proposed SA-DCNN achieving 99.95%. However, all these centralized approaches require aggregating institutional data at a single server, which is infeasible in privacy-regulated healthcare environments.
On CICIoMT2024, created by Dadkhah et al. [26] at the Canadian Institute for Cybersecurity, the full 19-class multiclass task proved notably challenging, with the original DNN baseline achieving only 73.3%. Alalhareth and Hong [27] proposed a deep stacked ensemble with BAT augmentation achieving near-perfect accuracy on a reduced taxonomy. Shaikh et al. [28] introduced HCLR-IDS integrating CNN-LSTM with deep reinforcement learning, reaching 99.58% binary but only 77.73% multiclass. Alabbadi and Bajaber [29] proposed X-FuseRLSTM achieving 97.66% with both SHAP and LIME explainability. Abid et al. [30] combined grey wolf optimization with CNN-enhanced LightGBM achieving 99.50%. Mohammad and Abdulrahman [31] reported 98.40% with a GRU-DNN hybrid.
The Gotham Dataset 2025, introduced by Belarbi et al. [32] at Cardiff University and Toshiba Europe, provides 496,191 balanced samples from 78 emulated IoT devices with 18 native traffic classes that the dataset authors group into 8 high-level traffic categories (benign plus seven attack behaviors). This dataset uniquely preserves per-device non-IID traffic distributions, making it the first benchmark explicitly designed for federated learning IDS research. To our knowledge, no published work has reported experimental IDS evaluation results on this dataset prior to the present study, presenting a significant benchmarking opportunity.
Federated learning for IoT/IoMT intrusion detection
Singh et al. [33] proposed HFL-HLSTM, a hierarchical FL framework with differential privacy for IoMT IDS, achieving 99.31% on NSL-KDD with -differential privacy guarantees—one of the earliest FL-IDS papers targeting the medical IoT domain. Begum et al. [34] combined FL with blockchain-based integrity verification using Hyperledger Fabric, reaching 97.43% on Edge-IIoTset. On CICIoMT2024, Misbah et al. [35] deployed FL with Random Forest achieving 99.22% and 99.09% F1. Our previously published FedMedSecure [36] introduced a federated few-shot learning framework with CrossTransformer, FEAT, RelationNetwork, and MAML, achieving 99.80% accuracy with differential privacy (
) and 75% communication reduction. Torre et al. [37] implemented FL-1D-CNN with both DP and homomorphic encryption achieving 97.31% but with F1 dropping to 92.69%. Alshammari et al. [38] combined FL with SMOTE and DP (
) achieving 94.60%. Rehman et al. [39] proposed FFL-IDS, a fog-enabled FL-based IDS countering jamming and spoofing attacks in IIoT environments, reaching 93.40% on Edge-IIoTset.
A consistent pattern emerges: FL-based approaches incur a 1–6% accuracy penalty compared to centralized counterparts, with the gap widening under stronger privacy guarantees and more severe non-IID distributions. This motivates architectures that are inherently communication-efficient and robust to data heterogeneity—properties that State Space Models naturally provide through their compact parameterization.
Mamba and State Space Models for cybersecurity
The Mamba architecture [18], based on selective State Space Models (S6), has demonstrated linear complexity for sequence modeling. Chen et al. [40] introduced IDS-GraphMamba integrating Markov-chain graph aggregation with Mamba for IoMT edge networks, achieving 99.70% on WUSTL-EHMS-2020 in a purely centralized setting. Wang et al. [20] proposed NetMamba for traffic classification with faster inference than Transformer alternatives at IEEE ICNP 2024. Outside cybersecurity, hybrid CNN–Transformer detectors have shown that pairing local convolutional feature extraction with global context modeling yields favorable accuracy–efficiency trade-offs in real-time recognition tasks [41]—a combination that Mamba realizes at linear cost through its depthwise convolution followed by selective state propagation. However, no published work has combined Mamba with federated learning for intrusion detection in any domain, leaving an open gap that FedMamba-IoMT directly addresses.
Kolmogorov–Arnold Networks for intrusion detection
KAN architectures have gained traction for IDS due to their parameter efficiency and interpretability. Most critically, Fahim-Ul-Islam et al. [42] proposed FedIoMT, combining FL with KAN and meta-learning for IoMT IDS in IEEE Transactions on Consumer Electronics—the closest existing work to FedMamba-IoMT in concept, employing KAN rather than Mamba within a federated framework.
Privacy and security in federated learning
Privacy and robustness in FL have been extensively studied as foundational concerns. Zhu et al. [15] demonstrated Deep Leakage from Gradients (DLG), showing that shared gradients can reconstruct training samples with high fidelity. Abadi et al. [43] introduced DP-SGD, integrating differential privacy into stochastic gradient descent through per-sample gradient clipping and calibrated noise injection, establishing the standard mechanism for private deep learning. Mironov [44] proposed Rényi Differential Privacy (RDP), enabling tighter composition bounds for iterative mechanisms—particularly advantageous for tracking cumulative privacy loss across FL rounds. Bonawitz et al. [45] developed practical Secure Aggregation protocols enabling servers to compute aggregated updates without observing individual contributions. For Byzantine resilience, Blanchard et al. [16] proposed Krum and Multi-Krum aggregation rules selecting updates closest to the geometric median. Yin et al. [46] demonstrated that coordinate-wise median and trimmed mean aggregation achieve optimal statistical rates under Byzantine adversaries. Fang et al. [17] showed that adaptive poisoning attacks can defeat many existing defenses, motivating multi-layered protection strategies. These works collectively establish the theoretical foundations upon which FedMamba-IoMT builds its security architecture.
Research gaps
The comprehensive analysis reveals five research gaps addressed by FedMamba-IoMT. First, no published work combines Mamba/SSM architectures with federated learning for intrusion detection. Second, Mamba’s communication efficiency advantage ( fewer parameters than Transformers) remains unexploited in FL settings. Third, the Gotham Dataset 2025 lacks any experimental IDS baselines. Fourth, existing FL-IDS approaches for IoMT either lack formal privacy guarantees or sacrifice significant accuracy when incorporating them. Fifth, no FL-IDS framework has systematically evaluated Byzantine resilience under multiple attack vectors with formal analysis of the aggregation mechanism’s vulnerability surface.
Materials and methods
This section presents the FedMamba-IoMT framework. We first describe the benchmark datasets, then formalize the threat model and security goals, detail the optimization objective, present the Mamba-based IDS architecture including the selective state space mechanism, describe the federated learning protocol with differential privacy and Byzantine resilience, and finally present the explainability integration. The end-to-end framework architecture is illustrated in Fig 1.
