Demonstrate an indicator-specific advantage of gradient encoding

Establish a regime in which IoC-identity encoding through the FedIoC indicator-weighted contrastive objective provably improves campaign recovery beyond contrastive up-weighting of the malicious class.

Background

FedIoC encodes locally matched Indicators of Compromise (IoCs) into client gradient updates using an indicator-weighted supervised contrastive objective. The server then clusters client updates by cosine similarity to recover attack-campaign cohorts without receiving raw indicators.

On the evaluated CTU-13 and UNSW-NB15 benchmarks, however, FedIoC was not clearly better than either plain FedAvg or a label-only supervised-contrastive control. The authors therefore identify the unresolved task of isolating experimental or theoretical conditions under which the IoC-specific information contributes a separable benefit rather than merely increasing the influence of malicious-class examples.

References

The indicator-weighted objective therefore does not yet yield a gain separable from contrastive up-weighting of the malicious class; isolating a regime in which IoC-identity encoding provably helps is the central open problem.

— Federated Attack Campaign Detection via Contrastive Encoding of Threat Indicators in Gradient Updates  (2609.04815 - Röder et al., 4 Sep 2026) in Section 6, Section 6.1, “Campaign Detection”