X-GATE: Attribution-Aware Distillation and Hardening for Compressed Edge-IIoT Intrusion Detection

Abstract

Industrial Internet of Things (IIoT) intrusion detection requires compact, latency-efficient models whose behavior remains assessable under adversarial stress, yet compression can alter the feature-attribution structure learned by a full-precision model. This paper presents X-GATE (eXplanation-Guided Adversarial Training Engine), an attribution-aware training framework for compressed Edge-IIoT intrusion detection. X-GATE combines Explanation-Consistency Distillation (ECD), which aligns Teacher–Student feature-attribution rankings with a differentiable soft-rank Spearman penalty, and Explanation-Guided Adversarial Training (EGAT), which hardens the Student on Teacher-salient feature coordinates. On the full Edge-IIoTset 2022 benchmark, the latest three-seed ablation gives Full X-GATE 89.30 ± 3.89% F1-Macro with 0.617 M parameters, within approximately 0.6 percentage points of the full-precision Teacher; a Random Forest model remains a stronger clean-F1 reference, so X-GATE is not framed as the clean-accuracy optimum. In a separate deployment-subset rerun, X-GATE obtains 78.83 ± 5.83% float F1-Macro and 79.11 ± 5.47% INT8 F1-Macro, reduces the adversarial false-positive rate from 0.46 ± 0.08% for KD-only to 0.16 ± 0.09% under the evaluated single-step white-box explanation-evasion protocol, and reduces CPU latency from 4.16 to 1.25 ms/sample. Component ablation further shows that ECD reduces Logical Drift by 17.24%, while EGAT improves adversarial F1 by 10.57 percentage points. Taken together, these benchmark- and protocol-bounded results position X-GATE as a compact neural operating point for the Edge-IIoT setting studied here, balancing attribution consistency, targeted hardening, and CPU-side efficiency.

1. Introduction

The rapid expansion of the Internet of Things (IoT) has enlarged the attack surface and increased the exposure of critical infrastructure to cyberthreats. Industrial IoT (IIoT) environments, in particular, require high-performance Intrusion Detection Systems (IDSs) that can identify subtle anomalies in real-time network traffic. Over the past five years, deep learning (DL) models—especially Transformer-based architectures such as SecurityBERT—have improved IDS performance by modeling sequential data and capturing complex spatiotemporal dependencies [1,2].

Direct deployment of these large models on resource-constrained edge devices remains computationally difficult. Furthermore, distributed architectures such as hierarchical, group-based blockchain frameworks have been proposed to eliminate single points of failure and improve scalability in IoT authentication [3], motivating our decentralized edge-deployment design choices. To reduce this burden, edge intelligence commonly relies on model compression, especially 8-bit post-training quantization and knowledge distillation (KD) [4,5]. Although these techniques accelerate inference, they can also introduce what we term the Quantization–Attribution Conflict. When continuous 32-bit floating-point weights are mapped to discrete 8-bit integers, the model’s internal representations can shift nonlinearly. As a result, the quantized “Student” may preserve output behavior while drifting away from the feature-attribution structure of the original “Teacher” model.

At the same time, edge-deployed IDSs must also contend with adversarial perturbations crafted to evade detection [6,7]. The standard defense mechanism, adversarial training (AT), hardens models by injecting adversarial examples during training. In its common form, AT relies largely on generic gradient-based procedures such as Projected Gradient Descent (PGD) and Fast Gradient Sign Method (FGSM) [8,9]. In compressed edge settings, this strategy can remain insufficient because it treats all features uniformly and does not account for attributional importance, leaving the model exposed to “explanation-evasion” attacks that target the features most influential under the model’s own attribution map.

Recent work has begun to explore explainable AI (XAI) within both distillation and adversarial hardening pipelines [10,11]. Lightweight explainable IDS work such as LENS-XAI also combines compact modeling with attribution-oriented transparency [12], and recent general machine learning work has begun to study Explanation-Guided Adversarial Training outside the compressed Edge-IIoT setting [13]. Yet, within the Edge-IIoT and compressed-IDS literature reviewed here, XAI remains primarily post hoc: it is used to inspect model behavior after training rather than to shape the training process itself [14,15]. We therefore frame X-GATE as a domain-specific integration and evaluation contribution: it couples Teacher–Student attribution preservation, INT8 compression, and attribution-masked adversarial hardening for quantized edge IDS models.

To address this limitation, we propose X-GATE, a framework for training lightweight Transformers with explicit attribution-aware objectives for the Edge-IIoT. By embedding XAI directly into the loss function, X-GATE shifts explainability from passive inspection to a training-time constraint.

The primary contributions of this work are fourfold:

• Framework Contribution (X-GATE): We formulate the X-GATE framework, which treats XAI as an active, differentiable training signal for addressing the Quantization–Attribution Conflict in Edge-IIoT environments.
• Attribution-Alignment Contribution (ECD): We introduce Explanation-Consistency Distillation, a knowledge transfer mechanism that uses a differentiable soft-rank Spearman correlation penalty to preserve the feature-attribution structure of a full-precision Teacher in an 8-bit quantized Student.
• Protocol-Bounded Adversarial Contribution (EGAT): We introduce Explanation-Guided Adversarial Training, which augments generic gradient-based perturbations with targeted hardening on high-attribution feature coordinates.
• Empirical Evaluation (Edge-IIoTset): We provide a controlled evaluation on Edge-IIoTset 2022 and introduce the Logical Drift (${\Delta }_{\mathit{L}}$) metric to quantify attributional divergence across distillation variants. Under the latest three-seed ablation, ECD-only reduces Drift by 17.24% relative to standard KD, EGAT-only improves adversarial F1 by +10.57 percentage points, and the Full X-GATE configuration delivers a balanced operating point across compressed-model accuracy, attributional fidelity, and adversarial resilience under the evaluated explanation-evasion protocol. A separate deployment-subset rerun reports 0.617M parameters, 1.25 ms/sample CPU latency, and similar float/INT8 F1-Macro values for the compact Student under the saved-checkpoint validation protocol.

The novelty of X-GATE should therefore be read as an integration and evaluation contribution rather than as a claim that attribution learning, distillation, or adversarial training is new in isolation. Specifically, X-GATE couples rank-based Teacher–Student attribution preservation with Teacher-salient adversarial hardening and evaluates that coupling under INT8 compressed-IDS constraints.

The remainder of this paper is organized as follows: Section 2 reviews prior work on Transformer-based intrusion detection, compression, adversarial training, and explainable AI for cybersecurity and then summarizes the specific research gap addressed by this study. Section 3 formalizes the attributional fidelity problem and presents the X-GATE framework, including ECD, EGAT, the information-theoretic interpretation, and the optimization procedure. Section 4 describes the Edge-IIoTset evaluation protocol, baselines, main classification results, efficiency trade-offs, Logical Drift analysis, and component ablation. Section 5 interprets the empirical findings and deployment implications, while Section 6 states the current evidence limits and future research directions. Finally, Section 7 concludes the paper.

2. Literature Review and Gap Analysis

The growth of Industrial IoT deployments has broadened the operational attack surface and motivated extensive research on deep learning-based IDSs. This section reviews four related research strands that frame the gap addressed by the proposed X-GATE framework.

2.1. Transformer-Based Intrusion Detection at the Edge

Attention-based architectures have reshaped sequential anomaly detection. Earlier convolutional and recurrent approaches, such as CNN-LSTM hybrids, captured local temporal dependencies but struggled to model long-range cross-protocol correlations [16]. The adoption of Transformer-based models addressed this limitation through the global receptive field provided by multi-head self-attention and reported stronger performance on heterogeneous network traffic [1]. More recently, Bidirectional Encoder Representations from Transformers (BERT)-derivative models such as SecurityBERT [2] and EBIDS [17] have made Transformers a common choice for high-accuracy IDSs, with reported detection rates above 99% on recent benchmarks. Extending this line of work to federated edge topologies, Adjewa et al. [18] showed that BERT-based models compressed through pruning retain accuracy within 1.5% of their full-precision counterparts under non-i.i.d. data distributions, which is relevant for distributed IIoT deployments.

Despite these advances, operational tension remains: the most accurate Transformer architectures are often also the most computationally demanding. With parameter counts exceeding 100 million in general-purpose models, direct deployment on microcontroller units (MCUs) or Raspberry Pi-class edge processors is difficult in practice. This constraint motivates aggressive compression strategies, which, as reviewed in the following subsection, can introduce additional vulnerability.

2.2. Model Compression and KD for Edge Inference

The challenge of deploying large neural networks onto resource-constrained hardware has produced extensive compression research. Li et al. [4] provide a comprehensive taxonomy of compression techniques—including weight pruning, low-rank decomposition, and quantization—establishing that post-training 8-bit integer (INT8) quantization currently offers a strong accuracy-to-latency trade-off for edge inference. Gholami et al. [19] formally quantify the theoretical accuracy degradation induced by precision reduction, demonstrating that mapping 32-bit floats to discrete 8-bit integers introduces nonlinear distortions into the latent representation space, particularly affecting decision boundaries for minority classes. KD [20]—a paradigm in which a compact “Student” model is trained to mimic the soft output distributions of a larger “Teacher”—has emerged as a common mechanism for recovering accuracy lost through compression. Comprehensive surveys [5,21] report that KD-augmented quantization consistently outperforms quantization-alone baselines, particularly in fine-grained classification tasks similar to multi-class network intrusion detection.

Most existing KD frameworks for edge security primarily align output logit distributions and typically do not constrain the internal feature-attribution structure of the compressed model. In the setting studied here, this gap can appear as a form of “shortcut learning,” in which the Student may reproduce the Teacher’s outputs through brittle feature correlations rather than through a similar attribution pattern. Under that condition, the compressed model can become more susceptible to “explanation-evasion” attacks that target the features it relies on the most heavily.

2.3. Adversarial Robustness in IDSs: Standard AT and Its Structural Limitations

Adversarial examples—imperceptible perturbations engineered to manipulate model predictions—represent an important attack vector against deployed IDSs [22]. IDS-specific adversarial attacks have been extensively studied [7,23,24], with researchers demonstrating that even iterative perturbation algorithms such as PGD and the Carlini–Wagner attack can evade recent high-performing classifiers. The standard defensive countermeasure, AT, augments the training objective with worst-case adversarially perturbed examples [8]. While AT consistently improves robustness under standard threat models, Khraisat and Alazab [25] showed that its efficacy degrades substantially when applied to compressed models operating under quantization constraints, as the gradient approximation through discrete integer mappings becomes unreliable.

