Feature Suppression and Differential Privacy for Residential Traffic Classification: A Two-Home Federated Study
Márton Pál Lipcsey-Magyar, Adrian Pekar
cs.LG · cs.NI
Quick verdict
Two-home FL study: feature suppression beats one untuned DP-SGD config on macro-F1/worst-group F1 in all seeds; candid scoping, narrow evidence.
Summary
The paper compares privacy-aware training options for residential traffic classification in a simulated two-client federated learning setup built from 1.62 million gateway-collected flows (two OpenWrt homes, six categories, 84% of 1.93M captured records retained). Against a full-feature FedAvg baseline, the authors evaluate feature suppression (FS-mild, dropping four packet inter-arrival-time features from 16 inputs), fixed-setting DP-SGD (ε=8, clip norm 1.0, Opacus/RDP accounting, record-level adjacency), an aggressive suppression variant, and a FedDPA personalization adaptation, across five seeds, two MLP capacities, and stratified plus temporal splits. With size-proportional aggregation, FS-mild beats the tested DP-SGD configuration on combined macro-F1 and worst-group F1 in every seed at both capacities (small model: .619 vs .503 combined; worst-group .071 vs .004); DP-SGD's losses concentrate in Home B's minority classes (Media .021, SocialNetwork .007). Loss- and shadow-model membership inference yields near-chance AUC (.500–.503) for all configurations. Main limitations: only two homes with non-overlapping capture windows, a single untuned DP configuration, unverified DPI-derived labels, possible session leakage in stratified splits, and no random-feature-removal control.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- With size-proportional aggregation, FS-mild (12 of 16 features) beats the tested DP-SGD configuration (ε=8, C=1.0) on combined macro-F1 and worst-group F1 in all five seeds at both capacities under stratified and temporal splits (small model: .619 vs .503 combined macro-F1).
- DP-SGD's utility cost is class-dependent: Home B's minority categories collapse (Media F1 .021, SocialNetwork .007 on the small model) while Network and Web remain above .93.
- Loss-based and shadow-model membership inference yield near-chance aggregate AUC (.500–.503) for all configurations including the non-private baseline, which the authors state does not establish privacy equivalence.
- Feature suppression is an input-minimization baseline without formal privacy guarantees, and it does not uniformly improve on the full-feature baseline (worst-group F1 .071 vs .077 for baseline FL).
- DP-SGD costs roughly 3.4× more per training round than FS-mild in isolated single-thread CPU simulation (184.7 s vs 54.7 s median round time, Table VI).
Strengths
Real gateway data with quantified natural non-IID structure
Table I quantifies real deployment heterogeneity (System/Media shares differ 6.4×/8.1×; 61.7/38.3 aggregation weights), giving the non-IID analysis genuine ecological validity rather than a synthetic partition.
Unusually honest claim scoping throughout
FS is repeatedly labeled input-minimization without formal guarantees (abstract, §III-B, §VI), MIA near-chance is explicitly 'not privacy equivalence', and Table VIII bounds every recommendation — a model of claim discipline.
Robustness across seeds, capacities, and splits
High reproducibility readiness
Weaknesses
n=2 clients with non-overlapping capture windows
Single untuned DP configuration carries the headline
DPI-derived labels never validated as ground truth
Weak MIA design and no feature-removal control
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper asks a deliberately narrow question: in a simulated two-client FedAvg federation over gateway-collected residential flows, what utility cost does a fixed DP-SGD configuration impose relative to feature suppression? Three primary configurations (full-feature baseline; FS-mild = 12 of 16 inputs after dropping the four packet inter-arrival-time features; DP-SGD at ε=8 with clip norm 1.0) are compared across five seeds, two MLP capacities ([16,16] with 646 parameters; [128,64] with 10,822), and stratified plus temporal 80/20 splits, with secondary analyses of FS-aggressive (8 features), equal-weight aggregation, a FedDPA adaptation, and runtime. The stated contribution is measurement and design guidance, not a new algorithm. Claims are scoped with unusual discipline: the abstract and Sections III–VI repeatedly state that FS provides no formal privacy guarantee, that the DP configuration is untuned, and that near-chance membership-inference results do not establish privacy equivalence. As scoped, the claims are supported by the reported experiments.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Does feature suppression provide differential privacy in federated learning?
No. FS-mild removes four packet inter-arrival-time features from the model's 16 inputs, but the authors state explicitly that it provides no formal privacy guarantee: the features may still be collected by the gateway meter, and nothing bounds what the trained model reveals about any individual training record. It is an input-minimization baseline, not a privacy mechanism.
Why does DP-SGD hurt minority traffic classes more than majority ones?
DP-SGD clips each per-example gradient and adds Gaussian noise, so underrepresented classes suffer a worse signal-to-noise ratio. In this study (ε=8, clip norm 1.0, two-home non-IID federation), Home B's small Media and SocialNetwork classes collapsed to F1 of .021 and .007 on the small model, while the dominant Network and Web classes stayed above .93.
Do the membership inference results show the models are private?
No. Loss-based and shadow-model attacks achieved AUCs of .500–.503 — essentially chance — for every configuration, including the non-private baseline. The authors stress this shows the tested probes had little discrimination power (the models are tiny MLPs on aggregate flow statistics), not that the models leak nothing, and not that feature suppression matches DP's formal guarantee.
What data does the study use and can it be reproduced?
1.62 million bidirectional flow records captured on two residential OpenWrt gateways (nDPI 5.0 labels), six traffic categories, roughly 11.5–11.9 days per home in Feb–Mar 2026. The authors release an artifact (github.com/FlowFrontiers/residential-fl-study) with datasets, pipeline code, per-round logs, checkpoints and seeds; all training is CPU-scale simulation, so replication is feasible on commodity hardware.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure 1 (convergence curves) cannot be assessed beyond its caption from the extracted text.
- The artifact repository (ref [15], FlowFrontiers/residential-fl-study) is referenced but its contents were not independently verified for this review.
- Per-home and medium-model MIA tables are deferred to the artifact; only small-model aggregates (Table VII) appear in the text.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.