The framework consists of three integrated components: (top-left) the overall federated learning workflow showing K local IoMT clients communicating with a global server through the novel FedMamba performance-aware aggregation scheme with Byzantine filtering; (top-right) the FedMamba weighting equation combining dataset proportion and inverse validation loss with DP-SGD integration; (bottom) the detailed client-side Mamba model architecture showing the data preprocessing and feature embedding pipeline, stacked FedMamba blocks (L = 4) with the S6 selective scan core including input-dependent state matrices , B, C, and discretization step
, the three-layer classification head, and the integrated SHAP/LIME explainability framework supporting FDA regulatory compliance.
Benchmark datasets
Three complementary datasets are employed for comprehensive evaluation, collectively spanning diverse IoT/IoMT ecosystems, attack taxonomies, and protocol stacks (Table 3).
Edge-IIoTset. Introduced by Ferrag et al. [22], this dataset comprises 2,219,201 network traffic samples from over 10 IoT/IIoT sensor types (temperature/humidity, ultrasonic, water level, pH, soil moisture, heart rate, flame, infrared, sound, and Modbus sensors) organized across a seven-layer testbed architecture. After preprocessing, the dataset yields 95 features and 15 classes consisting of 14 attack types spanning five threat categories—DoS/DDoS, information gathering, man-in-the-middle, injection, and malware—plus normal traffic. The dataset exhibits significant class imbalance, with Normal traffic constituting 72.8% while Fingerprinting and MITM contain only 801 and 971 samples.
CICIoMT2024. Created by Dadkhah et al. [26] at the Canadian Institute for Cybersecurity, this dataset provides 3,204,537 labeled instances from 40 IoMT devices (25 real healthcare devices including baby monitors, heart rate sensors, sleep rings, and blood pressure monitors, plus 15 simulated devices) operating across Wi-Fi, MQTT, and Bluetooth Low Energy protocols. The dataset encompasses 19 classes: 18 attack types organized into five categories (DDoS, DoS, reconnaissance, MQTT-specific, and spoofing) plus benign traffic, characterized by 46 features.
Gotham Dataset 2025. Published by Belarbi et al. [32] at Cardiff University and Toshiba Europe, this dataset contains 496,191 balanced samples from 78 emulated IoT devices operating on MQTT, CoAP, and RTSP protocols. It includes 18 native sub-labels which the dataset authors group into 8 high-level traffic categories: Benign plus seven attack behaviors (CoAP Amplification Attack, DoS Attack, Ingress Tool Transfer, Network Scanning, Periodic C&C Communication, Reporting, Telnet Brute Forcing). We evaluate at the 8-category level to match the operational granularity used by IoMT security operations and to avoid data-sparsity issues in long-tail sub-variants (several Mirai sub-classes contain fewer than 50 test samples). Each sample contains 23 packet-level features (27 after encoding). Critically, this dataset preserves per-device non-IID traffic distributions, making it the first benchmark explicitly designed for federated learning IDS research.
Threat model and security goals
We define a comprehensive threat model addressing three classes of adversaries in the FedMamba-IoMT federation (Fig 2):
Three adversary types are considered: an honest-but-curious server, malicious clients performing label-flipping, model poisoning, or free-rider attacks, and an external eavesdropper mounting gradient inversion attacks. Three defense layers are deployed: DP-SGD at the client level, cosine similarity-based Byzantine filtering at the server, and Secure Aggregation for communication confidentiality.
Adversary 1: Honest-but-curious server. The aggregation server faithfully executes the FedMamba protocol but may attempt to infer sensitive information about individual client datasets from the received model updates . Specifically, the server may mount gradient inversion attacks [15] to reconstruct training samples from the communicated model parameters.
Adversary 2: Malicious clients (Byzantine adversaries). A fraction f < 0.5 of participating clients may deviate from the prescribed training protocol. We consider three concrete attack strategies: (i) Label-flipping attack—adversarial clients randomly permute their training labels to inject noise into local model updates; (ii) Model poisoning attack—adversarial clients scale their model updates by a large factor or inject adversarial perturbations designed to degrade global accuracy; (iii) Free-rider attack—adversarial clients send random or minimally trained parameters while reporting artificially low training losses to exploit the performance-aware FedMamba aggregation (Eq (8)).
Adversary 3: External eavesdropper. A network-level adversary intercepts communication between clients and the server, attempting to extract sensitive information from transmitted model updates.
Security goals. The FedMamba-IoMT framework addresses these threats through a layered defense architecture: (1) Privacy preservation: DP-SGD with per-sample gradient clipping and calibrated Gaussian noise provides -differential privacy guarantees, bounding the information any adversary can extract about individual training samples; (2) Byzantine resilience: A cosine similarity-based filter detects and excludes anomalous model updates before aggregation, including those exploiting the inverse-loss weighting; (3) Communication confidentiality: Secure Aggregation [45] prevents the server from observing individual model updates.
Problem formulation
Consider a healthcare network comprising K institutions (hospitals, clinics, or IoMT gateway clusters), where each institution maintains a local dataset
. Each sample consists of a feature vector
and a label
. The total number of samples is
. The local data distributions
are generally non-identical across institutions. The objective is to collaboratively learn a global model
minimizing the weighted empirical risk:
where and
denotes the weighted cross-entropy loss with inverse-frequency class weights
.
Mamba-based IDS architecture
The proposed FedMamba-IDS model consists of three stages: a feature tokenization layer, a stack of L Mamba blocks, and a classification head.
Feature tokenization.
Raw network traffic features are partitioned into
non-overlapping chunks of size p (with the final chunk zero-padded if d is not divisible by p). Each chunk is projected into a D-dimensional token embedding via a learned linear transformation:
where and
. A learnable positional encoding
is added element-wise. This tokenization strategy is critical for adapting Mamba to tabular feature vectors: by treating feature subsets as ordered tokens, the model captures inter-feature dependencies through state space dynamics, analogous to how language models capture inter-token dependencies.
Selective State Space Model (S6) block.
Each Mamba block transforms its input sequence
through a six-step pipeline implementing the selective scan mechanism.
Step 1: Input projection and gating. The layer-normalized input is projected into two parallel branches of expanded dimension , where
is the expansion factor:
where is the main processing path and
serves as the multiplicative gating signal.
Step 2: Local convolution. A depthwise causal 1D convolution with kernel size captures local patterns:
where denotes the SiLU (Swish) activation function
.
Step 3: Selective scan parameters. Input-dependent SSM matrices ,
, and discretization step
are projected from the convolved input, making them input-dependent (selective). The state matrix
is parameterized in log-space as
for numerical stability with HiPPO initialization.
Step 4: Discretization. Continuous-time parameters are discretized via zero-order hold: and
.
Step 5: Selective scan (S6 core). The central recurrence propagates a hidden state through the token sequence:
where is a learnable skip connection. The selectivity arises because
and
depend on the input, enabling adaptive information retention with linear complexity
per layer versus
for self-attention.
Step 6: Gated output and residual connection.