More importantly for the present threat model, standard AT is attribution-agnostic: adversarial noise is distributed uniformly across all input features without regard to their relative attribution weight under the model. This uniform application may be insufficient against “explanation-evasion” adversaries who deliberately target the feature dimensions most heavily weighted by the model’s attribution map. Asif et al. [26] partially addressed this through data augmentation strategies for aerial vehicular systems, and Mekdad et al. [27] investigated adversarial robustness for image-based malware detectors. More recent Explanation-Guided Adversarial Training outside IDSs further supports the broader value of using explanations during robust optimization [13]. The specific gap targeted here is narrower: we did not identify prior work that formalizes an attribution-guided, attribution-constrained adversarial training objective for quantized edge Transformer IDS models. EGAT is motivated by this scope gap.

Table 1. Positioning of X-GATE against adjacent research categories.

Research Category	Compression Role	Training-Time Attribution Objective	Evaluated Threat Focus
Compressed IDS/KD [4,5,12,21]	Primary objective	Typically output- or logit-level; attribution not constrained	Clean efficiency, accuracy, and transparency
Post-hoc XAI for IDS [11,14,28,29]	Usually secondary	Explanations generated after training	Explanation and operator audit
Adversarial and Explanation-Guided Training [7,13,22,25]	Sometimes included	Usually attribution-agnostic in IDSs; explanation-guided variants outside IDSs do not target INT8 Edge-IIoT Teacher–Student compression	Generic perturbations or non-IDS robustness
X-GATE	INT8 compact Student	Soft-rank Teacher–Student attribution alignment	White-box explanation-evasion stress test

summarizes the boundary between X-GATE and the closest categories of related work. The table is not intended as an exhaustive ranking of prior methods; instead, it identifies which combinations of compression, training-time attribution constraints, and explanation-evasion hardening are evaluated in this study.

2.4. XAI for Cybersecurity: Current Reach and Fundamental Limitation

The integration of XAI into intrusion detection represents a growing research direction [10,28]. Neupane et al. [11] provide a taxonomy of Explainable IDS (X-IDS) methods, classifying them across local (e.g., SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME)) and global (e.g., attention visualization and concept activation vectors) explanation paradigms. El Houda et al. [29] demonstrated that attaching SHAP-based explanations to deep IDS frameworks can support analyst-facing interpretation and enable targeted forensic attribution in 5G topologies. Gaspar et al. [14] recently extended this evaluation to compare LIME and SHAP explanations specifically in multi-layer perceptron-based IDSs, concluding that SHAP reliably outperforms LIME in feature-level explanation faithfulness. Similarly, Wali et al. [15] integrated Random Forest-based explanation modules with neural network classifiers to produce hybrid explainability-first IDS architectures operating on tabular network flows.

Despite these advances, the studies reviewed here use XAI primarily in a post hoc or transparency-oriented capacity. Explanations are generally generated after model training and used mainly as retrospective audit tools for human operators. Within the compressed edge IDS literature reviewed here, we did not identify prior work that incorporates feature-attribution structure as an active, differentiable constraint that modulates the training trajectory of a quantized Student model. In this setting, post hoc XAI can expose the “Logical Drift” that emerges under standard KD, but it does not directly constrain it during training. X-GATE addresses this limitation through ECD, which minimizes divergence between the Teacher’s and Student’s attribution maps during training and thereby moves XAI from a passive diagnostic role to a training-time constraint.

2.5. Summary of Research Gaps

The review above points to three interconnected gaps in the current literature that motivate the X-GATE contribution:

• The Logical Drift Problem: Current KD frameworks rarely quantify or constrain divergence between Teacher and Student feature-attribution structure during compression, leaving compressed models potentially susceptible to shortcut learning and explanation-evasion attacks.
• The Blind AT Problem: Standard AT mechanisms apply attribution-agnostic perturbations and may leave high-attribution features insufficiently hardened against targeted explanation-evasion attacks.
• The Passive XAI Problem: In the literature reviewed here, explainability is treated predominantly as a post hoc diagnostic. We did not identify a framework that uses feature-attribution structure as a training-time, differentiable signal to jointly optimize attribution preservation and targeted adversarial resilience.

The X-GATE framework is designed to address these three gaps jointly through the algorithmic combination of ECD and EGAT, as formalized in Section 3.

3. Methodology: The X-GATE Framework

To enhance reproducibility, the core workflow of X-GATE proceeds in three steps: (1) training a full-precision Teacher model to establish an attribution reference, (2) applying Explanation-Consistency Distillation (ECD) to align the Student’s attribution ranking with the Teacher’s, and (3) performing Explanation-Guided Adversarial Training (EGAT) to harden the Student specifically on high-attribution features. The integration logic of the proposed framework couples these steps such that ECD ensures the preservation of attribution structure, while EGAT simultaneously leverages this structure for targeted adversarial robustness.

To investigate the “Quantization–Attribution Conflict,” this study adopts a Design Science Research (DSR) paradigm [30], which supports the construction and evaluation of an artifact for a clearly scoped structural problem. The resulting artifact is X-GATE—a unified training methodology designed to improve attribution consistency and protocol-bounded targeted adversarial performance in 8-bit quantized Transformers for resource-constrained Industrial IoT environments.

To increase the representational capacity of the Transformer architecture on tabular network data, X-GATE employs Feature-wise Tokenization. Rather than indiscriminately flattening heterogeneous packet features into a single dense vector, this component projects each of the d continuous features into an independent high-dimensional embedding vector. This design implicitly defines a sequence length equal to the feature dimension ($Seq=d$), enabling the multi-head self-attention mechanism to natively compute complex cross-feature dependencies (e.g., correlating flow duration directly against packet size) prior to logical extraction.

X-GATE operates on two algorithmic components built upon this tabular Transformer foundation: ECD and EGAT. The architecture and data flow of the X-GATE framework are illustrated in Figure 1.

As depicted in Figure 1, raw IIoT traffic data $\left(\mathbf{X}\right)$ are simultaneously processed by the full-precision 32-bit Teacher model $\left(f_T\right)$ and the quantized 8-bit Student model $\left(f_S\right)$, with the Student being derived from the Teacher via post-training INT8 quantization $\mathcal{Q}(\theta ,8)$. The framework then engages three concurrent optimization modules. First, standard KD aligns the Student’s output logits with the Teacher’s via the Kullback–Leibler (KL) divergence loss ${\mathcal{L}}_{\mathrm{KD}}$. Second, ECD extracts feature-level attributions from both models using Input × Gradient (IxG) attributions (${\varphi }_T$ and ${\varphi }_S$) and penalizes rank divergence through a differentiable soft-rank Spearman correlation loss ${\mathcal{L}}_{\mathrm{Fidelity}}$, encouraging the Student to preserve the Teacher’s attribution hierarchy. Third, EGAT constructs a normalized attribution mask M from the Teacher’s attribution map and channels it through a Logic-Aware Attacker, which generates targeted perturbations ${\delta }^{*}$ concentrated on high-attribution features. These perturbations are combined with the original input (⊕) to produce explanation-evasion adversarial samples ${\mathbf{x}}_{\mathrm{adv}}$ that are fed back into the Student’s training loop. The three loss components converge into the unified attribution-aware objective $\mathcal{J}\left({\theta }_S\right)={\mathcal{L}}_{\mathrm{CE}}+{\mathcal{L}}_{\mathrm{KD}}+\beta {\mathcal{L}}_{\mathrm{Fidelity}}+\gamma ({\mathcal{L}}_{\mathrm{CE}}^{\mathrm{adv}}+{\mathcal{L}}_{\mathrm{KD}}^{\mathrm{adv}})$, whose gradients update the Student parameters via backpropagation, jointly optimizing classification accuracy, logit alignment, attributional fidelity, and adversarial robustness within a single differentiable training objective.

3.1. Formal Problem Definition: The Attributional Fidelity Gap

The deployment of Transformer-based IDS models, such as SecurityBERT, on IIoT edge devices requires aggressive compression. Pure post-training quantization can nevertheless produce the Attributional Fidelity Gap (AFG), a phenomenon where reducing continuous 32-bit floating-point weights to discrete 8-bit integers can alter the latent representation space. Consequently, while categorical prediction accuracy may survive compression, the attribution structure used as a proxy for the model’s decision logic can shift [19].

We formulate this as a constrained multi-objective optimization problem. Let $\mathcal{D}={\left\{({\mathbf{x}}_i,y_i)\right\}}_{i=1}^N$ represent the IIoT traffic dataset, where $\mathbf{x}\in {\mathbb{R}}^d$ denotes the d-dimensional network feature vector and $y\in \{0,1,\dots ,K-1\}$ the intrusion classification space over K classes. A full-precision Teacher model, $f_T(\mathbf{x};{\theta }_T)$ with parameter vector ${\theta }_T\in {\mathbb{R}}^p$ stored in FP32 precision, provides accurate predictions over heterogeneous traffic features.

To deploy on edge sensors, we derive a quantized Student model $f_S(\mathbf{x};{\theta }_S)$ by applying a post-training affine INT8 quantization operator $\mathcal{Q}$, formally defined as

$$\mathcal{Q}(\theta ,8)=\mathrm{clip}\left(\mathrm{round}\left({\displaystyle \frac{\theta }{s}}+z\right),q_{min},q_{max}\right)$$

(1)

where $s\in {\mathbb{R}}^{+}$ is a per-channel floating-point scale factor, $z\in \mathbb{Z}$ is the zero-point offset mapping the float zero to an integer representation, and $[q_{min},q_{max}]=[-128,127]$ for signed INT8 codes (with $z=0$ in the symmetric special case). This formulation follows PyTorch’s (version 2.11) dynamic quantization with per-output-channel calibration [31], selected for its superior preservation of activation distribution versus static per-tensor configurations.

