Adversarially robust dynamic trust evaluation via graph-attentive reinforcement learning for scalable edge IoT security

1 Introduction

Trust is not a property a device advertises; it is a judgement a network makes, continuously, from evidence that an adversary is simultaneously trying to manipulate it. This framing—trust evaluation as an inference problem under active deception—distinguishes the challenge confronting modern edge IoT deployments from the more tractable problem of static anomaly detection. A projected global number of 29 billion IoT devices by 2030 (IoT Analytics, 2023) ensures that this challenge will only intensify, while the migration of decision-making to resource-constrained edge gateways simultaneously removes the computational safety margin that cloud-based analysis provided.

The difficulty is architectural rather than incidental. Trust evaluation has three distinct sub-problems that interact: (i) representation—constructing device embeddings that capture multi-hop behavioural patterns, including attack coalitions that are individually invisible but collectively obvious; (ii) decision—converting trust scores into operational actions (allow, throttle, isolate) via thresholds that balance false alarms against missed detections; (iii) adaptation—updating both the representation and the decision policy as the adversary revises their strategy in response to observed outcomes. Existing approaches address, at most, two of these. Reputation systems (Ganeriwal et al., 2008; Hassan et al., 2020) handle representation and decision but offer no adaptation. Machine learning classifiers (Lo et al., 2022; Amanmadov et al., 2025) handle representation and improve decisions but fix the evaluation policy. Reinforcement learning-based intrusion response (Nguyen and Reddi, 2021) handles adaptation but without graph-structured representation. We propose Adaptive Dynamic Trust Evaluation (ADTE), which targets all three.

Two additional challenges, inadequately addressed in earlier versions and identified by reviewers, have motivated new theoretical and empirical contributions in this revision. Long-term stability: a trust system deployed for months must adapt to evolving attacks without progressively forgetting the patterns it learned during initial deployment—a continual learning challenge that PPO, without explicit regularisation, does not handle. Gradient-accessible adversaries: the white-box attacker modelled in earlier research could observe threshold history but could not backpropagate through the detection system; a fully adaptive adversary with gradient access to the HGAT represents a strictly stronger and more realistic threat model, for which we now derive certified guarantees. Specifically, the gradient-based adaptive graph poisoning evaluated here operates as follows: at each evaluation window, the attacker constructs adversarial edge perturbations by backpropagating the HGAT classification loss with respect to the graph adjacency matrix, selects the top-⌊ 0.1 | E | ⌋ edges by gradient magnitude, and applies the perturbation before the gateway runs EMHA inference—an offline-replay threat model in which the attacker has full gradient access but must commit perturbations before observing the gateway’s response. This separation of attack computation from gateway inference is what makes the offline replay setting well-defined. Section 11.3 provides full experimental details.

Contributions. This study makes the following verifiable claims.

• Certified EMHA robustness. We derive a certified robustness radius ρ * for the EMHA mechanism under ℓ ∞-bounded node-feature perturbation (Theorem 1), prove mask convergence under PGD augmentation (Proposition 1), and demonstrate that EMHA resists gradient-based adaptive graph poisoning where the attacker has full access to the HGAT’s loss function (Section 11.3).
• Extended non-stationary regret bound. The regret bound O ( T Δ T ) is extended to (a) continuously drifting adversaries via a sliding-window restart scheme (Theorem 4) and (b) partially observable adversarial policies via a POMDP belief-state reduction that preserves the O ( T Δ T ) rate up to an additional term depending on the observation uncertainty (Corollary 2).
• Continual PPO with elastic weight consolidation (EWC). We augment the PPO agent with EWC to prevent catastrophic forgetting during long-horizon adversarial evolution, demonstrating that the EWC regulariser bounds the rate of policy degradation as a function of the Fisher information matrix condition number (Theorem 5).
• Asynchronous decentralised gateway operation. We introduce an asynchronous consensus protocol for multi-gateway ADTE deployments in which gateways share HGAT embeddings over noisy, delayed links and analyse convergence of the distributed trust estimate under bounded communication delay τ max (Proposition 2).
• Topology-churn-resilient scalability. Hierarchical HDIG partitioning (HHP) is extended with a dynamic re-partitioning trigger based on spectral gap monitoring, validated on synthetic topologies with device join/leave rates up to 5% per minute—conditions typical of industrial and campus IoT deployments (Baddeley et al., 2021).
• Privacy analysis. We formally bound the information leakage from threshold-history exposure to a white-box adversary using mutual information and propose a randomised threshold perturbation mechanism that reduces leakage below a target ϵ priv with bounded accuracy cost (Proposition 3).

2 Related research

2.1 Trust and reputation systems for IoT

The foundational architectures—RFSN (Ganeriwal et al., 2008) and TrustCom (Bao and Chen 2012)—have established beta distribution trust modelling as a principled baseline, the conceptual influence of which persists even in contemporary research. Their structural vulnerability to on–off attacks is well-characterised: because the beta update is a monotone function of recent observations, an attacker who controls the timing of honest behaviour can accumulate reputation faster than the system can forget. Hassan et al. (2020) partially address this with a Bayesian change-point layer (Singh et al., 2026): independently target it with dual-timescale reputation blending. Both approaches improve on–off resilience while fixing the evaluation policy—a design choice with severe consequences against patient attackers who adapt their strategy to the detection scheme rather than merely to its current state. More recently, Jiang et al. (2024) proposed a federated reputation framework that aggregates local trust scores across organisational boundaries, improving cross-domain generalisation but introducing the synchronisation latency problem that ADTE addresses. Simultaneously, Xiao et al. (2024) demonstrated that lightweight beta-model variants can operate within strict energy budgets on microcontroller-class devices, at the cost of reduced sensitivity to coordinated coalition attacks.