Classification head.
After L blocks, global average pooling followed by a three-layer head with LayerNorm, GELU, and dropout (p = 0.2) produces predictions. Table 4 summarizes hyperparameters.
Federated learning protocol
The FedMamba-IoMT framework trains the global model across K institutions through iterative communication rounds. The complete protocol including DP-SGD and Byzantine filtering is formalized in Algorithm 1.
Non-IID data partitioning.
Training data is partitioned using a Dirichlet distribution: for each class c, proportions with
, reflecting realistic healthcare scenarios where institutions serve different patient populations.
Local training with DP-SGD.
Each round t, a subset of
clients is selected (
). Each client receives global parameters and performs E local epochs of AdamW optimization with DP-SGD (detailed below).
FedMamba aggregation with Byzantine filtering.
We introduce a performance-aware aggregation augmented with Byzantine filtering. After the cosine similarity filter removes anomalous updates producing a filtered set , the aggregation weights for remaining clients are:
where balances data volume and model quality, and
prevents division by zero. The rationale is twofold: clients with lower losses have learned more accurate representations and should contribute more, and in IoMT environments with noisy or outlier-contaminated data, inverse-loss weighting naturally down-weights unreliable contributions. FedAvg and FedProx (
) serve as baselines.
Differential privacy integration
To provide formal privacy guarantees against gradient inversion attacks, we integrate DP-SGD [43] into local client training. For each mini-batch , per-sample gradients are computed and clipped to maximum
-norm C:
where . Clipped gradients are aggregated and perturbed with calibrated Gaussian noise:
where controls the privacy–utility tradeoff. We employ Rényi Differential Privacy (RDP) [44] to track cumulative privacy loss across
iterations, then convert to
-DP with
. We set C = 1.0 and calibrate
for target budgets
.
Byzantine resilience mechanism
To defend against malicious participants, we propose a cosine similarity-based filter applied before FedMamba aggregation. At each round t, the server computes model update directions and estimates the median direction via coordinate-wise median. Client k is accepted if:
where . This mechanism specifically addresses the vulnerability of inverse-loss weighting to free-rider attacks: without filtering, adversaries could submit random parameters with fake low losses to gain disproportionate aggregation weight. The cosine similarity filter detects such updates because random perturbations diverge from the median honest update direction.
Secure aggregation
To defend against the honest-but-curious server, Secure Aggregation (SecAgg) [45] can be integrated. Each client pair negotiates shared random masks via Shamir’s secret sharing (threshold ). Masks cancel during aggregation so the server sees only the aggregate. FedMamba’s compact 0.52 MB model makes SecAgg practical: 1.2 seconds/round versus 5.8 seconds for Transformer-based models with 620K parameters.
Algorithm 1. FedMamba-IoMT: Federated Training with DP and Byzantine Resilience.
Require: K clients, rounds T, epochs E, fraction , rate
, clip norm C, noise
, threshold
Ensure: Trained global model , privacy budget
1: Initialize with Xavier uniform; initialize RDP accountant
2: for t = 0 to do
3: random subset of
clients
4: Broadcast to all
5: for each client in parallel do
6: ; compute class weights
7: for e = 1 to E do
8: for each mini-batch do
9: Compute per-sample gradients for all
10: Clip:
11:
12:
13: end for
14: end for
15: Send to server
16: end for
17: Byzantine Filtering:
18: for all
19:
20:
21: Compute via Eq (8) for
22:
23: Update RDP accountant
24: end for
25: Convert RDP to -DP
26: return ,
Complexity analysis
For sequence length S, model dimension D, and state dimension , the Mamba selective scan requires
FLOPs per sample versus
for Transformers. With
, Mamba is strictly more efficient for S > 16. Per-round FL communication cost is
where b = 4 bytes (FP32). With
K and
selected clients, FedMamba transmits 6.2 MB/round versus 28.3 MB for Transformer-based FL—a 78% reduction. DP-SGD overhead scales as
per mini-batch, adding 16–32% training time.
Explainability framework
Global explainability uses KernelSHAP to compute Shapley values for each feature j, quantifying average marginal contributions. Local explainability uses LIME to fit interpretable surrogate models
near individual predictions:
, where
is a proximity kernel and
penalizes complexity.
Data preprocessing and implementation details
Non-numeric columns (IPs, timestamps, payloads) are removed. Missing values and infinite entries are replaced with zero. Features are standardized using training-partition statistics only. Targeted SMOTE with oversamples classes below 500 samples after federated partitioning to prevent cross-client data leakage. All experiments use Google Colab Pro+ with NVIDIA A100 GPU (40 GB), PyTorch 2.1, T = 50 rounds, E = 5 epochs, K = 10 clients,
,
with ReduceLROnPlateau (factor 0.5, patience 3), batch size 1024, and early stopping (patience 10). Data is split 80/20 with stratification. All experiments are repeated ten times with the canonical seed sequence {42, 123, 456, 789, 1024, 2048, 4096, 8192, 16384, 31415}; mean
standard deviation (Bessel-corrected) and Student’s t-distribution 95% confidence intervals are reported. Pairwise comparisons against FedAvg and FedProx baselines use two-sided paired t-tests and Wilcoxon signed-rank tests with Holm–Bonferroni correction at
across the family of six comparisons. Cohen’s dpaired is reported as effect size. For ease of reference and reproducibility, Table 5 consolidates every hyperparameter used across all components of the FedMamba-IoMT framework—model architecture, federated protocol, local optimization, differential privacy, Byzantine defense, and data preprocessing—together with its value.
Results
Overall classification performance
Table 6 presents the overall performance of FedMamba-IoMT with FedMamba aggregation (without DP, serving as the accuracy ceiling). The framework achieves % on Edge-IIoTset (15-class),
% on CICIoMT2024 (19-class), and
% on Gotham 2025 (8 high-level traffic categories grouping the dataset’s native 18 sub-labels). The increase from three to ten independent runs reduces standard deviations by approximately
and yields tight 95% confidence intervals (Table 7): [99.44, 99.50], [99.49, 99.55], and [98.87, 98.93] respectively. Weighted F1-scores closely mirror accuracy. Macro F1-scores remain above 95% across all datasets despite significant class imbalance (Fig 3). FedMamba beats both FedAvg and FedProx on every single seed for every dataset (60/60 paired wins; paired t-test p < 10-14, Wilcoxon
; all Holm–Bonferroni corrected; Table 9), with Cohen’s
indicating very large effect sizes.
All metrics exceed 97% across datasets. Weighted F1 closely tracks accuracy, while macro F1 is slightly lower reflecting the inherent difficulty of minority-class detection under class imbalance.
Fig 4 illustrates the federated learning convergence. Training loss decreases monotonically and converges within 25–30 rounds, while client accuracy plateaus above 99% by round 35. Gotham 2025 converges fastest due to smaller per-client volume, while CICIoMT2024 requires slightly more rounds owing to its 19-class taxonomy.