We define the Logic of a model via class-conditional, gradient-weighted feature attribution $\varphi$. Let $z_c(f,\mathbf{x})$ denote the scalar logit of model f for class c. For each feature $j\in \{1,\dots ,d\}$, the attribution ${\varphi }_j^{\left(c\right)}(f,\mathbf{x})$ is computed using the IxG method:

$${\varphi }_j^{\left(c\right)}(f,\mathbf{x})=x_j·{\displaystyle \frac{\partial z_c(f,\mathbf{x})}{\partial x_j}}$$

(2)

During training, we set $c=y$ so that Teacher and Student attributions are aligned with the ground-truth label. During post hoc Logical Drift evaluation, we instead set $c=argmax{f}_T\left(\mathbf{x}\right)$ to compare both models against the Teacher’s decision target on the same sample. IxG is fully differentiable and much cheaper than sampling-based Shapley estimators; we therefore use it as a tractable saliency proxy rather than as an exact Shapley computation. For compactness, $\varphi (f,\mathbf{x})$ denotes the resulting class-conditional attribution vector. X-GATE therefore aims to minimize Logical Drift (${\Delta }_L=1-{\rho }_s\left(\right|{\varphi }_T|,|{\varphi }_S\left|\right)$)—where ${\rho }_s$ denotes the Spearman rank correlation coefficient between attribution magnitudes—while preserving categorical precision under adversarial threat. The term “Logical” is used operationally to denote the attribution-rank structure captured by this metric; it does not imply symbolic logic, causal reasoning, or human-interpretable rules.

3.2. ECD

Standard KD [20] minimizes the logit divergence between Teacher and Student. This output-level alignment ($\mathrm{argmin}{L}_{KD}$) does not guarantee alignment of the internal explanation maps ($\mathrm{argmin}\left|\right|E_T\left(\mathbf{x}\right)-E_S\left(\mathbf{x}\right)\left|\right|$). To encourage the quantized Student model to align its attribution rankings with its Teacher, we introduce the ECD algorithm.

The clean-input distillation objective optimized by the Student within X-GATE is  ${\mathcal{J}}_{\mathrm{clean}}$:

$$\underset{{\theta }_S}{min}{\mathcal{J}}_{\mathrm{clean}}\left({\theta }_S\right)={\mathbb{E}}_{(\mathbf{x},y)\sim \mathcal{D}}\left[{\mathcal{L}}_{CE}(y,f_S\left(\mathbf{x}\right))+{\mathcal{L}}_{KD}(f_T,f_S)+\beta {\mathcal{L}}_{Fidelity}({\varphi }_T,{\varphi }_S)\right]$$

(3)

To encourage the Student to preserve the Teacher’s attribution hierarchy across the observed feature space, we define the Fidelity Loss (${\mathcal{L}}_{Fidelity}$) as a differentiable soft-rank Spearman Correlation penalty [32]:

$${\mathcal{L}}_{Fidelity}=1-{\rho }_{\mathrm{soft}}\left(\right|{\varphi }_T|,|{\varphi }_S\left|\right):={\displaystyle \frac{6{\sum }_{j=1}^d{\left(\widehat{\mathcal{R}}\left(\right|{\varphi }_{T,j}\left|\right)-\widehat{\mathcal{R}}\left(\right|{\varphi }_{S,j}\left|\right)\right)}^2}{d(d^2-1)}}$$

(4)

Here ${\rho }_{\mathrm{soft}}$ is a differentiable surrogate for Spearman rank correlation computed on attribution magnitudes. In the hard-rank, no-tie limit, ${\mathcal{L}}_{Fidelity}=1-{\rho }_s$, so lower values indicate tighter alignment, 0 denotes perfect agreement, and 2 corresponds to complete rank inversion. Accordingly, ${\mathcal{L}}_{Fidelity}$ should be interpreted as a differentiable surrogate for the post hoc Logical Drift metric (${\Delta }_L$), not as the exact evaluation statistic itself.

$\widehat{\mathcal{R}}:{\mathbb{R}}^d\to {\mathbb{R}}^d$ is a NeuralSort-style differentiable soft-ranking operator [33] that produces a continuous approximation to discrete permutation ranks via sigmoid-smoothed pair-wise comparisons:

$$\widehat{\mathcal{R}}{\left(\mathbf{v}\right)}_j=1+\sum _{k\ne j}\sigma \left({\displaystyle \frac{v_k-v_j}{\tau }}\right),\tau >0$$

(5)

where $\tau$ is a temperature hyperparameter controlling ranking sharpness ($\tau \to 0^{+}$ recovers the hard rank). This formulation is fully differentiable with respect to ${\varphi }_S$ (and transitively ${\theta }_S$), enabling clean backpropagation through the attribution manifold. Unlike Mean Squared Error (MSE), which penalizes absolute attribution magnitude, the soft-rank penalty is scale-invariant: it encourages the 8-bit Student to prioritize a similar hierarchy of high-attribution network features $\{{\varphi }_{\left(1\right)}\ge {\varphi }_{\left(2\right)}\ge \cdots \ge {\varphi }_{\left(d\right)}\}$ as the 32-bit Teacher, regardless of magnitude differences induced by INT8 weight clipping.

3.3. EGAT

While ECD targets attribution alignment in the compressed model, it is not by itself an active defense against manipulation. Traditional AT relies heavily on uniform, gradient-based perturbation algorithms, such as PGD [8], defined as ${\mathbf{x}}_{adv}={\mathsf{\Pi }}_{{\mathcal{B}}_{ϵ}}(\mathbf{x}+\alpha ·\mathrm{sign}\left({\nabla }_{\mathbf{x}}{\mathcal{L}}_{CE}\right))$, where ${\mathsf{\Pi }}_{{\mathcal{B}}_{ϵ}}$ denotes projection onto the ${\ell }_{\infty }$ ball of radius $ϵ$. Because this blind approach treats all feature dimensions uniformly, it does not preferentially harden the high-attribution coordinates emphasized by the model, leaving the quantized model exposed to the “explanation-evasion” attack family studied here.

The EGAT protocol addresses this by operationalizing the Teacher’s attribution map as a Teacher attribution mask. Specifically, we normalize attribution magnitudes to obtain $M\in {[0,1]}^d$, with $M_j=|{\varphi }_{T,j}|/{\sum }_k\left|{\varphi }_{T,k}\right|$. In the implemented training loop, the attacker is instantiated as a single-step attribution-masked FGSM perturbation:

$${\delta }_{\mathrm{adv}}=ϵ·\left(M\odot \mathrm{sign}\left({\nabla }_{\mathbf{x}}{\mathcal{L}}_{CE}(y,f_S\left(\mathbf{x}\right))\right)\right),{\mathbf{x}}_{\mathrm{adv}}=clip(\mathbf{x}+{\delta }_{\mathrm{adv}})$$

(6)

The X-GATE objective then augments the clean-input loss ${\mathcal{J}}_{\mathrm{clean}}$ with adversarial CE/KD terms evaluated on ${\mathbf{x}}_{\mathrm{adv}}$:

$$\mathcal{J}\left({\theta }_S\right)={\mathcal{J}}_{\mathrm{clean}}\left({\theta }_S\right)+\gamma {\mathbb{E}}_{(\mathbf{x},y)\sim \mathcal{D}}\left[{\mathcal{L}}_{CE}(y,f_S\left({\mathbf{x}}_{\mathrm{adv}}\right))+{\mathcal{L}}_{KD}(f_T\left(\mathbf{x}\right),f_S\left({\mathbf{x}}_{\mathrm{adv}}\right))\right]$$

(7)

where ⊙ denotes Hadamard (element-wise) multiplication and $\gamma \ge 0$ controls the strength of the adversarial branch. The attribution mask M concentrates perturbation energy onto the features that the Teacher most heavily weights, while the outer loss trains the Student to remain accurate under these targeted attacks.

3.4. Information-Theoretic Interpretation

The rank-based objective also admits a conservative information-theoretic interpretation. Let $R_T=\mathcal{R}\left(\right|{\varphi }_T\left|\right)$ and $R_S=\mathcal{R}\left(\right|{\varphi }_S\left|\right)$ denote the hard-rank permutations induced by the Teacher and Student attribution magnitudes. Under a uniform prior over the $d!$ possible rank permutations of $R_T$,

$$I({\varphi }_T;{\varphi }_S)\ge I(R_T;R_S)=log(d!)-H(R_T\mid R_S)$$

(8)

The first inequality follows from the Data Processing Inequality, since ${\varphi }_T\mapsto R_T$ and ${\varphi }_S\mapsto R_S$ are deterministic maps. The identity on the right is the standard decomposition of mutual information under the stated uniform prior. This observation motivates rank agreement as a meaningful compression objective: improving agreement between $R_T$ and $R_S$ tightens a lower bound on the information preserved in rank space. In X-GATE, ${\mathcal{L}}_{Fidelity}$ serves as a differentiable surrogate for this rank agreement; it is not itself a direct estimator of mutual information, nor does it imply that the Student is a sufficient statistic for the Teacher.

Computational Complexity Analysis

To demonstrate the empirical feasibility of X-GATE, we analyze its asymptotic computational overhead. The primary computational bottleneck resides in the feature-attribution extraction (${\varphi }_T,{\varphi }_S$) required during the training loop.

• Problem Class: Non-convex neural optimization with attribution extraction inside the training loop.
• Time Complexity:

  $$\begin{array}{cc}\hfill \mathcal{O}(E_{max}·{\displaystyle \frac{N}{\left|\mathcal{B}\right|}}·[& C_T^{\mathrm{fwd}}+C_S^{\mathrm{fwd}}\hfill \\ \hfill & +{⊮}_{\beta >0}\left(C_T^{\mathrm{IxG}}+C_S^{\mathrm{IxG}}+C_{rank}\right)\hfill \\ \hfill & +{⊮}_{\gamma >0}\left(C_{\mathrm{attack}}+C_S^{\mathrm{adv}}\right)\left]\right)\hfill \end{array}$$

Here $C_T^{\mathrm{fwd}}$ and $C_S^{\mathrm{fwd}}$ denote Teacher and Student forward costs, $C_T^{\mathrm{IxG}}$ and $C_S^{\mathrm{IxG}}$ denote the additional input-gradient attribution costs, $C_{rank}$ is the soft-rank computation cost over d features, and $C_{\mathrm{attack}}$ denotes the masked FGSM step. This form matches the implemented training loop more closely than a fixed $3C_f$ count: the Teacher parameters are frozen, but Teacher attributions are still recomputed per mini-batch because they depend on the current inputs and target labels.

3.5. Algorithm: X-GATE Optimization Procedure

The integrated training procedure for the X-GATE framework, unifying ECD and EGAT within a single differentiable objective, is formally presented in Algorithm 1. The inclusion of this procedural structure mathematically and logically outlines the defense mechanisms deployed against targeted evasion.