2.2 Graph neural networks for IoT security

E-GraphSAGE (Lo et al., 2022) established strong generalisation to unseen device types in IoT intrusion detection. GraphTrust (Amanmadov et al., 2025) extended this to heterogeneous GCN architectures for trust scoring on N-BaIoT, achieving 90.8% accuracy but evaluated only on static graph snapshots. TempShield (Ajmire et al., 2025) introduced adversarial temporal graph defence, but targeting graph-level anomaly detection rather than per-node trust scoring. Critically, neither GraphTrust nor TempShield provides certified robustness guarantees against gradient-based graph poisoning—a gap that ADTE’s EMHA mechanism and Theorem 1 fill.

The adversarial robustness of GNNs has been more broadly studied by Sun et al. (2020), who showed that imperceptible graph structure perturbations can severely degrade node classification accuracy. Certified defences via randomised smoothing (Bojchevski et al., 2020) provide formal guarantees but at a computational cost incompatible with edge inference. Our EMHA mechanism occupies a middle ground: it provides analytic robustness bounds that are tighter than randomised smoothing for the specific class of edge-injection attacks, while adding only O ( | E | ⋅ d e ) overhead to the forward pass. Recent research on robust GNN training under spectral perturbations (Jin et al., 2022) and adaptive graph defence via meta-learning (Zhang et al., 2024) extends the robustness toolkit but does not address the edge-level, online inference setting that edge IoT deployments demand. ADTE’s EMHA mechanism is, to our knowledge, the first to combine per-edge perturbation detection with a certified analytic bound computable in real time during gateway inference.

2.3 Reinforcement learning for adaptive security

PPO (Schulman et al., 2017) has established itself as the reference method for policy-gradient security tasks due to its resistance to catastrophic policy updates (Nguyen and Reddi, 2021; Sengupta et al., 2023). A more recent development is the use of meta-reinforcement learning for online adaptation to unseen attack families (Tiwari et al., 2024), which demonstrates faster policy recovery after distribution shift at the cost of a diverse meta-training corpus. Model-based RL approaches for network security (Li et al., 2024) have shown sample efficiency advantages but require accurate environment models that are difficult to obtain in dynamic IoT settings where device behaviour evolves continuously. Offline RL methods (Chen et al., 2021) that learn from fixed datasets without environment interaction offer promising deployment characteristics but have not yet been evaluated under adversarial distribution shift. What distinguishes ADTE from all cited prior research is the explicit non-stationarity treatment in the MDP definition and the continual learning augmentation—neither of which appears, to our knowledge, in the security RL literature.

2.4 Continual learning in security systems

Catastrophic forgetting—the tendency of neural networks to overwrite previously learned parameters when trained on new data—is a well-known failure mode of online learning systems (McCloskey and Cohen, 1989). In the security context, it manifests as a system that adapts to a new attack campaign while losing the ability to detect the original threat. EWC (Kirkpatrick et al., 2017) addresses this by penalising changes to parameters deemed important for prior tasks, as measured by the Fisher information matrix. Its application to continuously updated security models is nascent: Guo et al. (2025) apply EWC to network intrusion detection classifiers, demonstrating retention of prior-task accuracy, but do not integrate EWC with RL policy optimisation. ADTE provides the first analysis of EWC-regularised PPO for adaptive IoT trust management.

2.5 Privacy in trust management

Threshold-based decision systems implicitly leak information about the underlying model when an adversary can observe the system’s responses to probing inputs (Jagielski et al., 2020). For trust evaluation specifically, an attacker who knows the historical threshold sequence can infer the model’s sensitivity to boundary-region behaviour. Differential privacy mechanisms for ML-based security systems (Abadi et al., 2016) suppress this leakage at the cost of accuracy. We propose a lighter-weight randomised threshold perturbation that provides model-free leakage bounds using mutual information, thus avoiding the accuracy penalty of full DP.

Two 2026 systems bear directly on this comparison and are worth treating on their own terms rather than being folded into a generic “federated privacy” bucket. Yaseen et al. (2026b) combine federated multi-agent reinforcement learning with quantum-resilient cryptography and Byzantine-tolerant aggregation for autonomous intrusion response; they report strong false-positive reduction and near-complete privacy preservation under a fixed differential-privacy budget on a large simulated device population. The framework solves a genuinely harder cryptographic problem than attempted by ADTE: protecting model gradients exchanged across mutually distrustful federation participants. It does not, however, address graph-structured trust scoring, certified robustness to adversarial structural perturbation, or the non-stationary single-deployment setting that motivates ADTE’s regret analysis—the two frameworks are best read as complementary rather than competing, since a federation of ADTE-style gateways could plausibly adopt this style of cryptographic aggregation layer for inter-organisational deployment. Yaseen et al. (2026a) target a different point in the design space: ultra-reliable, low-latency 6G task distribution secured with post-quantum cryptographic primitives and variational quantum components, aimed at decoding-error and latency budgets far stricter than the 60 s window ADTE assumes. Their threat model concerns communication-channel security under future quantum-capable adversaries, which is largely orthogonal to ADTE’s concern with graph-poisoning and threshold-history leakage at the trust-decision layer. Relative to both, ADTE’s contribution is narrower in cryptographic scope—it offers no protection against an adversary with quantum computational resources, an explicit limitation we did not state clearly enough in earlier drafts—but broader in its treatment of the trust evaluation problem itself: certified node-feature robustness, empirical graph-poisoning resilience, non-stationary regret guarantees, and continual-learning stability are not addressed by either system. Table 1 reflects this positioning by treating privacy and adversarial robustness as separate columns, since the three frameworks trade off differently between them.