A: Average client training loss per communication round. B: Average client accuracy per round. Convergence is achieved within 25–30 rounds for all datasets.
Fig 5 presents normalized confusion matrices. On Edge-IIoTset, the model achieves perfect classification for Normal, DDoS_ICMP, DDoS_UDP, and MITM, with minor confusion for Fingerprinting (F1 = 0.89). On CICIoMT2024, confusion occurs only between semantically similar MQTT sub-attacks (brute force vs. connect flood). On Gotham 2025 (8 high-level categories), per-class F1 ranges from 1.000 (CoAP Amplification Attack, Reporting) and 0.994 (DoS Attack) down to 0.929 (Ingress Tool Transfer) and 0.813 (Telnet Brute Forcing), with TelnetBF being the dominant macro-F1 limiter due to its 68.7% precision arising from confusion with NetScan and ITT.
A: Edge-IIoTset (15 classes). B: CICIoMT2024 (19 classes). C: Gotham Dataset 2025 (8 high-level traffic categories). Strong diagonal dominance is observed across all datasets, with the main confusion on Gotham occurring between Telnet Brute Forcing and Network Scanning / Ingress Tool Transfer.
Comparison with state-of-the-art
FedMamba-IoMT achieves 99.47% on Edge-IIoTset in a federated setting, surpassing all prior FL methods by substantial margins: FFL-IDS (93.40%), BFLIDS (97.43%), and the original FL-DNN baseline (98.60%). The result approaches the best centralized methods (SA-DCNN: 99.95%, Elshewey CNN-DNN: 99.80%) while maintaining privacy preservation. On CICIoMT2024, FedMamba-IoMT achieves 99.52% on the challenging 19-class task, outperforming all FL approaches except FedMedSecure [36] (99.80%). However, FedMedSecure employs a four-model ensemble requiring
3.15 MB, whereas FedMamba uses a single architecture at 0.52 MB—a
reduction. For the Gotham Dataset 2025, FedMamba-IoMT establishes a federated IDS baseline at 98.90% accuracy across the 8 high-level traffic categories (Fig 6). We also benchmark against FedIoMT [42], the closest existing federated IoMT-IDS work (KAN + meta-learning), on CICIoMT2024 under our identical FL protocol: FedIoMT achieves 99.19
0.07% accuracy versus FedMamba’s 99.52
0.04%, a + 0.33 percentage-point margin (paired t(9) = 39.4,
, Cohen’s d = 12.5). FedIoMT’s KAN backbone uses 218K parameters versus FedMamba’s 135K, and its meta-learning inner loop adds
18% wall-clock overhead per round. We note that our FedIoMT reimplementation may differ from the original authors’ configuration in minor details that we could not verify.
A: Edge-IIoTset. B: CICIoMT2024. Blue bars indicate centralized methods, gold bars indicate federated methods, and red bar indicates FedMamba-IoMT (proposed).
Federated aggregation ablation study
Table 8 presents the ablation comparing FedAvg, FedProx, and FedMamba aggregation. FedMamba consistently outperforms both baselines across all three datasets and metrics, with pairwise differences significant at p < 10-14 after Holm–Bonferroni correction (Table 9). The largest improvements appear on CICIoMT2024: + 0.61% accuracy over FedAvg (99.52% vs 98.91%) and +0.31% over FedProx. The macro F1-score improvement is even more pronounced— + 1.37% over FedAvg on CICIoMT2024 (97.89% vs 96.52%)—indicating that the performance-aware weighting particularly benefits minority attack classes disproportionately affected by non-IID partitioning. FedMamba achieves this with only 3–4% time overhead versus FedAvg (Fig 7). Sensitivity to the mixing coefficient (Eq 8) is reported in Table 10: accuracy is concave with maximum at
and stays within 0.10% of the optimum for
, confirming the chosen value is robust.
Comparison of FedAvg, FedProx, and FedMamba (proposed) across accuracy, weighted F1, and macro F1 for all three datasets.
Comparison with parameter-matched Transformer baseline
To rigorously substantiate the efficiency advantage of FedMamba over Transformer architectures, we evaluate FT-Transformer [47]—the most widely cited published Transformer architecture for tabular data—as a parameter-matched federated baseline under our identical FL protocol. FT-Transformer is configured following the original authors’ recommendations: dtoken = 192, nblocks = 3, nheads = 8, ffnhidden = 192 with GEGLU, residual dropout 0, attention dropout 0.2, embedding tokenizer applied to the same 27-feature input as FedMamba. FT-Transformer’s set-to-set attention is order-equivariant, providing the parameter-matched permutation-invariant point of comparison and isolating the contribution of FedMamba’s sequential state-space processing.
Table 11 reports the comparison across all three datasets. FedMamba beats FT-Transformer on every seed (paired t-test for all three datasets), with margins of +0.26%, + 0.24%, and +0.28% on Edge-IIoTset, CICIoMT2024, and Gotham respectively. FedMamba simultaneously achieves
fewer parameters,
smaller model size,
lower inference latency, and
lower per-round communication—confirming that FedMamba’s accuracy advantage is attributable to the sequential state-space processing, not to model capacity. As a second baseline, a parameter-matched 3-layer MLP (hidden dim 256, ReLU, dropout 0.2,
135K parameters) yields 98.61%, 98.74%, and 97.92% on Edge-IIoTset, CICIoMT2024, and Gotham—strictly below both FT-Transformer and FedMamba on every dataset.
Privacy–utility analysis
Table 12 presents the systematic evaluation of FedMamba-IoMT under varying differential privacy budgets. We report results across and note that there is no consensus standard for an acceptable
in healthcare ML (the recent literature spans
; see NIST SP 800−226 draft, 2024). At
(
), the framework achieves 98.52%, 98.18%, and 97.16% accuracy on Edge-IIoTset, CICIoMT2024, and Gotham 2025—representing a modest 0.95–1.74% reduction from the non-DP baseline. The corresponding DP-SGD noise multiplier
is reported per (dataset,
) pair in Table 13, along with the Poisson sampling ratio q = B/N needed for independent verification via RDP composition. Even at the strongest privacy level (
), accuracy remains above 95.3% across all datasets—a level of utility retained under a substantially stronger privacy budget than that of Torre et al., whose DP + HE approach reported 97.31% under weaker privacy protection. The accuracy degradation follows a characteristic concave curve (Fig 8): the steepest drop occurs between
and
, with diminishing returns for weaker privacy. The macro F1-score exhibits a sharper decline at lower
, reflecting greater sensitivity of minority attack classes to gradient noise. DP-SGD training time overhead ranges from 16% (
) to 32% (
).
A: Accuracy vs. privacy budget () with error bars (
1 std). B: Macro F1-score vs.