Algorithm 1: X-GATE: attribution-aware distillation and EGAT

3.6. Method Positioning and Theoretical Motivation

While contemporary approaches to Edge-IIoT intrusion detection often treat model compression, explanation, and adversarial robustness as separate modules—yielding compact or explainable models that can remain exposed to explanation-evasion attacks—X-GATE links them through a shared attribution-aware training objective.

Unlike recent IDS methods that use XAI primarily as a passive diagnostic layer, X-GATE operationalizes feature attribution as an active, differentiable training constraint for the quantized Teacher–Student setting studied here.

This design choice addresses several structural limitations in the current literature:

• Beyond Standard KD: Conventional KD exclusively matches output logits [34], without directly constraining the attribution hierarchy used here as a proxy for model reasoning. In contrast, X-GATE explicitly encourages preservation of attributional structure through the ECD mechanism, so the Student is trained to inherit not only the Teacher’s predictions but also part of its attribution pattern.
• Beyond Standard AT: Traditional AT applies uniform, gradient-based perturbations (e.g., PGD) across all feature dimensions indiscriminately. EGAT instead concentrates perturbation energy on high-attribution features identified by the Teacher’s attribution map, yielding a training signal better aligned with the explanation-evasion adversary modeled in this study.
• The Logical Drift Metric (${\Delta }_{\mathit{L}}$): To quantify this effect, we introduce Logical Drift as a rank-agreement metric motivated by the information-theoretic interpretation in Section 3.4, offering a quantitative complement to subjective visual interpretations of explanation consistency.

4. Experimental Setup and Baselines

4.1. Dataset Description and Preprocessing

To evaluate X-GATE in a realistic but still benchmark-bounded Edge-IIoT setting, we utilized Edge-IIoTset 2022 [35]. This dataset is a broad public cybersecurity benchmark for IoT and IIoT applications, capturing 14 distinct cyberattack categories (yielding 15 total classes including Normal traffic) across seven sensor modalities (e.g., Flame, Water Level, and Temperature) and protocols. We do not treat results on this single dataset as evidence of cross-domain generalization; that boundary is discussed explicitly in Section 6.

The raw dataset was distributed across 24 source tables. We executed a four-phase preprocessing pipeline designed to keep validation and test records separate from training-time balancing operations:

• Aggregation and Deduplication: Over 20 million initial records were aggregated. We removed duplicate network flows and instances populated with null/NaN values, resulting in a cleansed baseline dataset.
• Partitioning: After aggregation and cleaning, the dataset was split using stratified random partitioning into training, validation, and test subsets (70/15/15). The split is not a temporal deployment split; therefore, temporal drift and chronological generalization are not claimed from these experiments.
• Feature Tokenization: We extracted 49 continuous numerical and categorical network features. Continuous-feature scalers and categorical encoders were fitted on the training partition and then applied to validation and test records. Continuous features were scaled using standard $\mathcal{Z}$-score normalization to stabilize attention gradients, while categorical indicators (e.g., protocol types and connection states) were mapped to integer indices for neural embedding.
• Training-Only Hybrid Resampling: Edge-IIoTset is strongly imbalanced (e.g., Normal traffic dominates at >1.6 M samples, while certain attacks such as MITM contain approximately ${10}^3$ samples). To reduce majority-class collapse during optimization, the training partition was balanced with a hybrid procedure: RandomUnderSampler reduced the dominant benign class, and the Synthetic Minority Oversampling Technique (SMOTE) expanded underrepresented attack classes. Validation and test partitions were not synthetically oversampled or undersampled, so reported metrics are computed on held-out records rather than on resampled evaluation data.

4.2. Baseline Models

To evaluate X-GATE within the constraints of resource-limited Industrial IoT environments, we established a representative seven-model benchmark matrix. This matrix contrasts X-GATE against strong classical tabular baselines, standard deep learning architectures, the full-precision Teacher model, and recent lightweight and Transformer-hybrid configurations.

All baselines use the same cleaned Edge-IIoTset feature schema and the same stratified train/validation/test partitions described in Section 4.1. The training fold is the only fold exposed to the hybrid SMOTE/undersampling procedure; validation and test folds remain unresampled for all models. This benchmark is intended to compare representative model families under a shared preprocessing protocol, not to claim exhaustive coverage of every published Edge-IIoTset result or a state-of-the-art leaderboard. We did not perform equal-budget, architecture-specific exhaustive tuning for every baseline; the baseline results should therefore be read as representative implementations under a common pipeline rather than as best-case reproductions of each model family.

• LightGBM/Random Forest: Tree-based ensemble methods remain effective for structured tabular network data [36,37]. We include LightGBM and Random Forest as strong classical tabular baselines. Evaluating deep learning models against these frameworks helps determine whether the computational overhead of transforming tabular data into continuous-feature embeddings is empirically justified for objectives beyond clean predictive accuracy.
• BiLSTM/1D-CNN: Standard deep sequential and spatial models are widely deployed in intrusion detection to capture sequential payload dependencies and localized communication patterns  [25]. These architectures establish the baseline performance floor for deep learning methods operating on raw feature vectors.
• Vanilla SecurityBERT (Pre-Trained Teacher): Derived from the architecture introduced by Ferrag et al. [2], Vanilla SecurityBERT is an uncompressed, 32-bit full-precision Transformer tailored for cyberthreat detection. In our experiments, this serves as the benchmark “Teacher” model. The goal is for the heavily quantized 8-bit X-GATE Student to approximate the Teacher’s diagnostic behavior while preserving more of its attribution structure than standard KD.
• TBCLNN (Tree-Based Convolutional Lightweight Neural Network): Selected as a recent lightweight neural competitor. TBCLNN represents contemporary efforts to merge tree-based spatial embeddings into computationally lean convolutional streams. This baseline helps distinguish X-GATE from comparisons against only older or less deployment-oriented architectures.
• MBConv-ViT [16] (MobileNet Vision Transformer Hybrid): As documented in the recent literature, replacing standard multi-head self-attention with hybrid MobileNet inverted residuals (MBConv blocks) paired with Vision Transformers offers an aggressively lightweight alternative to pure Transformers. MBConv-ViT [16] acts as our direct lightweight structural competitor for testing whether X-GATE’s 8-bit quantized structure and ECD provide a competitive compression–accuracy–attribution consistency trade-off.

To avoid overstating the comparison,

Table 2. Baseline and X-GATE model-selection protocol.

Model Family	Fixed Configuration	Training Budget	Interpretation
Random Forest [36]	100 trees, maximum depth of 20, fixed random state	One fit per seed on the shared training fold	Strong classical tabular reference, not a searched upper bound
LightGBM [37]	100 boosting rounds, learning rate of 0.1, fixed random state	One fit per seed on the shared training fold	Representative gradient-boosted-tree reference; low F1 is not used as evidence that LightGBM is intrinsically weak
CNN1D-BiLSTM [17], TBCLNN, and MBConv-ViT [16]	Published-inspired compact neural architectures implemented on the same feature schema	AdamW, learning rate of $1\times {10}^{-4}$, weight decay of $1\times {10}^{-4}$, up to 20 epochs in the baseline protocol	Representative neural references under the common preprocessing pipeline
Teacher, KD-only, and X-GATE Students	SecurityBERT-family Teacher and TinySecurityBERT Students with fixed KD temperature $T=4.0$	AdamW with CosineAnnealing schedule; X-GATE uses $\beta =0.5$, $\gamma =0.3$, $ϵ=0.03$, $\tau =1.0$	Main comparison for attribution-aware compression and controlled explanation-evasion hardening

summarizes the model-selection budget used in this study. The goal was a common-pipeline comparison across representative model families, not an exhaustive architecture-specific leaderboard search. Consequently, the Random Forest and LightGBM results should be interpreted as fixed-configuration tabular references, while the neural baselines and X-GATE share the same training fold, preprocessing, optimizer family, and validation protocol.

4.3. Experimental Results: Classification Performance

All deep learning models, including the baselines and X-GATE, were trained using an NVIDIA RTX 3090 GPU and the AdamW optimizer [38] with a CosineAnnealing learning rate scheduler initialized at $1\times {10}^{-4}$. The X-GATE training objective (Equation (3)) was configured with the following hyperparameters: clean-input CE and KD weights fixed at 1.0, with $\beta =0.5$ and $\gamma =0.3$; perturbation bound $ϵ=0.03$; and NeuralSort temperature $\tau =1.0$. The penalty coefficients $\beta =0.5$ and $\gamma =0.3$ were selected from a small validation grid rather than an exhaustive hyperparameter search; they should therefore be interpreted as reasonable operating-point choices, not globally optimal values. The attack magnitude $ϵ=0.03$ was chosen to align with established adversarial perturbation limits for tabular network traffic benchmarks. The Standard KD baseline used for the Logical Drift and ablation analyses was trained under an identical protocol—same TinySecurityBERT architecture, same AdamW optimizer, CosineAnnealing learning rate schedule, and gradient clipping (max-norm = 1.0)—differing only in the loss function, i.e., ${\mathcal{L}}_{\mathrm{KD}\text{-}\mathrm{base}}={\mathcal{L}}_{CE}+T^2·D_{\mathrm{KL}}(\sigma (z_T/T)\parallel \sigma (z_S/T))$ with temperature $T=4.0$, omitting both the ECD fidelity penalty and the EGAT adversarial protocol.

This paper reports related but non-identical evaluation views, and each view should be read as answering a different primary question rather than as one combined leaderboard.

Table 3. Evaluation view map.

View	Primary Artifacts	Evaluation Scope	Main Question
Clean benchmark	Table 4; Figure 2, Figure 3, Figure 4, Figure 5 and Figure 6	Full Edge-IIoTset clean-test classification	How does X-GATE compare with neural and tree baselines on standard clean classification?
Deployment subset	Table 5	Saved-checkpoint rerun with float/INT8 metrics and CPU latency	What compactness, quantization, and latency profile does the Student exhibit under the deployment-oriented rerun?
Ablation	Table 6 and Table 7; Figure 7 and Figure 8	Four configurations: KD-only, ECD-only, EGAT-only, and Full X-GATE	Which component changes attribution-rank alignment and which component changes protocol-bounded targeted adversarial performance?
Adversarial stress test	Table 8	White-box explanation-evasion protocol with mixed-provenance clean-F1 reference column	How does the evaluated Student behave when high-attribution features are deliberately perturbed?

summarizes the mapping between these evaluation views, their scope, and their primary artifacts.

Table 4. Classification performance summary on Edge-IIoTset 2022.