TABLE 1. Comparative analysis. ✓: fully addressed; ∼: partial; ×: not addressed.

Cert. Rob, certified robustness. CL, continual learning/no catastrophic forgetting. Async, asynchronous multi-gateway. Priv, privacy leakage bound.

included in experimental comparison.

2.6 Positioning summary

Table 1 situates ADTE against eight baselines across ten criteria. No prior study has simultaneously addressed certified robustness, continual learning, asynchronous gateway operation, and privacy leakage. The two federated/quantum-security frameworks discussed above are omitted from the table itself because they do not perform device-level trust classification and so cannot be scored on the classification-oriented criteria (H-Graph, Cert.Rob., and Async) without forced and somewhat misleading mapping; the qualitative comparison above is the fairer treatment.

3 System model and problem formulation

3.1 Network model

Consider an edge IoT deployment of N devices D = { d 1 , … , d N } served by G ≥ 1 edge gateways G = { g 1 , … , g G }. Devices span four functional classes (sensor, actuator, metering unit, embedded controller) and communicate via heterogeneous short-range protocols (Zigbee, BLE, Z-Wave, and Wi-Fi 6). Gateways run the ADTE module and communicate with each other over a low-bandwidth management plane—an architectural reality that distinguishes real edge deployments from the single-gateway assumption common in prior research.

Definition 1 (Heterogeneous device interaction graph). The HDIG is a directed attributed multigraph H = ( V , E , ϕ , ψ , X , T ) , where: V is the node set; ϕ : V → T v = { sensor, actuator, gateway, controller } assigns node types; ψ : E → T e = { data, control, co - location, anomaly } assigns edge types; X ∈ R | V | × d is the node feature matrix; T ∈ R | E | is the edge timestamp vector. The HDIG is reconstructed at each 60 s evaluation window.

Anomaly edges are inserted when the prior window raised a suspicion flag for a given interaction, embedding temporal memory of past suspicious events directly into graph topology rather than requiring the encoder to reconstruct it from feature history alone. This design prevents memory loss under feature distribution shift, a property important for continual learning analysis in Section 6.

3.2 Node feature encoding

Each node v i carries a d = 64-dimensional feature vector partitioned into five blocks: behavioural ( d b = 16 ), topological ( d t = 12 ), temporal Fourier ( d τ = 12 ), resource ( d r = 8 ), and energy ( d e = 8 ), plus an eight-dimensional belief-state summary ( d β = 8 ) derived from the POMDP filtering step described in Section 4.2. The belief-state summary encodes the posterior probability that each device is in each of four latent states— {benign-stable, benign-degraded, compromised-covert, compromised-active}—providing an explicit uncertainty signal that the HGAT can use to down-weight nodes with ambiguous latent states.

3.3 Trust score and decision rule

Definition 2 (Trust score and action). The smoothed trust score of d i at window t is τ ̃ i t ∈ [ 0,1 ] . An adaptive threshold pair θ t = [ θ ℓ t , θ h t ] with θ ℓ t < θ h t − 0.10 maps scores to actions:

The research problem couples three sub-problems: (P1) accurate trust score estimation under adversarial graph perturbation; (P2) adaptive threshold control under non-stationary adversarial drift; and (P3) long-horizon policy stability under continual adversarial evolution. The coupling arises because the attacker observes both the trust scores (through the gateway’s allow/isolate responses) and the threshold history θ 1 : t − 1. Addressing P3 while solving P1 and P2 is the principal contribution of this revision.

4 ADTE architecture

Figure 1 illustrates the four-module architecture. The HDIG construction engine (Module 1) feeds the EMHA-HGAT encoder (Module 2), whose output drives both the continual PPO agent (Module 3) and the asynchronous consensus layer (Module 4) for multi-gateway deployments. The modules interact in two directions: forward, where graph embeddings from Module 2 constitute the state representation consumed by Module 3’s policy network, and backward, where Module 3’s threshold decisions influence the anomaly-edge insertion logic in Module 1 at the next window (a flagged device triggers an anomaly edge in the subsequent HDIG). Module 4 operates in parallel with Modules 1–3, synchronising boundary-node embeddings between gateways before Module 2 aggregates them into consensus representations. This coupling is why removing any single module in the ablation study (Table 7) degrades performance: each module provides inputs that the others depend on for accurate operation.

4.1 Edge-masked heterogeneous attention

4.1.1 Attention formulation

For edge type r ∈ T e and directed pair ( j → i ), the raw attention logit iswhere W r ∈ R d ′ × d and a r ∈ R 2 d ′ are relation-specific parameters.

e i j r = LeakyReLU a r ⊤ W r h i ‖ W r h j , (2)

4.1.2 Adversarial edge gate

The gate scalar ξ i j r ∈ [ 0,1 ] iswhere e i j ∈ R d e is the edge feature vector (timestamp, frequency, volume). The masked and normalised attention coefficient is

ξ i j r = σ m r ⊤ h i ‖ h j ‖ e i j , (3)

e ̃ i j r = ξ i j r ⋅ e i j r , (4)

α i j r = exp e ̃ i j r ∑ k ∈ N r i exp e ̃ i k r . (5)

The node embedding update across L layers iswith β r being a softmax-normalised semantic weight per relation type.

h i ℓ + 1 = ELU ∑ r ∈ T e β r ∑ j ∈ N r i α i j r W r h j ℓ , (6)

4.1.3 Adversarial augmentation training

During training, each clean graph H is paired with a perturbed version H ′ constructed by ten-step PGD graph attack (Sun et al., 2020) with perturbation budget ⌊ 0.1 | E | ⌋ edges. The HGAT is trained on both, minimisingwith α aug = 0.5.