. The dashed line at
indicates the recommended operating point balancing privacy and utility.
Gradient inversion attack resistance
We evaluate empirical resistance to gradient inversion using the public reference implementation of the Deep Leakage from Gradients (DLG) attack [15], configured with 300 LBFGS iterations and cosine-similarity dummy-gradient loss. Two metrics quantify reconstruction quality: Mean Squared Error (MSE) between original and reconstructed feature vectors (higher = more private) and cosine similarity (lower = more private). We emphasize that these metrics are empirical proxies, not formal upper bounds; resistance is demonstrated against one specific attack family and may differ under R-GAP, GradInversion, or IG-style attacks. The formal privacy guarantee is provided by DP-SGD with Rényi accounting (Table 13); the gradient-inversion analysis below is a complementary empirical evaluation.
Fig 9 presents results across architectures at varying privacy levels. Without DP, FedMamba provides approximately higher reconstruction error than the FT-Transformer baseline (MSE: 0.171 vs. 0.082) and lower cosine similarity to true inputs (0.43 vs. 0.71). This inherent advantage arises because FedMamba’s compact 135K parameters encode less information per gradient update compared to the Transformer’s 620K parameters, fundamentally limiting information available for reconstruction. With DP-SGD at
, reconstruction MSE increases to 0.851 for FedMamba (vs. 0.742 for Transformer), and cosine similarity drops to 0.108 (vs. 0.189), rendering gradient inversion practically infeasible. At
, all architectures achieve MSE > 0.92 and cosine similarity < 0.07.
A: Reconstruction MSE (higher = more private). B: Cosine similarity (lower = more private). FedMamba’s compact 135K parameterization provides inherent privacy advantages over larger architectures, with the gap increasing under stronger DP.
Byzantine resilience evaluation
We evaluate FedMamba-IoMT’s robustness against three Byzantine attack strategies at 10%, 20%, and 30% adversarial participation rates, comparing four configurations: FedAvg, FedProx, FedMamba (without defense), and FedMamba with cosine similarity defense.
Label-flipping attack. Fig 10 shows that FedMamba without defense maintains higher accuracy than FedAvg and FedProx under label-flipping (e.g., 93.86% vs. 91.45% vs. 92.78% at 20% malicious on Edge-IIoTset), as inverse-loss weighting naturally downweights clients with noisy labels. With the Byzantine filter, accuracy is maintained at 97.62% at 20% and 95.18% at 30% adversarial participation.
FedMamba + Defense maintains >95% accuracy even at 30% malicious clients.
Model poisoning attack. Fig 11 presents results under scaled gradient attacks—the most severe threat. FedAvg drops to 78.62% at 30% malicious on Edge-IIoTset. FedMamba with defense maintains 93.75% under identical conditions, a 15.13 percentage point improvement over undefended FedAvg.
The most severe attack. FedMamba + Defense maintains 93.75% at 30% malicious vs. FedAvg at 78.62% on Edge-IIoTset.
Free-rider attack. Fig 12 reveals a critical finding: FedMamba without the Byzantine filter is more vulnerable to free-rider attacks than FedAvg (92.15% vs. 94.85% at 20% malicious on Edge-IIoTset). This occurs because adversarial clients exploit the inverse-loss weighting by reporting artificially low loss values, gaining disproportionate aggregation weight despite submitting random parameters. This vulnerability directly motivates the cosine similarity filter: FedMamba with defense achieves 97.51% under the same conditions, as the filter detects divergent update directions regardless of reported loss values.
FedMamba without defense is more vulnerable than FedAvg due to inverse-loss weighting exploitation. The cosine similarity filter recovers robustness, demonstrating the necessity of the proposed defense.
Fig 13 summarizes all Byzantine results as a heatmap for Edge-IIoTset, demonstrating that FedMamba + Defense consistently achieves the highest accuracy across all attack types and severity levels. Sensitivity to the cosine-similarity threshold is analyzed in Table 14:
is the concave optimum at
Dirichlet non-IID (98.72% accuracy with FRR = 7.2%, TRR = 97.3%); under more extreme non-IID (
), the optimum shifts slightly toward
, motivating an adaptive-
extension as future work. Without Byzantine clients, the filter at
induces FRR
% on honest clients, confirming it does not measurably hurt clean training.
Color intensity indicates accuracy. FedMamba + Defense maintains >93% across all attack types including 30% malicious clients.
Model efficiency and Secure Aggregation overhead
Table 15 compares FedMamba against representative architectures. The Mamba model achieves competitive accuracy with only 135K parameters—78% fewer than FT-Transformer [47] (a published parameter-matched tabular Transformer baseline, evaluated in this revision under our identical FL protocol; see Table 11) and 57% fewer than CNN-BiLSTM. The 0.52 MB model translates to 6.2 MB per-round communication (bidirectional exchange with the
clients selected per round), compared to 28.3 MB for FT-Transformer and 37.8 MB for FedMedSecure. Single-sample inference averages 1.23 ms on NVIDIA A100 (server-class GPU). We note that this server-class latency does not transfer directly to ARM-based IoMT edge gateways; edge-hardware deployment validation is a separate engineering effort beyond the scope of this algorithmic contribution and is discussed in the Limitations subsection.
FedMamba’s compact size also makes SecAgg particularly practical (Fig 14). SecAgg computation requires only 1.2 seconds per round for FedMamba versus 5.8 seconds for Transformer-based models, and communication with SecAgg remains at 15.6 MB versus 70.8 MB for Transformer—demonstrating that formal communication confidentiality is feasible without prohibitive overhead.
A: Communication cost with and without SecAgg. B: SecAgg computation time per round. FedMamba achieves the lowest overhead among deep learning architectures due to its compact 0.52 MB model size.
Non-IID sensitivity and scalability
FedMamba-IoMT demonstrates remarkable robustness to data heterogeneity: accuracy decreases by only 2.65% on Edge-IIoTset from near-IID (: 99.78%) to extreme non-IID (
: 96.82%). Similar patterns hold for CICIoMT2024 (3.52% drop) and Gotham 2025 (3.60% drop). This degradation is substantially smaller than typically reported for FL-CNN approaches (5–10% under comparable conditions), suggesting that Mamba’s sequential state propagation provides inherent robustness to distribution shift. Performance scales gracefully from K = 3 to K = 20 clients, with accuracy decreasing from 99.71% to 99.18% on Edge-IIoTset.
Feature ordering ablation
To validate the Mamba tokenization strategy for tabular data, we compare five feature ordering schemes: random, original (default), correlation-sorted, PCA-sorted, and mutual information-sorted (Fig 15). Mutual information sorting provides a modest but consistent improvement of approximately 0.3–0.4% over random ordering across all datasets, while the default ordering achieves intermediate performance. This confirms that Mamba’s sequential processing captures meaningful inter-feature dependencies when related features are grouped within tokens, though the modest effect indicates Mamba also functions effectively as a general-purpose feature mixer regardless of ordering.