Architecture Type	Model	Accuracy (%)	F1-Macro (%)
Classical Ensemble	Random Forest [36]	99.87 ± 0.00	97.02 ± 0.06
Classical Ensemble	LightGBM [37]	58.03 ± 17.66	20.25 ± 6.00
Full-Precision DL	Vanilla SecurityBERT (Teacher)	99.67 ± 0.04	89.85 ± 3.32
Quantized KD (Proposed)	X-GATE TinyStudent	99.58 ± 0.11	89.30 ± 3.89
Deep Temporal	CNN1D-BiLSTM [17]	99.12 ± 0.04	78.84 ± 0.15
Deep Convolutional	TBCLNN (Recent Lightweight)	98.56 ± 0.31	70.38 ± 2.20
Hybrid Transformer	MBConv-ViT [16]	98.77 ± 1.45	85.42 ± 2.14

presents the primary evidence for full-benchmark clean classification.

Table 5. Deployment-subset efficiency and diagnostic trade-offs. This table illustrates the balance achieved by Full X-GATE, demonstrating a significant CPU latency reduction while preserving F1-Macro performance compared with the KD-only baseline.

Model	Parameters (Millions)	CPU (ms)	Float F1-Macro (%)	INT8 F1-Macro (%)	Gain
Vanilla SecurityBERT (Teacher)	4.799	4.16	71.58 ± 0.00	72.04 ± 0.00	Baseline
KD-only TinyStudent	0.617	1.29	78.23 ± 10.84	78.61 ± 11.13	87.1% params
Full X-GATE TinyStudent	0.617	1.25	78.83 ±5.83	79.11 ± 5.47	87.1 %; 3.3 ×

Note: Table 5 reports the deployment-subset saved-checkpoint rerun. The Teacher row is a fixed-checkpoint reference in this rerun; its INT8 value denotes the same Teacher reference evaluated through the INT8 inference path for context, not an additionally deployed Teacher variant. The TinyStudent rows report means ± standard deviations across the Student reruns used for the deployment-subset comparison.

presents the primary evidence for the deployment-oriented compactness, quantization, and CPU latency claim.

Table 6. Empirical calculation of Logical Drift (${\Delta }_L$) on Edge-IIoTset.

Distillation Architecture	F1-Macro (%)	Logical Drift (${\mathbf{\Delta }}_{\mathit{L}}$)	Drift Change vs. Standard KD
Standard KD (Logits Only)	89.98 ± 3.40	0.2536 ± 0.0061	–
Standard KD + ECD ($\beta$ = 0.5, $\gamma$ = 0)	91.17 ± 0.41	0.2099 ± 0.0214	−17.24%
Standard KD + EGAT ($\beta$ = 0, $\gamma$ = 0.3)	88.90 ± 2.54	0.2596 ± 0.0083	+2.36%
Full X-GATE (ECD + EGAT)	89.30 ± 3.89	0.2343 ± 0.0255	−7.63%

and

Table 7. Component ablation results on Edge-IIoTset 2022 (n = 3 runs).

Configuration	F1-Macro (%)	ROC-AUC	Adv-F1 (%)	${\mathbf{\Delta }}_{\mathit{L}}$	Spearman $\mathit{\rho }$
Standard KD ($\beta$ = 0, $\gamma$ = 0)	89.98 ± 3.40	0.9993 ± 0.0000	75.40 ± 3.02	0.2536 ± 0.0061	0.7464 ± 0.0061
Standard KD + ECD ($\beta$ = 0.5, $\gamma$ = 0)	91.17 ± 0.41	0.9992 ± 0.0001	76.34 ± 2.57	0.2099 ± 0.0214	0.7901 ± 0.0214
Standard KD + EGAT ($\beta$ = 0, $\gamma$ = 0.3)	88.90 ± 2.54	0.9992 ± 0.0000	85.97 ± 4.87	0.2596 ± 0.0083	0.7404 ± 0.0083
Full X-GATE ($\beta$ = 0.5, $\gamma$ = 0.3)	89.30 ± 3.89	0.9992 ± 0.0001	86.09 ± 5.57	0.2343 ± 0.0255	0.7657 ± 0.0255

present the primary evidence for component attribution and adversarial ablation.

Table 8. Deployment-subset adversarial robustness assessment under the evaluated protocol with clean-F1 reference values. The results show that Full X-GATE significantly reduces the adversarial FPR, highlighting its superior robustness against explanation-evasion attacks without compromising clean-F1 accuracy.

Model	F1-Macro (%)	Adversarial FPR (%)	Defense Framework
Random Forest [36]	97.02	>45.00	None
TBCLNN	70.38	25.40	None
MBConv-ViT [16]	85.42	22.30	Standard AT
CNN1D-BiLSTM [17]	78.84	28.10	Standard AT
KD-only TinyStudent	78.23 ± 10.84	0.46 ± 0.08	Logit KD
X-GATE TinyStudent	78.83 ± 5.83	0.16 ± 0.09	ECD + EGAT (Full X-GATE)

Note: For Random Forest, TBCLNN, MBConv-ViT [16], and CNN1D-BiLSTM [17], F1-Macro values are reproduced from Table 4 as full-benchmark clean references. For KD-only TinyStudent and X-GATE TinyStudent, F1-Macro values come from the deployment-subset rerun in Table 5. Thus the F1 column should not be read as a single-regime clean-F1 comparison; the robustness comparison is the adversarial FPR column under the evaluated threat protocol.

presents the primary evidence for protocol-bounded adversarial behavior under the white-box explanation-evasion stress test; its clean-F1-Macro column is a reference column with explicitly mixed provenance, as noted below the table. The absolute F1-Macro values from the deployment-subset rerun should therefore not be directly interchanged with the full-benchmark F1 values in Table 4; they answer a narrower deployment stress question.

The adversarial results reported below should be read as a controlled white-box stress test rather than as a complete production attack evaluation. The attacker is assumed to know the Student model and to perturb normalized tabular features within the fixed ${\ell }_{\infty }$ budget $ϵ=0.03$, using the explanation-evasion protocol to concentrate changes on high-attribution features. We do not evaluate adaptive gray-box or black-box attackers, multi-step optimization beyond the reported single-step masked-FGSM setting, poisoning, replay, protocol-aware packet constraints, or concept drift; these boundaries are revisited in Section 6.

As presented in Table 4, we prioritize the F1-Macro score as the primary diagnostic metric. Given the multi-class structure and extreme imbalance of Edge-IIoTset (15 classes, with Normal traffic far outnumbering rare attacks such as MITM), accuracy alone can be misleading. F1-Macro gives each class equal weight in the aggregate score, reducing the tendency of dominant classes to obscure failures on underrepresented attacks. For transparency, the reported deep learning results summarize repeated runs with different random seeds (three seeds for the principal X-GATE ablation and deployment-subset reruns; epoch counts range from 8 to 20 depending on the model and experiment). These values are descriptive means and standard deviations rather than formal hypothesis-test estimates.

The Random Forest classical reference point achieved an F1-Macro score of 97.02 ± 0.06%. This provides a strong empirical reference point and makes clear that X-GATE should not be interpreted as the clean-F1 optimum on tabular Edge-IIoTset features. Among the deep learning models, the full-precision Vanilla SecurityBERT (Teacher) reached an F1-Macro score of 89.85 ± 3.32% under the proposed feature-wise tokenization scheme.

As shown in Table 4, the 8-bit quantized X-GATE TinyStudent maintains stable full-benchmark performance across initializations (89.30 ± 3.89% on average). The average ${\Delta }_{\mathrm{F}1}$ between the 32-bit Teacher and the 8-bit Student is therefore approximately 0.55 percentage points in the full benchmark setting, which is consistent with the intended compact-Student operating point. Isolating the specific contribution of ECD requires the component ablation reported in Section 4.6. The separate deployment-subset rerun reported later uses a deployment-subset validation protocol and therefore yields lower absolute F1 values; we report it separately to avoid conflating full-dataset classification accuracy with deployment stress testing. Under standard top-down quantization, truncating float32 weights can distort the nonlinear boundaries that support minority-class discrimination. By explicitly encouraging attribution-rank agreement through the soft-rank penalty, the Student remains closer to the Teacher under the IxG attribution proxy than a purely logit-matching baseline.

The tested temporal baselines produced lower F1-Macro values under this implementation and preprocessing pipeline. The CNN1D-BiLSTM [17] architecture reached an F1-Macro of 78.84 ± 0.15%. This may reflect a weaker match between the implemented architecture and the tabular Edge-IIoTset feature geometry, the fixed tuning budget, or both; it should not be read as a general limit of temporal IDS models. The Vision–Transformer hybrid, MBConv-ViT [16], provided a stronger middle ground (85.42 ± 2.14%) but still trailed X-GATE by approximately 3.9 percentage points. This pattern is consistent with a narrower claim: within this benchmark and model set, attribution-aware distillation is a competitive neural design for structured IIoT anomaly detection under edge constraints. Under the same shared preprocessing and training recipe, LightGBM, despite being a competitive gradient boosting framework, reached 20.25 ± 6.00% F1-Macro on this specific multi-class distribution. We do not treat this value as LightGBM’s tuned upper bound on Edge-IIoTset; rather, it is reported as a representative outcome under the common pipeline used for this comparison.

To examine class-level error structure, Figure 2 presents the confusion matrix for X-GATE TinyStudent. Rather than repeating matrices for every baseline, we focus on X-GATE to highlight where errors remain concentrated. The matrix indicates strong separation for distinct volumetric flows (e.g., DDoS_UDP and DDoS_ICMP). The remaining misclassifications occur mainly within closely related attack families—such as SQL injection variants and Cross-Site Scripting (XSS)—where the continuous payload indicators overlap statistically.

Beyond raw classification accuracy, deployment also depends on training stability and diagnostic consistency. EGAT shapes perturbations toward Teacher-salient features. As shown in Figure 3, the highlighted X-GATE training and validation loss curves decline smoothly without erratic spikes. This behavior is consistent with stable optimization under the selected objective.

This stability is accompanied by useful class-separation behavior in this benchmark, as reflected by the macro ROC-AUC comparison in Figure 4. X-GATE remains close to the better-performing neural baselines and above the lower-performing traditional reference, suggesting a favorable class-separation profile among the evaluated neural and traditional implementations. To place this behavior in context, Figure 5 compares X-GATE with traditional, Teacher, and lightweight neural baselines as a qualitative cross-regime summary. Whereas some lighter sequential architectures (e.g., CNN1D-BiLSTM [17] and TBCLNN) trade recall for precision, or vice versa, X-GATE maintains a comparatively balanced profile across precision, recall, and the robustness-oriented 1-FPR axis, without implying that all axes come from one identical evaluation regime.