L aug = L CE H + α aug L CE H ′ , (7)

4.1.4 Mask convergence

Proposition 1 (EMHA mask convergence). Let L aug be the augmented training loss in Equation 7 and suppose that the gate parameters { m r } are updated by gradient descent with step size η . Then, for any adversarial edge ( j , i , r ) ∈ E adv , the expected mask value satisfies where ξ 0 is the initial gate value, μ ξ > 0 is the local strong convexity constant of L aug with respect to m r in a neighbourhood of the adversarial edge distribution, and ξ * ∈ 0,1 is the residual gate value determined by the irreducible uncertainty in the adversarial edge distribution.

PROOF. The gate ξ i j r = σ ( m r ⊤ z i j ), where z i j = [ h i ‖ h j ‖ e i j ]. Under PGD augmentation, the gradient of L aug w.r.t. ξ i j r is negative for adversarial edges (since increasing ξ increases the loss on perturbed graphs). By the μ ξ-strong convexity of L aug near the solution m r * (which satisfies ξ i j * < 1 for all adversarial edges), gradient descent converges geometrically at rate ( 1 − η μ ξ ) t, yielding Equation 8. The residual ξ * is non-zero only when the adversarial and benign edge distributions are not separable in the gate’s feature space.

Remark 1 (Justification of local strong convexity). The local strong convexity constant μ ξ > 0 assumed in Proposition 1 is non-trivial for a sigmoid-gated network, since σ ( ⋅ ) is not globally strongly convex. We justify the local condition as follows. The Hessian of L aug with respect to m r evaluated at m r * is

The second-derivative term ∂ 2 L CE / ∂ ξ 2 > 0 whenever the cross-entropy loss is not at its global minimum. The outer product z z ⊤ has full rank whenever the joint feature distribution of adversarial-edge triplets [ h i ‖ h j ‖ e i j ] spans the full feature space—a condition guaranteed by the diverse PGD perturbation budget used in training (⌊ 0.1 | E | ⌋ edges, 10 random seeds). Operationally, the local condition reduces to requiring that | m r ⊤ z | < 4 for all training samples (so that σ ′ is bounded away from zero), which holds in our setting since gate pre-activations are clipped during training. We measure μ ξ = 0.031 ± 0.004 across five seeds on N-BaIoT at convergence, confirming that the local strong convexity constant is positive and well-separated from zero.

This justification is necessarily local in a second sense that the measurement above does not resolve: μ ξ is estimated at the converged solution on five seeds of a single dataset family (N-BaIoT, MedBIoT, and UNSW-NB15 share similar IoT traffic statistics), and the argument that the outer product z z ⊤ has full rank rests on the training-time PGD budget covering the relevant region of feature space—a claim we have not verified for device populations with behavioural statistics substantially different from the three benchmark datasets. We therefore do not treat μ ξ > 0 as established for graph-attention trust models in general; it is established for the specific architecture, training procedure, and dataset family evaluated here, and Proposition 1 should be read with that scope in mind. A more general convexity argument, if one exists, would need to hold uniformly over a class of feature distributions rather than being checked post hoc on the converged model, and we flag this as an open theoretical question rather than one this revision resolves.

4.1.5 Certified robustness under node-feature perturbation

Theorem 1 (EMHA certified robustness). Suppose that node features are perturbed by ‖ δ x i ‖ ∞ ≤ ε for all i . Let C W = max r ‖ W r ‖ 2 and let L denote the number of HGAT layers. The change in the trust score of any node i satisfies where σ s , max ′ = 0.25 is the maximum sigmoid derivative. Consequently, trust decisions remain unchanged as long as the current trust score is more than δ τ i max from either threshold, defining thus a certified robustness radius:

PROOF. The perturbation δ x i propagates through the HGAT via the sequence of ELU-activated linear transformations in Equation 6. Since ELU is 1-Lipschitz and each projection W r has spectral norm at most C W, the perturbation to layer-ℓ embedding satisfies ‖ δ h i ( ℓ ) ‖ 2 ≤ C W ℓ ‖ δ x i ‖ 2 ≤ C W ℓ d ε by the ℓ ∞ → ℓ 2 norm conversion. After L layers, the perturbation to the readout w out ⊤ h i ( L ) is bounded by ‖ w out ‖ 2 C W L d ε. Applying the bound on the sigmoid derivative yields Equation 9. The decision boundary condition directly yields Equation 10.

Remark 2 Theorem 1 provides a per-node, per-window certified radius that can be computed online. Nodes with trust scores close to the threshold boundaries (small ρ * ) can be flagged for enhanced scrutiny—for example, a mandatory quarantine period—without waiting for their trust score to cross the threshold. This converts the certification from a passive guarantee into an active early-warning signal.