Five ordering strategies compared across all three datasets. Mutual information sorting provides 0.3% improvement over random ordering, confirming that Mamba captures inter-feature dependencies.
Explainability analysis
Global explainability (SHAP).
Fig 16 presents the SHAP feature importance analysis. The top five discriminative features are tcp.flags (mean ), frame.len (0.128), ip.proto (0.115), tcp.len (0.098), and ip.ttl (0.091). These align with domain knowledge: TCP flag patterns (SYN floods, ACK scans) are primary DDoS/reconnaissance indicators, while abnormal frame lengths signal payload-based injection attacks. For CICIoMT2024, MQTT-specific features (mqtt.msgtype, mqtt.len) rank among the top 10. On Gotham 2025, tcp.flags.syn emerges as the most important for distinguishing Mirai scanning from benign traffic.
Top 20 features ranked by mean absolute SHAP value. TCP flag patterns and frame length dominate detection decisions, confirming alignment with network security domain knowledge.
Local explainability (LIME).
Fig 17 presents LIME explanations for three representative samples. In all cases, the model relies on security-relevant features: tcp.flags and frame.len dominate DDoS detection; tcp.flags.syn dominates Mirai detection (consistent with SYN-heavy propagation); and mqtt.msgtype dominates MQTT attacks (protocol-specific semantics). These explanations confirm that FedMamba-IoMT makes decisions based on genuine attack signatures rather than spurious correlations, supporting FDA regulatory trust requirements.
A: DDoS_UDP detection on Edge-IIoTset (99.7% confidence). B: Mirai TCP Flooding on Gotham 2025 (99.9%). C: MQTT Brute Force on CICIoMT2024 (98.3%). Green bars indicate features supporting the prediction.
Privacy–utility–efficiency Pareto tradeoff
Fig 18 presents the signature Pareto analysis combining privacy (), utility (accuracy), and efficiency (communication cost). FedMamba-IoMT dominates the left region of the tradeoff space, achieving the lowest communication cost while maintaining competitive accuracy at all privacy levels. At
, FedMamba achieves 98.52% accuracy with only 6.2 MB/round—compared to 97.82% at 28.3 MB/round for FT-Transformer [47] and 97.31% at 22.4 MB/round for Torre et al.’s DP + HE approach. This establishes FedMamba as the Pareto-optimal choice for privacy-constrained, bandwidth-limited IoMT deployments.
FedMamba dominates the low-communication, high-accuracy region across all privacy levels. Bubble size indicates privacy strength (larger = stronger privacy / lower ).
Discussion
The experimental evaluation yields several significant findings with implications for the design and deployment of privacy-preserving IDS in healthcare IoT networks.
State Space Models as efficient FL backbones. FedMamba-IoMT demonstrates that Mamba architectures match or exceed Transformer and LSTM detection accuracy for network IDS while requiring 78% fewer parameters. The complexity of Mamba’s selective scan translates directly to reduced per-round communication in federated settings—a critical advantage for bandwidth-constrained IoMT edge environments where medical devices share limited network infrastructure with clinical applications. This efficiency does not come at the expense of representational power: FedMamba achieves 99.47–99.52% accuracy across Edge-IIoTset and CICIoMT2024, surpassing all prior FL-based approaches and approaching the ceiling established by centralized methods.
Formal privacy with acceptable utility cost. The integration of DP-SGD with Rényi privacy accounting demonstrates that formal -differential privacy is achievable in federated IDS with moderate accuracy costs. At
(selected as the median of our reported sweep; no consensus standard exists for healthcare ML), accuracy degrades by only 0.95–1.74% from the non-DP baseline. This compares favorably with Torre et al. [37], who reported a 2.0% accuracy drop with combined DP and homomorphic encryption at a comparable privacy level. Furthermore, FedMamba’s compact parameterization provides an empirical privacy advantage under the DLG attack family: reconstruction MSE is approximately
higher against FedMamba than against FT-Transformer, consistent with the intuition that fewer parameters limit per-gradient information content. We caution that this is an empirical observation against one attack family rather than a formal guarantee; the formal privacy bound is provided by DP-SGD with Rényi accounting.
Byzantine resilience with honest vulnerability analysis. The Byzantine evaluation reveals a nuanced finding: the FedMamba aggregation’s inverse-loss weighting provides natural resilience against label-flipping and model poisoning (outperforming FedAvg by 2–5%), but introduces a specific vulnerability to free-rider attacks where adversaries report fake low losses. This honest analysis of the aggregation mechanism’s attack surface, paired with the cosine similarity defense that recovers accuracy to >95% at 30% adversarial participation, is essential for deployment in adversarial healthcare environments where some participating institutions may be compromised.
Comparison with FedMedSecure. A direct comparison with our previously published FedMedSecure [36] reveals complementary strengths. FedMedSecure achieves higher raw accuracy (99.80%) through its four-model ensemble, but FedMamba-IoMT offers smaller model size (0.52 MB vs. 3.15 MB), 83% lower communication cost, formal DP guarantees, Byzantine resilience evaluation, and faster inference (1.23 ms vs. 4.8 ms). These trade-offs position FedMamba-IoMT as preferable for bandwidth-limited, security-critical deployments, while FedMedSecure remains advantageous when maximum accuracy is paramount.
Relationship to prior centralized IDS work. Our earlier centralized ensemble framework [8], which combined stacked autoencoders, CatBoost feature selection, and a transformer–CNN–LSTM ensemble for IoT and fog-computing IDS, established that ensemble-based detection can exceed 99% accuracy on NSL-KDD, UNSW-NB15, and AWID under centralized training. FedMamba-IoMT inherits the multi-architecture intuition—combining attention-like selectivity with recurrence—but distills it into a single linear-complexity SSM backbone suitable for the federated, differentially-private, Byzantine-resilient setting required for medical-IoT deployment, where centralized training is not viable for regulatory and operational reasons. The progression from centralized ensemble [8] to federated SSM (this work) reflects a deliberate response to the practical constraints of cross-institutional healthcare cybersecurity.
Regulatory alignment. The SHAP and LIME analyses confirm that detection decisions are based on security-relevant features (TCP flags, frame length, protocol-specific features) rather than spurious correlations, supporting the FDA’s 2023 cybersecurity guidance [5] requirements for transparency in ML-enabled medical device security. The formal differential privacy guarantees further strengthen regulatory compliance by providing mathematically provable protections for patient data.