Figure 6 provides a qualitative view of explanation preservation. The feature-importance heatmap extracted from TinyStudent indicates that X-GATE distributes attribution across several secondary and tertiary payload features rather than overemphasizing a single manipulable indicator (e.g., TCP_Window_Size). The ECD penalty encourages the model to evaluate a broader packet context. This distributed attribution pattern may help explain the observed lower sensitivity to isolated feature manipulation under the evaluated threat model, but it should be treated as a qualitative attribution-based interpretation rather than a standalone causal proof.

4.4. Efficiency vs. Accuracy Trade-Off

While precision is important, the deployment objective of this study is to evaluate lighter operation on resource-constrained edge-class CPU settings. We therefore report empirical efficiency proxies using total parameter count (Millions) and CPU-side single-sample inference latency (ms per sample), rather than claiming hardware-specific microcontroller deployment. All measurements were conducted on a machine equipped with an AMD Ryzen 7 5800X CPU, 128 GB of RAM, and an NVIDIA RTX 3090 24GB GPU, using a batch size of 128, with the PyTorch dynamic INT8 quantization backend as the inference framework. The reported latency values were taken from the same CPU-side single-sample measurement harness used across Teacher and Student checkpoints, so the comparison reflects consistent deployment-side timing rather than ad hoc runtime sampling.

As detailed in Table 5, the deployment-subset rerun separates the edge Student models from the Teacher reference under the same CPU-side single-sample measurement harness. Vanilla SecurityBERT requires 4.799M parameters and 4.16 ms/sample, while the TinyStudent family requires only 0.617M parameters, corresponding to an 87.1% parameter reduction. Full X-GATE further records low CPU-side latency (1.25 ms/sample), a 3.3 × CPU speedup relative to the Teacher and a modest improvement over the KD-only Student (1.29 ms/sample).

Regarding parameter sensitivity, the local checks run around the deployment-subset operating point indicate that the chosen values for $\beta$, $\tau$, and $ϵ$ do not trigger abrupt collapse; nearby settings change performance smoothly rather than sharply. This is a reproducibility note, not a claim of exhaustive hyperparameter optimality. The efficiency comparison should therefore be interpreted as a deployment-subset validation rather than as a replacement for the full-benchmark classification results in Table 4. Under this validation protocol, Full X-GATE achieves 78.83 ± 5.83% float F1-Macro and 79.11 ± 5.47% INT8 F1-Macro, slightly above the KD-only Student while preserving the same compact parameter budget. The INT8 deployment evaluation used a quantization-compatible Transformer loading path to keep the saved-checkpoint rerun consistent across Teacher and Student models.

The Teacher in this rerun is used as the full-precision attribution reference for compression, not as a claim that the Teacher is always the strongest predictor on every deployment subset. ECD therefore evaluates whether a compact Student can preserve part of the Teacher’s attribution hierarchy while improving the deployment-oriented latency and compactness profile measured in this rerun.

4.5. Empirical Measurement of Logical Drift (${\Delta }_L$)

To test the attribution-alignment rationale introduced in Section 3, we quantified the internal attribution topology of the models natively via PyTorch IxG attributions. We define Logical Drift (${\Delta }_L=1.0-\rho$) using the Spearman rank correlation coefficient ($\rho$) computed across the absolute feature attributions of the full-precision Teacher and the quantized Student models, using the Teacher-predicted class as the common attribution target on each validation sample. Logical Drift should be interpreted as an attribution-rank divergence metric, not as a direct causal measure of model reasoning. The comparative baseline for this metric is explicitly the standard KD Student (a model distilled using only output logits without our proposed explainability constraints).

As shown in Table 6, the standard KD baseline obtains ${\Delta }_L=0.2536$, indicating that logit matching alone does not fully preserve the Teacher’s attribution ranking. This pattern is consistent with a shortcut learning interpretation, but it does not prove that the Student has learned spurious feature-dependence rules. The narrower claim is that a compressed model can match labels while relying on attribution rankings that differ materially from the Teacher’s.

The isolation of the ECD component ($\beta$ = 0.5, $\gamma$ = 0) in the ablation study clarifies its intended mechanism: by encouraging the Student’s attribution hierarchy to match the Teacher’s, ECD alone reduces Logical Drift from $0.2536$ to $0.2099$—a 17.24% reduction—while also showing a higher mean F1-Macro than the KD-only baseline (91.17% vs. 89.98%). This is consistent with the view that attribution-constrained distillation can transfer behavioral knowledge (logits) together with part of the Teacher’s attribution structure. The EGAT component ($\beta$ = 0, $\gamma$ = 0.3) instead primarily raises adversarial F1 under the evaluated explanation-evasion protocol, with Logical Drift remaining close to the KD-only baseline (${\Delta }_L=0.2596$). This separation supports the interpretation that ECD is the component most closely associated with attribution-rank preservation, whereas EGAT mainly changes the adversarial failure mode.

The Full X-GATE configuration ($\beta$ = 0.5, $\gamma$ = 0.3) exhibits an intermediate Drift value ($0.2343\pm 0.0255$): it does not match the ECD-only model’s lowest Drift, but it remains lower than KD-only while adding the adversarial-F1 gain associated with EGAT. This may reflect the multi-objective optimization tension inherent in simultaneously minimizing three loss terms—the Student must balance classification accuracy, attribution fidelity, and adversarial robustness, occasionally trading the ECD-only optimum for stronger observed adversarial performance under the evaluated protocol. In return, Full X-GATE obtains the highest mean adversarial F1 among the tested configurations (Adv-F1 = 86.09%) while maintaining competitive F1-Macro (89.30%).

4.6. Ablation Study: Quantifying Individual Component Contributions

To examine the contribution of each algorithmic component of X-GATE, we conducted a systematic four-configuration component ablation study. The ablation isolates the effects of: (1) Standard KD—standard KD without ECD or EGAT ($\beta =0,\gamma =0$); (2) Standard KD + ECD—KD augmented with ECD ($\beta =0.5,\gamma =0$); (3) Standard KD + EGAT—KD augmented with EGAT ($\beta =0,\gamma =0.3$); and (4) Full X-GATE—the complete framework with both components active ($\beta =0.5,\gamma =0.3$). All configurations utilized the identical TinySecurityBERT Student architecture, identical AdamW optimizer with identical learning rate ($1\times {10}^{-4}$) and gradient clipping (max-norm = 1.0) and were trained for 20 epochs across three independent random seed initializations (seeds: 42, 7, 13). The results are reported as means ± standard deviations.

The ablation results presented in Table 7 and visualized in Figure 7 and Figure 8 clarify the role of each X-GATE component.

Finding 1: ECD Is Associated with Higher Mean Accuracy and Lower Logical Drift in the Ablation. Adding ECD alone (Standard KD + ECD) raises F1-Macro from 89.98% to 91.17%, a gain of +1.19 percentage points (pp), and reduces Logical Drift from 0.2536 to 0.2099, a 17.24% reduction. This pattern is consistent with the soft-rank Spearman penalty encouraging the Student to learn attribution rankings that are more closely aligned with the Teacher’s attribution hierarchy, thereby reducing one measurable proxy for shortcut-like compression behavior. ECD does not materially change adversarial F1 under the evaluated protocol (Adv-F1 remains at 76.34%, comparable to Standard KD’s 75.40%), suggesting that attribution alignment alone did not improve performance under the evaluated perturbation protocol.

Finding 2: EGAT Is Associated With Higher Targeted Adversarial F1 Under the Evaluated Protocol. The largest ablation effect appears in EGAT. Adding EGAT alone (Standard KD + EGAT) raises adversarial F1 from 75.40% to 85.97%, a +10.57 pp gain. This result is consistent with the mechanism described in Section 3.3: by concentrating adversarial perturbation energy on the Teacher’s highest-attribution features through the attribution mask M, EGAT exposes the Student during training to the same feature subset targeted by the explanation-evasion protocol. Standard KD + EGAT does not reduce Logical Drift under this protocol (${\Delta }_L=0.2596$, slightly higher than KD-only), indicating that protocol-specific hardening alone does not guarantee improved Teacher–Student attribution alignment.

Finding 3: Full X-GATE Provides an Observed Balance Between Accuracy and Protocol-Bounded Adversarial Performance. The complete framework (Full X-GATE, $\beta$ = 0.5, $\gamma$ = 0.3) achieves the highest mean adversarial F1 in the ablation set (86.09 ± 5.57%) while maintaining competitive F1-Macro (89.30 ± 3.89%). Although the ECD-only configuration achieves the highest clean F1-Macro and lowest Logical Drift, the Full X-GATE configuration preserves part of this attributional benefit (${\Delta }_L=0.2343$) while adding the targeted adversarial-F1 improvement associated with EGAT. The resulting profile is therefore not a single-metric optimum; it offers a favorable balance observed among the tested configurations when clean classification, attribution-rank preservation, and protocol-bounded explanation-evasion performance are considered jointly.

Collectively, the ablation study suggests that ECD and EGAT address partly orthogonal failure modes—ECD targets the attribution-preservation gap, while EGAT targets the evaluated adversarial-defense gap—and that their combination in Full X-GATE provides a balanced observed operating point among the tested configurations.

5. Discussion

Section 4 reports accuracy, efficiency, attribution, and robustness measurements for the tested models. This section interprets those findings, discusses edge-deployment trade-offs, clarifies the role of the Logical Drift metric, and positions X-GATE relative to prior work and practical constraints. In particular, we justify why X-GATE is preferable beyond clean accuracy: while X-GATE does not strictly dominate in clean classification accuracy compared to unconstrained models like Random Forest, its primary advantage lies in minimizing Logical Drift and providing targeted adversarial robustness—attributes that clean accuracy metrics fail to capture.