Remark 3 (Scope of the certificate relative to the graph-poisoning threat model). The reviewers correctly identified that Theorem 1 certifies robustness against ℓ ∞ -bounded node-feature perturbations, whereas the primary threat model involves graph-structure perturbations—specifically, adversarial edge injection. This distinction is important and we address it explicitly here. The node-feature certificate in Theorem 1 serves two roles. Firstly, it provides a formal guarantee for the class of feature-manipulation attacks (sensor spoofing, traffic-volume inflation, timestamp falsification) that represent a practically significant sub-class of IoT adversaries. Secondly, it establishes the analytic machinery—Lipschitz propagation through the HGAT layers—that underpins the empirical resistance to edge-injection attacks demonstrated in Table 3 . A fully rigorous certificate against edge-structure perturbations the raw attention logit (Equation 2), the EMHA gate (Equation 3), the masked coefficient (Equation 4), the attention softmax (Equation 5), and neighbourhood aggregation (Equation 6). This is a substantially more difficult problem: the attention distribution changes non-linearly when edges are injected or removed, and the gate is specifically designed to detect such perturbations rather than to be agnostic to them. Certified defences for graph-structure perturbations via randomised smoothing exist in the general GNN literature (Bojchevski et al., 2020) but impose computational costs incompatible with 60 s edge evaluation windows. We therefore make a precise and bounded claim: ADTE provides an analytic certificate against node-feature perturbations (Theorem 1) and empirical, but not formally certified, robustness against edge-structure attacks (Table 3). The title and abstract have been revised to reflect this distinction; the certified robustness claim is now explicitly qualified as applying to node-feature perturbation. Deriving a formal certificate against the full graph-poisoning threat model remains an open problem and a stated direction for future theoretical work.

Remark 4 (Empirical ρ * values and threshold margins). The certified robustness radius ρ * in Equation 10 scales inversely with the spectral norm product C W L and can become vacuously small for deep networks with large spectral norms. To assess practical utility, we report empirical ρ * values alongside the threshold margins actually used during evaluation. On N-BaIoT at convergence ( L = 3 , measured C W = 1.31 ), the median ρ * = 0.087 across all device-windows, with the tenth percentile at ρ * = 0.031 (devices near the threshold boundary). The adaptive threshold pair [ θ ℓ t , θ h t ] maintains a minimum separation of 0.10, so a threshold margin of min ( τ ̃ i − θ ℓ , θ h − τ ̃ i ) ≥ 0.031 is sufficient for certification—a condition satisfied by 89.3% of device-windows in clean evaluation and by 74.1% under gradient attack at ε = 0.10 . For the remaining 25.9% of device-windows under attack, the certification provides no formal guarantee; these are precisely the boundary cases flagged by the early-warning mechanism described above.

4.2 POMDP belief-state reduction

An adversary’s true policy is not directly observable: the gateway sees device behaviour, not intent. To model formally this partial observability, we define a POMDP over the latent device state space Z = { benign - stable, benign - degraded, compromised - covert, compromised - active }.

Definition 3 (Belief state). The belief state of device d i at window t is b i t ∈ Δ ( Z ) , where Δ ( Z ) is the probability simplex over Z . It is updated via Bayes’ rule: where o i t is the observed behaviour feature vector, P ( o | z ) is the observation model, and P ( z ′ | z , a ) is the latent transition model.

The belief state b i t enters the node feature vector as the d β = 8 belief-state summary block, providing the HGAT with an explicit probabilistic representation of each device’s trust uncertainty. The observation and transition models are estimated from training data; their uncertainty is captured by a Dirichlet posterior with concentration parameters updated online.

Corollary 2 (Regret under partial observability). Under the POMDP belief-state formulation, the ADTE PPO agent’s cumulative regret satisfies where H obs = max i H ( z i | o i t ) is the maximum conditional entropy of the latent state given observations—a measure of irreducible observation uncertainty.

PROOF. The POMDP with belief-state b i t reduces to an MDP over the belief simplex, which satisfies the same bounded-reward and Lipschitz-continuity conditions as the original MDP (since the belief update is a contraction in the total variation metric). Applying Theorem 4 to the belief-state MDP yields the first term. The second term arises from the estimation error of the belief state due to observation noise, bounded using the entropy of the latent state conditioned on observations together yielding the regret bound in Equation 12.

4.3 Temporal trust smoothing

The EMA with device-adaptive decay iswhere v i t encodes recent behavioural volatility and embedding dissimilarity.

τ ̃ i t = λ i t τ i t + 1 − λ i t τ ̃ i t − 1 , λ i t = σ s u ⊤ v i t , (13)

5 Non-stationary PPO threshold adaptation

5.1 Non-stationary MDP with continuous adversarial drift

The piece-wise stationarity assumption was identified by reviewers as a potential limitation. We now provide a regret bound that holds under continuous adversarial drift, using a sliding-window restart mechanism that partitions the time horizon into overlapping windows of length W sw, with the PPO policy reset to the prior window’s converged parameters at the start of each window.

Assumption 3 (κ-smooth adversarial drift). The adversary’s policy π t A varies smoothly: ‖ π t + 1 A − π t A ‖ TV ≤ κ for all t , where κ ≥ 0 is the per-step drift rate.

Under Assumption 3, Δ T ≤ κ T, and piece-wise stationarity is the special case κ ∈ { 0 , δ ( t − t k ) }.

Theorem 4 (Regret under continuous drift). Under Assumption 3 and bounded reward R t ∈ [ 0 , R max ] , the ADTE PPO agent with sliding-window restart of window length W sw = ⌊ T 2 / 3 κ − 1 / 3 ⌋ achieves cumulative regret where C 1 , C 2 are constants depending on the MDP mixing time and R max. Setting κ = Δ T / T recovers the O ( T Δ T ) bound from the piece-wise stationary case when drift is concentrated at change points.

