Imagine you're running a chain of 11 restaurants, each with a different local health inspector who grades on slightly different criteria. You want a single food-safety checklist that works everywhere — but you can't share the inspectors' notes across locations (privacy). The question isn't just whether to average the checklists; it's HOW you average them — do you penalize restaurants that drift too far from the group consensus, or do you let the server aggressively update based on outlier feedback? That's the core mechanism here: the aggregation rule matters more than you'd expect. The committed claim: replacing FedAvg with a proximal optimizer (FedProx-style, strong regularization) improves the count of transferable client pairs — pairs whose cross-client accuracy exceeds 70% — from 42 to 48 in a federated network intrusion detection system trained on CIC-IDS 2017. An adaptive optimizer (FedAdam-style, aggressive server learning rate) hits 46. This is not a claim about detecting new attack categories per se, but about improving how well a model trained on one client's attack distribution generalizes to another client's unseen attack classes. The baseline is TabFIDS (prior work by overlapping authors), which used FedAvg with bootstrapping and temporal averaging on the same CIC-IDS 2017 dataset split across 11 clients. The ladder is honest but narrow: we're comparing three optimizers on one dataset with one metric (count of pairs above 70% accuracy). No external dataset, no comparison to centralized training, no comparison to non-federated transfer learning baselines. The 48-vs-42 improvement is a 14% relative gain in breadth — real, but modest and confined to one benchmark. Architecturally, this is standard horizontal federated learning with a shared neural network (details sparse — the paper is 5 pages). The three optimizers represent the gradient-aggregation family: FedAvg (vanilla averaging), FedProx (proximal regularization penalizing client drift from the global model), and FedAdam (adaptive server-side momentum). The key structural lever is the mu parameter for FedProx and the server learning rate for FedAdam. They sweep 10 hyperparameter configs per optimizer — enough to show sensitivity, not enough for a full landscape. The integrity picture is mixed. CIC-IDS 2017 is a widely used community benchmark, which is good. But it's also a 2017 dataset — known to have labeling quirks and increasingly stale traffic patterns. The 11-client split and the transferability metric (count of pairs above 70%) come from the authors' own prior work (TabFIDS), so the evaluation framework is partly self-referential. No code release is mentioned. The hyperparameter sweep is modest (10 configs), and no confidence intervals or statistical significance tests are reported for the headline numbers. The depth-vs-breadth finding with SMOTE is genuinely interesting. SMOTE raises per-pair accuracy but reduces the number of transferable pairs, meaning it overfits to the minority-class distribution of the specific client. Bootstrapping preserves breadth. This is a useful design insight for practitioners building federated NIDS: your data-balancing choice isn't neutral, it shapes the geometry of generalization in a way that counts. The obvious next experiment is testing on a second dataset — UNSW-NB15, or better yet a modern dataset with post-2020 attack traffic. The authors almost certainly know this; at 5 pages, this reads like a workshop or short paper where scope was deliberately constrained. The other missing piece is scaling: 11 clients is tiny for cross-device FL. Whether the proximal advantage holds at 50 or 100 clients, with more heterogeneous attack mixes, is the load-bearing question for real deployment.