5.1. The Tabular Data Paradigm: Why Tree-Based Models Excel—And Where They Face Edge-Deployment Constraints

The strong empirical performance of tree-based ensemble methods on structured tabular features is a well-documented phenomenon in the machine learning literature [39]. As demonstrated in Table 4, Random Forest achieves an F1-Macro score of 97.02 ± 0.06%, outperforming all neural architectures on this clean full-benchmark metric. This performance gap is not necessarily a flaw of the deep learning models and is consistent with the geometry of tabular data. Tabular IDS datasets such as Edge-IIoTset encode network flows as heterogeneous vectors of continuous, ordinal, and categorical features sharing no spatial or sequential topology. Tree models natively partition this space via axis-aligned, piece-wise-constant splits, which are often well matched to the irregular, non-smooth decision boundaries that characterize multi-protocol network anomalies.

Treating tree-based accuracy as the sole “performance ceiling” is incomplete once the operational constraints of Edge-IIoT deployment are considered across model compactness, adversarial threat surface, and temporal adaptation. A model that fails any one of these constraints can be difficult to deploy in practice, regardless of its benchmark performance. The relevant implication is therefore conditional: when deployment requires a small neural model whose training objective can incorporate attribution consistency and targeted hardening, clean tabular accuracy alone is an incomplete selection criterion. As shown in Section 4.4 (Table 5), the Random Forest reference is not the compact INT8 Student targeted by this study and was not evaluated in the same CPU-side quantized deployment path as X-GATE. Section 5.2 (Table 8) further shows that its axis-aligned split boundaries remain brittle under small, targeted perturbations that move samples across decision thresholds. This contrast is not intended to rank tree ensembles as generally inferior; rather, it motivates evaluating a differentiable compact neural path in which attribution-aware training constraints can be applied directly.

5.2. Protocol-Bounded Adversarial Resilience as an Operational Advantage

Table 8 highlights the operational motivation for X-GATE under the controlled adversarial conditions defined in Section 4.3. Under the “explanation-evasion” threat model—where an adversary targets high-attribution features identified via the model’s own attribution maps—Random Forest’s FPR rises to above 45% under attack in our evaluation protocol. This pattern should not be read as a general claim that tree ensembles are insecure; rather, it shows that this particular non-adversarially trained baseline is brittle under the attribution-guided perturbation scheme studied here. Tree ensembles in this setup are not trained with an explicit mechanism for recognizing or resisting attacks organized around their own feature-attribution topology.

The non-X-GATE adversarial rows in Table 8 should be interpreted as single-protocol stress-test references rather than exhaustive robust optimization baselines. They identify how representative models behaved under the same explanation-evasion attack definition used for this study, but they do not establish best-case adversarial robustness for each model family. The mean ± standard deviation values are reported only for the rerun Student configurations where three saved-checkpoint replicates were available.

In the representative AT baselines evaluated here, standard AT provides limited protection under the attribution-guided threat model, with CNN1D-BiLSTM [17] degrading to 28.10% adversarial FPR and MBConv-ViT [16] reaching 22.30%. A plausible explanation is the blind perturbation protocol underlying standard AT: by uniformly distributing FGSM noise across all $d=49$ features without awareness of attribution weight, these models are hardened against generic perturbations but can remain exposed when an adversary manipulates a small set of high-attribution features. In contrast, X-GATE’s EGAT mechanism concentrates hardening energy on those features via the attribution mask M, encouraging the model to rely less exclusively on a few vulnerable coordinates. The measured result under this protocol is an adversarial FPR of 0.16 ± 0.09% in the deployment-subset rerun—a large reduction relative to both the KD-only Student (0.46 ± 0.08%) and the non-X-GATE deep learning baselines.

Under this protocol, the framework is associated with improved targeted resilience against the evaluated explanation-evasion attack. Clean-accuracy trade-offs should be interpreted separately through the same-regime results in Table 4 and Table 5 rather than through the mixed-provenance clean-F1 reference column in Table 8.

5.3. Interpreting the Logical Drift Metric: Shortcut Learning and Attribution-Aware Compression

The introduction of the Logical Drift (${\Delta }_L$) metric represents a conceptual departure from how “successful distillation” is conventionally measured. Standard KD evaluation often halts at output accuracy: if the compressed Student achieves parity with the Teacher’s prediction labels, the distillation is deemed successful [20,34]. Our empirical results in Table 6 and Table 8 suggest that this criterion is insufficient under the explanation-evasion threat model studied here.

The standard KD baseline achieves a Logical Drift of ${\Delta }_L=0.2536$ in the ablation rerun despite producing competitive classification accuracy. This pattern is consistent with but does not by itself prove the “Clever Hans” phenomenon, or shortcut learning [40,41], in which a model reaches correct outputs by exploiting brittle feature correlations rather than the attribution structure encoded by the Teacher. In the IDS context, such a Student model may reproduce labels while relying on attribution patterns that differ from the Teacher’s. When those high-attribution features are deliberately manipulated by an adversary—as modeled in our EGAT threat scenario—the Student may be more vulnerable under this stress test if the compressed model’s attribution pattern differs substantially from the Teacher’s.

The X-GATE ECD constraint is designed to target this failure mode. For instance, preserving this attribution structure supports operational tasks in IIoT environments: an analyst can trace an alert back to malicious payload features during forensic review, and the same attribution map can help debugging by revealing when a compressed Student starts leaning on benign background traffic artifacts rather than attack-bearing fields. The ablation study (Section 4.6) provides supporting evidence: isolating ECD alone ($\beta$ = 0.5, $\gamma$ = 0) reduces Logical Drift from the standard KD baseline of ${\Delta }_L=0.2536$ to ${\Delta }_L=0.2099$, a 17.24% reduction. The Full X-GATE configuration retains a smaller but still positive attribution-preservation benefit (${\Delta }_L=0.2343$, a 7.63% reduction vs. KD-only) while improving targeted adversarial behavior. This finding is informative because it separates two mechanisms that can otherwise be conflated: ECD is associated with improved Teacher–Student attribution alignment, whereas EGAT is associated with higher adversarial F1 on the high-attribution coordinates targeted by the explanation-evasion adversary. By minimizing ${\mathcal{L}}_{Fidelity}$ to align the Spearman rank correlation of feature attributions, ECD penalizes attribution hierarchies that diverge from the Teacher’s even when output labels match. For instance, while a standard KD model might over-associate a specific isolated feature value (e.g., TCP_Window_Size) with an attack because that value appeared frequently in a training subset, X-GATE is instead encouraged to distribute attribution across the broader payload geometry. The combined ablation and deployment-subset evidence is therefore consistent with X-GATE transferring behavioral knowledge (logits) together with part of the Teacher’s attribution structure, producing a compressed model whose IxG attribution rankings remain closer to the Teacher’s attribution map under the evaluated protocol.

5.4. Efficiency–Accuracy–Explanation Consistency: Navigating the Three-Way Trade-Off

A persistent tension in the edge intelligence literature is the interaction among three axes relevant to deployment-oriented evaluation: computational efficiency (low parameter count and latency), classification accuracy (high F1-Macro), and attribution consistency (preserving explanation structure under compression and attack). In many systems, optimizing one axis can degrade another: aggressive quantization preserves efficiency but may disrupt attribution structure; adversarial hardening can improve protocol-specific adversarial metrics while adding training or inference overhead; maintaining full precision can preserve accuracy but often violates edge constraints.

The results suggest that this three-way trade-off is not fixed in a single direction across the tested variants. By jointly optimizing ${\mathcal{L}}_{CE}$, ${\mathcal{L}}_{KD}$, and ${\mathcal{L}}_{Fidelity}$ within a unified loss landscape, X-GATE appears able to preserve part of the Teacher’s attribution hierarchy without fully sacrificing efficiency or classification accuracy. Simultaneously, EGAT uses a single-step masked FGSM approximation that adds limited extra cost while improving adversarial F1 under the targeted threat model considered here. The ablation study (Section 4.6, Table 7) provides quantitative evidence for this complementarity: ECD alone contributes +1.19 pp to F1-Macro and a 17.24% reduction in Logical Drift, whereas EGAT alone contributes +10.57 pp to adversarial F1. In Full X-GATE, these effects combine into a balanced observed operating point among the tested variants: 89.30 ± 3.89% full-benchmark F1-Macro, 86.09 ± 5.57% adversarial F1 in ablation, 87.1% parameter reduction, 1.25 ms/sample deployment-subset CPU latency, and 0.16 ± 0.09% deployment adversarial FPR.

As a contextual comparison, the closest competing architecture (MBConv-ViT [16], 96.9% memory reduction) achieves greater compression but trails by ≈3.9% in F1-Macro and does not include an explicit mechanism for explanation-consistency or explanation-evasion defense. The TBCLNN competitor achieves extreme compression (99.9%) but at the cost of 18.9 percentage points of F1-Macro loss and high adversarial FPR under this evasion protocol (25.40%). Within this benchmark, these comparisons position X-GATE at a competitive operating point across the three deployment axes, although broader validation across additional datasets would be needed before claiming a general Pareto frontier.

5.5. Broader Implications: From Passive XAI to Active Attribution-Aware Training Signal

The methodological implication of X-GATE may extend beyond the specific Edge-IIoT application domain, but this extension should be interpreted as a hypothesis rather than an empirical conclusion. The central design choice—elevating XAI from a post hoc diagnostic tool to an active, differentiable training constraint—suggests a design pattern that may be useful in other deployment contexts where a compressed neural model is expected to remain both accurate and attribution-consistent under adversarial conditions. Industrial manufacturing QA systems, medical imaging compression for mobile diagnostics, and autonomous vehicle perception compressed for embedded GPUs may share variants of the Quantization–Attribution Conflict identified in this work, but each would require domain-specific validation. The X-GATE framework’s ECD and EGAT protocols are defined through the Teacher’s attribution map ${\mathsf{\Phi }}_T$ and the quantization operator $\mathcal{Q}$, which makes them conceptually portable across other compressed-model settings. Whether that portability holds across different architectures, datasets, and deployment domains remains an empirical question for future work.

Logical Drift also provides a candidate quantitative instrument for evaluating attribution consistency that complements accuracy-based benchmarks. Because this metric can be computed inexpensively via gradient-based attribution methods, it could serve as a useful supplementary reporting measure alongside F1-Macro and ROC-AUC in future compressed-IDS evaluations—analogous to how calibration error became a standard reporting supplement to classification accuracy following landmark work on neural network confidence [42].