PROOF. Divide the horizon T into N W = ⌈ T / W sw ⌉ windows of length W sw. Within each window, the total variation of π t A is at most κ W sw by Assumption 3. The near-stationarity within each window allows PPO to achieve per-window regret O ( R max W sw ) by the standard PPO convergence analysis (extended to handle κ W sw drift by the standard Δ-contaminated MDP regret argument of Cheung et al. (2020)). Summing across N W windows gives total regret O ( N W R max W sw ) = O ( R max T N W ). Setting W sw = T 2 / 3 κ − 1 / 3 minimises the right-hand side, yielding Equation 14. The connection to O ( T Δ T ) under piece-wise drift follows by setting κ = M / T for M change points.

Remark 5 The O ( T 2 / 3 ) rate for continuously drifting adversaries is worse than the O ( T ) rate for stationary adversaries, which is information-theoretically unavoidable: no online algorithm can achieve sublinear regret against an adversary who changes strategy at every step ( Even-Dar et al., 2009 ). The T 2 / 3 rate is, however, the optimal rate achievable by any algorithm against a κ -smooth adversary. ADTE achieves this optimal rate through the sliding-window restart.

5.2 MDP state, action, and reward

The state iswhere b agg t ∈ R 4 is the network-aggregated belief-state summary (mean posterior probability across all devices for each latent state class).

s t = τ ̃ ̄ t , θ t , f attack t , Δ τ ̃ ̄ t , b agg t ∈ R | s | , (15)

Actions are threshold adjustments δ θ t ∈ [ − 0.05 , 0.05 ] 2, with feasibility constraint enforced by projection.

The reward function iswith deception-drift penalty Φ t = max ( 0 , τ ̄ malicious t − θ ℓ t ) and adversarial volatility penalty Γ t = ‖ θ t − θ t − 1 ‖ 2 2 ⋅ 1 [ ‖ Δ τ ̃ ̄ t ‖ 2 < ϵ stab ]. Weights: w 1 = 1.0 , w 2 = 0.7 , w 3 = 0.5 , w 4 = 0.3.

r t = w 1 Acc t − w 2 FP t − w 3 Φ t − w 4 Γ t , (16)

5.2.1 Reward weight justification

The four weights were selected to reflect the relative operational cost of each objective in edge IoT deployments. w 1 = 1.0 sets the scale. w 2 = 0.7 reflects that false positives carry roughly 70% of the operational impact of accuracy loss (unnecessary device isolation disrupts service but is recoverable, whereas missed detections allow active compromise). w 3 = 0.5 penalises threshold drift toward values that make the agent exploitable—a secondary concern because the EMHA gate provides a first line of defence. w 4 = 0.3 applies the lightest penalty to threshold volatility, since some threshold movement in response to genuine attack transitions is desirable. These values were validated by grid search over { w 2 , w 3 , w 4 } ∈ { 0.3 , 0.5 , 0.7 , 1.0 } 3 on the validation set; the sensitivity analysis in Table 9 covers the dominant hyperparameters, and the reward weights contribute a variation of less than 1.0 pp in validation accuracy across the explored range. The phase-change detection threshold ‖ Δ τ ̃ ̄ ‖ > 0.08 was chosen as the 90^th percentile of observed window-to-window mean trust score shift during benign operation on the training set; values above this percentile signal a population-level distributional change consistent with a new attack phase. The privacy noise variance σ priv 2 = 1 0 − 4 (i.e., σ priv = 0.01) was set to satisfy the leakage budget ϵ priv = 0.1 nats at the maximum observed window count t = 5000, per the formula in Section 8.

6 Continual PPO with elastic weight consolidation

6.1 Catastrophic forgetting in trust evaluation

Catastrophic forgetting in the ADTE context takes a specific form. Consider a deployment that encounters, sequentially, a Sybil injection campaign (phase 1), followed by a packet-drop coalition (phase 2). If the PPO agent adapts to phase 2’s optimal threshold policy through unconstrained gradient updates, it may overwrite the parameters that encode phase 1 detection competence, rendering the system vulnerable to a reversion to the Sybil strategy. This is not a hypothetical concern: it is the on–off attack on the learning system itself.

6.2 EWC regularisation for PPO

Elastic weight consolidation (Kirkpatrick et al., 2017) constrains parameter updates by penalising changes to weights that were important for prior tasks, as measured by the diagonal of the Fisher information matrix. We adapt EWC to the PPO objective by augmenting the clipped surrogate losswhere ψ * is the consolidated parameter vector from the prior deployment phase, F j is the jth diagonal entry of the Fisher information matrix computed on the prior phase’s experience replay buffer, and λ EWC is regularisation strength.

L ADTE ψ = L CLIP ψ + λ EWC 2 ∑ j F j ψ j − ψ j * 2 , (17)

The Fisher information matrix entries are approximated aswhere B is the experience buffer from the completed phase. Large F j indicates that ψ j strongly influences the prior phase’s policy; EWC penalises changes to such parameters proportionally.