Limitations and future work. Several limitations should be acknowledged. First, while DP-SGD provides formal guarantees, the current implementation does not explore gradient compression or quantization that could further reduce communication while maintaining DP. Second, the cosine similarity filter uses a fixed threshold (Table 14); an adaptive thresholding extension driven by historical update statistics is a natural future direction. Third, evaluation uses testbed-generated datasets and the inference latency is measured on server-class GPU (NVIDIA A100); end-to-end deployment validation on representative edge hardware (ARM-based IoMT gateways, embedded SoMs, dedicated medical-device processors) and validation on production hospital network traffic constitute a separate deployment study beyond the scope of an algorithmic contribution. Fourth, the gradient-inversion experiments use the DLG attack family; resistance against more recent attacks (R-GAP, GradInversion, IG) has not been empirically established and is reserved for future work. Fifth, investigating hybrid Mamba-attention architectures and evaluating adversarial robustness against evasion attacks targeting the sequential processing mechanism represent promising future directions. Finally, emerging computational paradigms—such as noise-aware quantum kernel methods that have recently demonstrated competitive regression performance under simulator-based NISQ constraints [48]—may offer longer-term complementary substrates for resource-constrained security analytics.
Conclusion
This paper presented FedMamba-IoMT, the first federated State Space Model framework for privacy-preserving intrusion detection in Internet of Medical Things networks, with formal differential privacy guarantees and Byzantine resilience. By leveraging Mamba’s selective scan mechanism with linear complexity , the framework simultaneously achieves high multiclass accuracy (
without DP;
at
), privacy preservation through DP-SGD with Rényi accounting, communication efficiency (0.52 MB, 78% smaller than Transformer alternatives), and robustness against Byzantine adversaries (>95% under 30% malicious clients with the proposed cosine similarity defense).
The proposed FedMamba aggregation with Byzantine filtering consistently outperforms FedAvg (+0.61% accuracy, + 1.37% macro F1 on CICIoMT2024) and FedProx baselines, with improvements most pronounced for minority attack classes under non-IID conditions. The honest analysis of FedMamba’s vulnerability to free-rider attacks and the effective defense mechanism demonstrate the maturity of the security evaluation. Gradient inversion analysis confirms that compact parameterization provides inherent privacy advantages, achieving higher reconstruction error than Transformer architectures even without differential privacy. On the Gotham Dataset 2025, we establish a federated IDS baseline at 98.90% accuracy across 8 high-level traffic categories with naturally non-IID per-device distributions. The integrated SHAP and LIME framework supports FDA 2023 regulatory compliance. FedMamba-IoMT advances the state-of-the-art by establishing that State Space Models provide a compelling foundation for efficient, private, Byzantine-resilient, and interpretable intrusion detection in healthcare IoT networks.
References
- 1.
Al-Zidi NM, Tawfik M, Al-Hejri AM, Fathail I, Aldhaheri TA, Al-Tashi Q. Smart system for real-time remote patient monitoring based on Internet of Things. In: 2021 2nd International Conference on Computational Methods in Science & Technology (ICCMST). 2021. p. 1–6. https://doi.org/10.1109/iccmst54943.2021.00013
- 2. Ozcelik MM, Kok I, Ozdemir S. A survey on Internet of Medical Things (IoMT): enabling technologies, security and explainability issues, challenges, and future directions. Expert Systems. 2025;42(5).
- 3. Jiang JX, Ross JS, Bai G. Ransomware attacks and data breaches in US Health Care Systems. JAMA Netw Open. 2025;8(5):e2510180. pmid:40366661
- 4. Ewoh P, Vartiainen T. Vulnerability to cyberattacks and sociotechnical solutions for health care systems: systematic review. J Med Internet Res. 2024;26:e46904. pmid:38820579
- 5.
U S Food and Drug Administration. Cybersecurity in medical devices: Quality system considerations and content of premarket submissions. FR 66458. 2023.
- 6. Liao H, Murah MZ, Hasan MK, Aman AHM, Fang J, Hu X, et al. A survey of deep learning technologies for intrusion detection in Internet of Things. IEEE Access. 2024;12:4745–61.
- 7.
Saif S, Das P, Biswas S, Khari M, Shanmuganathan V. HIIDS: Hybrid intelligent intrusion detection system empowered with machine learning and metaheuristic algorithms for application in IoT based healthcare. Microprocessors and Microsystems. 2022;104622. https://doi.org/10.1016/j.micpro.2022.104622
- 8. Tawfik M. Optimized intrusion detection in IoT and fog computing using ensemble learning and advanced feature selection. PLoS One. 2024;19(8):e0304082. pmid:39088558
- 9. Tawfik M, Fathi IS, Nimbhore SS, Alsmadi IM, Sawah MS. E-RespiNet: An LLM-ELECTRA driven triple-stream CNN with feature fusion for asthma classification. PLoS One. 2025;20(11):e0334528. pmid:41187139
- 10. Pati S, Kumar S, Varma A, Edwards B, Lu C, Qu L, et al. Privacy preservation for federated learning in health care. Patterns (N Y). 2024;5(7):100974. pmid:39081567
- 11.
McMahan HB, Moore E, Ramage D, Hampson S, Agüera y Arcas B. Communication-efficient learning of deep networks from decentralized data. In: Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS). PMLR; 2017. p. 1273–82.
- 12. Teo ZL, Jin L, Li S, Miao D, Zhang X, Ng WY, et al. Federated machine learning in healthcare: a systematic review on clinical applications and technical architecture. Cell Rep Med. 2024;5(2):101419. pmid:38340728
- 13. Almanifi ORA, Chow C-O, Tham M-L, Chuah JH, Kanesan J. Communication and computation efficiency in federated learning: a survey. Internet of Things. 2023;22:100742.
- 14. Ye M, Fang X, Du B, Yuen PC, Tao D. Heterogeneous federated learning: state-of-the-art and research challenges. ACM Comput Surv. 2023;56(3):1–44.
- 15.
Zhu L, Liu Z, Han S. Deep leakage from gradients. In: Proceedings of the 33rd Conference on Neural Information Processing Systems (NeurIPS). 2019. p. 14774–84.
- 16.
Blanchard P, El Mhamdi EM, Guerraoui R, Stainer J. Machine learning with adversaries: byzantine tolerant gradient descent. In: Proceedings of the 30th Conference on Neural Information Processing Systems (NeurIPS). 2017. p. 119–29.
- 17.
Fang M, Cao X, Jia J, Gong N. Local model poisoning attacks to Byzantine-robust federated learning. In: Proceedings of the 29th USENIX Security Symposium. 2020. p. 1605–22.
- 18.
Gu A, Dao T. Mamba: linear-time sequence modeling with selective state spaces. In: Proceedings of the 1st Conference on Language Modeling (COLM). 2024.
- 19.
Zhu L, Liao B, Zhang Q, Wang X, Liu W, Wang X. Vision Mamba: efficient visual representation learning with bidirectional state space model. In: Proceedings of the 41st International Conference on Machine Learning (ICML). 2024. p. 62429–42.
- 20.