6. Limitations and Future Work

6.1. Current Limitations

The empirical findings reported in this work rest on several methodological premises whose boundaries merit explicit scientific scrutiny. The most immediate constraint concerns the scope of experimental validation: all experiments are conducted on the Edge-IIoTset 2022 dataset, which, despite representing one of the most taxonomically comprehensive publicly available IDS benchmarks, constitutes a single operational environment with its own feature engineering conventions, traffic generation protocols, and class distribution characteristics. The generalizability of the quantitative performance gains—particularly the low adversarial FPR and the attribution-alignment trends observed across the ablation settings—to networks governed by substantially different topologies or attack landscapes cannot be established from the present evidence alone. Practitioners deploying X-GATE in production IIoT environments may encounter data distributions that deviate from this benchmark, and cross-dataset validation on complementary collections such as CICIDS2022, NF-UQ-NIDS17, UNSW-NB15, and CIC-IoT-2023 represents the essential next empirical step. Relatedly, the present split protocol is stratified randomly rather than chronologically or in a deployment-site based manner. Although validation and test partitions remain separate from the training-only SMOTE/undersampling procedure, this study does not establish performance under temporal drift, online deployment, or unseen-site transfer. The synthetic oversampling step is therefore an optimization device for the training fold, not evidence that the learned class boundaries will transfer unchanged to naturally imbalanced traffic streams.

A notable limitation of the evaluated threat model is the assumption that the Teacher’s attribution mask remains a stable reference under distribution shift. In practice, temporal drift or sensor reconfiguration could weaken that reference; EGAT may therefore be sensitive both to attribution noise and to the choice of attribution method itself. Future work should test mask stability under chronologically separated splits and compare alternative XAI backends before treating the current setting as broadly transferable.

A second limitation, more subtle in character, concerns the approximation underlying the Logical Drift metric itself. Both the ECD training objective and the post hoc ${\Delta }_L$ evaluation rely on IxG attributions as a computationally tractable gradient-based saliency proxy rather than an exact Shapley estimator. As such, IxG should not be interpreted as satisfying the full Shapley axiom system; in particular, features that carry no decision-theoretic influence may still receive non-zero attribution scores owing to gradient propagation artifacts in deep composition. The practical consequence is that the Logical Drift comparisons in Table 6 may incorporate a systematic measurement bias, and—more consequentially—the ECD training signal may inadvertently penalize innocuous attribution discrepancies rooted in this approximation rather than attribution-rank divergences that reflect meaningful model behavior differences. Quantifying the magnitude of this gap and evaluating whether ECD trained on KernelSHAP-generated attribution targets yields meaningfully stronger attribution alignment constitute an open and important methodological question.

The adversarial robustness evaluation is subject to a third structural constraint: the explanation-evasion threat model assumes a white-box adversary possessing full knowledge of the Student’s architecture, weights, and attribution topology—simultaneously the most stringent and the least operationally realistic threat assumption. In addition, the feature-space perturbations used in the present tabular stress test are bounded numerically, but they are not constrained by a full packet- or flow-level semantic-validity model; consequently, the results should be interpreted as model-level stress evidence rather than proof of protocol-valid attack resistance. A more operationally common adversarial regime involves gray-box or black-box adversaries who must estimate model behavior through query access or surrogate model transfer, and the degree to which X-GATE’s observed robustness transfers to these more representative conditions has not been evaluated. Compounding this, the single-step FGSM approximation employed by EGAT, while justified by established practice in the adversarial training literature [9], leaves a theoretical gap between this tractable approximation and a full multi-step PGD evaluation unquantified for the specific training objective defined in Equations (3) and (7). The three-seed reporting protocol also provides only descriptive means and standard deviations; it does not support strong formal significance claims, especially for metrics with relatively large variance such as deployment-subset F1-Macro. As a fourth limitation, the comparative baseline study is intentionally representative rather than exhaustive. The Random Forest, LightGBM, and compact neural references share the same preprocessing pipeline, but this study does not perform equal-budget architecture-specific hyperparameter searches or reproduce every published Edge-IIoTset leaderboard result. The comparison therefore supports claims about the observed operating point of X-GATE under this protocol, not claims of best-case superiority over fully tuned baseline families. Finally, the current compression strategy is confined to PyTorch dynamic INT8 quantization, a robust and commercially supported regime; the extent to which the ECD constraint’s attribution-preservation capacity degrades under more aggressive precision regimes—INT4 or binary quantization, where nonlinear distortions induced by weight clipping are substantially more severe—remains unexplored. Similarly, the latency measurements are CPU-side proxies rather than embedded-device measurements of memory footprint, throughput, or energy consumption.

6.2. Future Research Directions

The limitations articulated above motivate a tractable research agenda that extends naturally from the present contribution. The most pressing near-term direction is a systematic multi-benchmark evaluation campaign designed to establish the boundary conditions of X-GATE’s empirical performance. Validating the Logical Drift reduction and protocol-bounded adversarial metrics across datasets with contrasting attack taxonomies, sensor modalities, and feature dimensionalities would provide the empirical grounding necessary for making general claims about ECD’s attribution-preservation capacity. This evaluation can be conducted in parallel with an extension of X-GATE to federated edge learning settings, where heterogeneous data distributions across geographically distributed sensor nodes may amplify Logical Drift during local distillation in ways that the current centralized training protocol cannot address. A federated variant of X-GATE incorporating per-node Teacher attribution alignment—where each edge node’s local Student is constrained to preserve its regional Teacher’s attribution hierarchy—is a plausible extension, but its practical value would need to be established empirically under heterogeneous non-IID traffic.

A parallel security validation direction is to replace the present single-step explanation-evasion stress test with a broader attack suite: multi-step PGD-style optimization, adaptive attacks that account for the attribution mask M, gray-box and black-box transfer attacks, and packet- or flow-valid perturbation constraints. Such experiments would separate robustness that is specific to the current masked-FGSM protocol from robustness that persists under stronger and more operationally realistic adversaries.

Addressing the attribution approximation gap identified in Section 6.1 represents a second high-priority direction with direct implications for the measurement validity of ECD. Re-training the distillation framework using KernelSHAP-generated attribution targets in place of IxG approximations would align the attribution target more closely with Shapley-style desiderata and could reduce the dummy–axiom mismatch as a source of measurement bias. The primary engineering challenge is computational: KernelSHAP’s $\mathcal{O}(d·T_{\mathrm{samples}})$ per-sample cost substantially exceeds IxG’s single backward pass, and its integration within a real-time distillation training loop would require efficient amortized SHAP protocols or gradient-based SHAP surrogates trained jointly with the Student model—a separate engineering problem in its own right.

Another direction is the extension of X-GATE to quantization-aware training (QAT), wherein the straight-through estimator propagates gradients through the discrete quantization function during training, enabling joint optimization of weight precision and attributional fidelity throughout the learning lifecycle rather than applying attribution alignment as a post-quantization corrective constraint. The interaction between QAT’s gradient approximation and the ECD soft-rank penalty is theoretically non-trivial, but the potential payoff is a framework capable of improving attribution alignment at INT4 and below—where post-training quantization strategies often become brittle. In parallel, the EGAT protocol’s static attribution mask M—computed from Teacher attributions at training time and fixed thereafter—represents a natural candidate for adaptive online extension. Periodically updating M from real-time traffic samples could allow X-GATE to track distributional shifts in network behavior without requiring full model re-training, but this remains a hypothesis for future evaluation rather than a demonstrated property of the current system.

Another long-term direction concerns the broader evaluation role of Logical Drift. The compressed-IDS evaluation landscape currently lacks a widely adopted attribution consistency metric that complements prediction accuracy and protocol-bounded adversarial benchmarks; ${\Delta }_L$ is intended as one candidate for that role. The analogy to Expected Calibration Error [42] suggests that such metrics can mature from single-paper proposals into broadly used evaluation tools when they prove reliable across settings. If validated across additional datasets, architectures, and attack conditions, Logical Drift could become a useful supplementary reporting measure in compressed attribution-aware AI evaluation.

7. Conclusions

This work studies a specific tension in compressed Edge-IIoT IDS evaluation: the need to reconcile model compression, adversarial robustness, and attribution consistency. In the tested setting, deploying Transformer-based IDS models via standard KD and 8-bit quantization was associated with measurable shifts in internal feature-attribution patterns, producing a compressed “Student” that maintains competitive accuracy while exhibiting divergent attribution behavior, which we quantify as Logical Drift (${\Delta }_L$). Under the explanation-evasion threat model considered here, these shifts coincide with greater compressed-model susceptibility; one plausible explanation is that high-attribution features remain attractive perturbation targets, while standard AT does not explicitly protect them.

The proposed X-GATE framework is designed to address these limitations jointly within the evaluated protocol. Through ECD, X-GATE encourages the Student’s training trajectory to better preserve the Teacher’s feature-attribution hierarchy, operationalizing XAI as an active, differentiable penalty rather than a post hoc observation. Through EGAT, X-GATE concentrates adversarial hardening onto high-attribution feature dimensions identified by the Teacher’s attribution map, thereby using interpretability as part of the training-time defense mechanism.

The benchmark-bounded empirical results on Edge-IIoTset 2022 indicate that X-GATE reaches 89.30 ±3.89% F1-Macro in the latest three-seed full-benchmark ablation, using only 0.617M parameters. In the deployment-subset rerun, the same compact Student obtains 78.83 ± 5.83% float F1-Macro and 79.11 ± 5.47% INT8 F1-Macro while reducing adversarial FPR from 0.46 ± 0.08% for KD-only to 0.16 ± 0.09% under the single-step white-box explanation-evasion attack considered here; this should be interpreted as protocol-bounded evidence rather than a general robustness guarantee. The rerun also measures 1.25 ms/sample CPU-side latency for X-GATE compared with 4.16 ms/sample for the Teacher, corresponding to a 3.3× speedup. A four-configuration ablation study further separates the roles of the two modules: ECD improves F1-Macro by +1.19 percentage points and reduces Logical Drift by 17.24% over pure KD, whereas EGAT improves Adversarial F1 by +10.57 percentage points. The two modules therefore address different failure modes—attribution inconsistency and protocol-bounded adversarial behavior—and their combination in Full X-GATE yields a balanced operating point among the configurations and threat model evaluated in this study.

Beyond its immediate IIoT application, X-GATE also raises a broader design question: whether post hoc explainability is sufficient for compressed models deployed under adversarial pressure. Within the tested setting, our results support treating feature attribution as a training signal, not only as a post hoc inspection tool; in this setting, it is associated with improved attribution consistency and targeted adversarial performance under the evaluated threat model. In that sense, X-GATE and the Logical Drift metric offer a concrete, benchmark-bounded step toward edge-AI workflows in which interpretability is considered during compression rather than appended after deployment.