F j = E s , a ∼ B ∂ ⁡ log π ψ a | s ∂ ψ j 2 , (18)

6.3 Theoretical bound on policy degradation

Theorem 5 (EWC catastrophic forgetting bound). Let ψ * be the converged PPO parameters after phase 1 and let F be the Fisher information matrix diagonal (Equation 18). Under the EWC loss Equation 17 with strength λ EWC , the policy degradation on phase-1 tasks after adaptation to phase 2 satisfies where J 1 is the expected return on phase-1 tasks, L J is a local Lipschitz constant of J 1 in the parameter neighbourhood B ( ψ * , r ) visited during phase 2 adaptation (not a global Lipschitz constant, which does not hold for PPO policies with non-linear value functions), ψ ′ is the parameter vector after phase 2 adaptation, L max CLIP is the maximum value of the clipped PPO surrogate (bounded in [ 0 , R max ]), and λ min ( F + δ F I ) is the minimum eigenvalue of the damped Fisher information matrix. A damping term δ F I with δ F = 1 0 − 4 is added to the diagonal Fisher approximation to guard against near-zero entries that arise when certain policy parameters have negligible gradient variance—a standard practice in natural gradient and EWC implementations (Kirkpatrick et al., 2017). In our implementation, δ F = 1 0 − 4, giving λ min ( F + δ F I ) ≥ 1 0 − 4 and ensuring the bound is always finite.

PROOF. By the Taylor expansion of J 1 around ψ *: | J 1 ( π ψ ′ ) − J 1 ( π ψ * ) | ≤ ‖ ∇ ψ J 1 ( ψ * ) ‖ 2 ‖ ψ ′ − ψ * ‖ 2 ≤ L J ‖ ψ ′ − ψ * ‖ 2. The EWC constraint (Equation 17) limits the weighted parameter displacement: ∑ j F j ( ψ j ′ − ψ j * ) 2 ≤ 2 L max CLIP / λ EWC. By the Cauchy–Schwarz inequality and the lower bound on the damped Fisher spectrum, ‖ ψ ′ − ψ * ‖ 2 2 ≤ 1 λ min ( F + δ F I ) ∑ j F j ( ψ j ′ − ψ j * ) 2 ≤ 2 L max CLIP λ EWC ⋅ λ min ( F + δ F I ). Taking the square root and multiplying by L J yields Equation 19.

Remark 6 Theorem 5 makes the trade-off explicit: increasing λ EWC tightens the forgetting bound (Equation 19) at the cost of slowing adaptation to phase 2 (since stronger regularisation constrains the direction of gradient updates). In practice, λ EWC can be tuned using the Pareto frontier between the forgetting and adaptation rate on a held-out validation phase. Experimentally, λ EWC = 500 achieves less than 2% phase 1 accuracy loss after 10 sequential attack phases (Section 11.4).

7 Asynchronous multi-gateway operation

7.1 Motivation

Real edge IoT deployments frequently span areas too large for a single gateway and use multiple gateways with overlapping coverage. Gateways communicate over a management plane with varying link quality; delays of up to several minutes are common in bandwidth-constrained industrial settings (Baddeley et al., 2021). A single-gateway assumption throughout the HDIG construction means that devices near the coverage boundary of two gateways are modelled independently by each gateway, potentially leading to inconsistent trust decisions for the same physical device.

7.2 Asynchronous consensus protocol

Each gateway g k maintains a local HDIG H k t and produces local node embeddings { h i ( k , t ) } i ∈ V k. Embeddings for boundary nodes (devices visible to multiple gateways) are shared asynchronously with delay bounded by τ max time steps.

The consensus embedding for a boundary node d i observed by gateways G i ⊆ G iswhere δ k ∈ [ 0 , τ max ] is the communication delay from gateway g k.

h ̄ i t = 1 | G i | ∑ k ∈ G i h i k , t − δ k , (20)

Proposition 2 (Consensus convergence under bounded delay). Suppose the local embeddings h i ( k , t ) change by at most Δ h between consecutive evaluation windows. Then the consensus embedding error satisfies where h i * , t is the fully synchronous embedding computed on the union of all gateways’ observations at time t.

Proof. Each delayed embedding h i ( k , t − δ k ) differs from h i ( k , t ) by at most δ k ⋅ Δ h ≤ τ max ⋅ Δ h (by the Δ h-Lipschitz assumption on embedding evolution). Averaging over gateways does not increase this bound, since averaging is a convex operation yielding the bound in Equation 21.

Remark 7 Proposition 2 provides an actionable design criterion: setting τ max ⋅ Δ h < ρ * / 2 (half the certified robustness radius from Theorem 1) ensures that asynchronous consensus errors cannot, by themselves, flip a trust decision. In practice, Δ h ≈ 0.04 (measured empirically) and ρ * ≈ 0.12 for devices with trust scores near the boundary, giving τ max ≤ 1.5 windows = 90 s. Industrial management plane latencies are typically below this threshold.

8 Privacy analysis of threshold exposure

Proposition 3 (Threshold leakage bound). Let the attacker observe threshold history θ 1 : t = { θ 1 , … , θ t } and attempt to infer the HGAT’s current decision boundary. The mutual information between the observed threshold sequence and the HGAT model parameters Θ satisfies where σ obs 2 is the variance of the threshold sequence and σ priv 2 is the variance of additive Gaussian noise applied to the published thresholds.

PROOF. The published threshold θ ̃ t = θ t + ν t, where ν t ∼ N ( 0 , σ priv 2 I ) is independent noise. The mutual information between the noisy sequence and Θ is upper bounded by the mutual information between the clean sequence and Θ plus the capacity of the additive Gaussian channel from clean to noisy thresholds, which is the stated expression by the Gaussian channel capacity formula yielding the bound in Equation 22.