Wang T, Xie X, Wang W, Wang C, Zhao Y, Cui Y. Netmamba: efficient network traffic classification via pre-training unidirectional mamba. In: 2024 IEEE 32nd International Conference on Network Protocols (ICNP). 2024. p. 1–11. https://doi.org/10.1109/icnp61940.2024.10858569
- 21. Saif S, Das P, Biswas S. DHOA-ANFIS: a hybrid technique to detect routing attacks in wireless body area network. Wireless Pers Commun. 2023;133(1):453–80.
- 22. Ferrag MA, Friha O, Hamouda D, Maglaras L, Janicke H. Edge-IIoTset: a new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning. IEEE Access. 2022;10:40281–306.
- 23. Sufyan A, Khan FA, Hamza YA, Chelloug SA. Enhancing IoT intrusion detection using dimensionality reduction and deep learning. Information Security Journal: A Global Perspective. 2024;33(4):401–20.
- 24. Elshewey AM. An enhanced approach for edge-based intrusion detection based on a hybrid deep learning model CNN-DNN. SN Comput Sci. 2026;7(3).
- 25. Alshehri MS, Saidani O, Alrayes FS, Abbasi SF, Ahmad J. A self-attention-based deep convolutional neural networks for IIoT networks intrusion detection. IEEE Access. 2024;12:45762–72.
- 26. Dadkhah S, Neto ECP, Ferreira R, Molokwu RC, Sadeghi S, Ghorbani AA. CICIoMT2024: a benchmark dataset for multi-protocol security assessment in IoMT. Internet of Things. 2024;28:101351.
- 27. Naeem H, Alsirhani A, Alserhani FM, Ullah F, Krejcar O. Augmenting Internet of Medical Things security: deep ensemble integration and methodological fusion. CMES. 2024;141(3):2185–223.
- 28. Shaikh JA, Wang C, Sima MWU, Arshad M, Owais M, Hassan DSM, et al. A deep reinforcement learning-based robust intrusion detection system for securing IoMT Healthcare Networks. Front Med (Lausanne). 2025;12:1524286. pmid:40309737
- 29. Alabbadi A, Bajaber F. X-FuseRLSTM: a cross-domain explainable intrusion detection framework in iot using the attention-guided dual-path feature fusion and residual LSTM. Sensors (Basel). 2025;25(12):3693. pmid:40573580
- 30. Abid T, Ahmim A, Maazouzi F, Chefrour D, Ullah I, Ahmim M, et al. A novel IoT threat detection using GWO feature selection and CNN-enhanced LightGBM. J Cloud Comp. 2025;14(1).
- 31. Mohammad AE, Abdulrahman AA. An intrusion detection for Internet of Medical Things based on deep learning techniques. IHJPAS. 2026;39(1):317–32.
- 32.
Belarbi O, Spyridopoulos T, Anthi E, Rana O, Carnelli P, Khan A. Gotham Dataset 2025: a reproducible large-scale IoT network dataset for intrusion detection and security research. 2025. https://arxiv.org/abs/2502.03134
- 33. Singh P, Gaba GS, Kaur A, Hedabou M, Gurtov A. Dew-cloud-based hierarchical federated learning for intrusion detection in IoMT. IEEE J Biomed Health Inform. 2023;27(2):722–31. pmid:35816521
- 34. Begum K, Mozumder MAI, Joo M-I, Kim H-C. BFLIDS: blockchain-driven federated learning for intrusion detection in IoMT networks. Sensors (Basel). 2024;24(14):4591. pmid:39065989
- 35. Misbah A, Sebbar A, Hafidi I. Securing Internet of Medical Things: an advanced federated learning approach. ijacsa. 2025;16(2).
- 36. Tawfik M, Abu-Ein AA, Noaman HM, Abdelhaliem AH, Fathi IS. FedMedSecure: federated few-shot learning with cross-attention mechanisms and explainable AI for collaborative healthcare cybersecurity. Sci Rep. 2025;15(1):40050. pmid:41238815
- 37. Torre D, Chennamaneni A, Jo J, Vyas G, Sabrsula B. Toward enhancing privacy preservation of a federated learning cnn intrusion detection system in IoT: method and empirical study. ACM Trans Softw Eng Methodol. 2025;34(2):1–48.
- 38. Alsolami T, Ilyas M. FedSMOTE-DP: privacy-aware federated ensemble learning for intrusion detection in IoMT networks. Sensors (Basel). 2026;26(5):1592. pmid:41829552
- 39. Rehman T, Tariq N, Khan FA, Rehman SU. FFL-IDS: a fog-enabled federated learning-based intrusion detection system to counter jamming and spoofing attacks for the Industrial Internet of Things. Sensors (Basel). 2024;25(1):10. pmid:39796800
- 40. Ben Atitallah S, Driss M, Boulila W. IDS–GraphMamba: a Markov-enhanced graph Mamba framework for real-time intrusion detection in IoMT edge networks. Computer Networks. 2026;275:111933.
- 41.
Onteddu AR, Reddy Bandhela R, Reddy Kundavaram R, Jagannaveen V. A CNN-transformer hybrid for precise object detection in UAV aerial imagery. In: 2025 IEEE 3rd Global Conference on Wireless Computing and Networking (GCWCN). 2025. p. 1–7. https://doi.org/10.1109/gcwcn66157.2025.11448412
- 42. Fahim-Ul-Islam Md, Chakrabarty A, Alam MdGR, Maidin SSB. A resource-efficient federated learning framework for intrusion detection in IoMT networks. IEEE Trans Consumer Electron. 2025;71(2):4508–21.
- 43.
Abadi M, Chu A, Goodfellow I, McMahan HB, Mironov I, Talwar K, et al. Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 2016. p. 308–18. https://doi.org/10.1145/2976749.2978318
- 44.
Mironov I. Rényi differential privacy. In: 2017 IEEE 30th Computer Security Foundations Symposium (CSF). 2017. p. 263–75. https://doi.org/10.1109/csf.2017.11
- 45.
Bonawitz K, Ivanov V, Kreuter B, Marcedone A, McMahan HB, Patel S, et al. Practical secure aggregation for privacy-preserving machine learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017. p. 1175–91. https://doi.org/10.1145/3133956.3133982
- 46.
Yin D, Chen Y, Kannan R, Bartlett P. Byzantine-robust distributed learning: towards optimal statistical rates. In: Proceedings of the 35th International Conference on Machine Learning (ICML). 2018. p. 5650–9.
- 47.
Gorishniy Y, Rubachev I, Khrulkov V, Babenko A. Revisiting deep learning models for tabular data. In: Advances in Neural Information Processing Systems. 2021.
- 48. Kundavaram RR, Bandhela RR, Onteddu AR. Noise-aware quantum support vector regression under simulator-based NISQ approximation. IEEE Access. 2026;14:56889–99.