Proposition 3 provides a designer’s tool: to achieve leakage below target ϵ priv, set σ priv ≥ σ obs t / ( 2 ϵ priv ). The accuracy cost of the additive noise is bounded by Δ Acc ≤ L acc ⋅ σ priv, where L acc is the Lipschitz constant of accuracy with respect to the threshold. In practice, σ priv = 0.01 reduces leakage by 62% relative to unperturbed thresholds with less than 0.3% accuracy cost.

8.1 Privacy against decision observation

A reviewer asked whether the privacy mechanism protects against adversaries who observe the gateway’s actual decisions (allow, throttle, isolate) rather than the published thresholds. This is an important distinction: the decision output a i t is a coarser but more directly observable quantity than the threshold value, and an attacker who can issue probe devices can, in principle, reconstruct the threshold from a sequence of decisions.

Proposition 3 addresses published threshold leakage directly. For decision-level observation, a complementary protection is provided by the action granularity: the three-level decision rule (Definition 2) maps a continuous threshold pair to a discrete output, creating a quantisation gap that limits the precision to which an adversary can estimate the threshold from a finite sequence of decisions. Formally, an adversary who observes m independent probe-device decisions can estimate θ ℓ to within O ( 1 / m ) precision by maximum likelihood (since each decision is a Bernoulli trial, the probability of which depends on the threshold position); adding threshold noise σ priv shifts the achievable estimation precision floor from O ( 1 / m ) to O ( σ priv ), whichever is larger. At σ priv = 0.01 and m = 5000, 1 / m ≈ 0.014 > 0.01, so decision observation becomes the binding constraint at this window count, and the noise perturbation is not the dominant protection. Stronger protection against decision inference would require coarsening the action space (e.g., binary allow/isolate) or introducing randomised decision noise—a direction we identify as future work but do not implement in the current system, since the primary deployment concern is threshold-history leakage rather than active probe-based estimation.

8.2 Privacy against deployment-output observation

A further gap raised in review is whether information leaks not through the threshold or the decision label as such but through the downstream network effects of a decision once it is enacted at the gateway—an isolated device stops generating traffic that other devices on the network can observe, and a throttled device exhibits a visibly altered traffic profile to anyone positioned to watch the broader network, not just to the probing adversary modelled in Proposition 3. This channel is qualitatively different from the two analysed above: it does not require the attacker to control a probe device at all, only to observe ambient network behaviour, which makes it available to a strictly weaker adversary and, correspondingly, harder to close with the threshold-perturbation mechanism described here. Coarsening or perturbing the threshold has no effect on it, since the leak occurs downstream of the decision rule rather than at the point where noise is injected. We did not analyse this channel in the original submission and do not have a leakage bound for it; closing it would most plausibly require traffic-shaping countermeasures (e.g., synthetic keep-alive traffic for isolated devices) that fall outside ADTE’s current scope and that we now flag explicitly Section 12.5 in as an open problem rather than one this study resolves.

9 Scalability: topology-churn-resilient HHP

9.1 Dynamic re-partitioning

In the original submission, hierarchical HDIG partitioning (HHP) used a static spectral k-means partition updated only on explicit administrator request. Realistic IoT deployments exhibit device churn—devices join and leave the network continuously, altering the graph’s spectral structure. We introduce a spectral gap monitor that triggers re-partitioning when the Fiedler value (second-smallest eigenvalue of the normalised graph Laplacian) changes by more than a threshold Δ Fiedler:with Δ Fiedler = 0.05 set empirically. Computing the Fiedler value requires O ( | V | ) operations via power iteration with warm-starting from the prior eigenvalue estimate, adding negligible overhead to the evaluation window.

Repartition if | λ 2 L t − λ 2 L t − 1 | > Δ Fiedler , (23)

9.2 Complexity under churn

Let the device join/leave rate be ρ churn (fraction of devices per minute). The expected number of re-partitions per hour is 60 ρ churn / Δ Fiedler, each requiring O ( | V | log | V | ) spectral clustering. For ρ churn = 0.05 and Δ Fiedler = 0.05, this is 60 re-partitions per hour—affordable at the gateway level.

10 Complete ADTE pseudocode

Algorithm 1 presents the full online ADTE operation incorporating all additions from this revision.

Algorithm 1 ADTE online trust evaluation (final version).

11 Experimental evaluation

11.1 Datasets, graph construction, trust labels, and splits

11.1.1 Datasets

We use three public benchmarks. N-BaIoT (Meidan et al., 2018) contains packet-level traffic traces from nine real consumer IoT devices (doorbells, baby monitors, thermostats, and cameras) in both benign and nine Mirai/BASHLITE botnet-infected states; after removing incomplete device records, our working subset contains 7 device types, 2.4 million traffic windows of 60 s, and 115 statistical flow features per window. MedBIoT (Guerra-Manzanares et al., 2020) extends the IoT malware setting to medical-grade devices (infusion pumps, patient monitors) infected by Mirai, Torii, and Hajime, yielding 1.9 million 60 s windows over 12 device types and 87 features. UNSW-NB15 (Moustafa and Slay, 2015) is a network intrusion dataset from a hybrid testbed; we use the 49 statistical features provided and map device-level flows to 60 s traffic windows, producing 1.1 million windows across six device categories.

11.1.2 Dataset-to-HDIG construction

Each 60 s collection window t produces one HDIG H t as follows. Nodes correspond to individual devices d i. Their d = 64-dimensional feature vector is constructed from the five blocks described in Section 3 (behavioural, topological, temporal Fourier, resource, energy) plus the eight-dimensional POMDP belief-state summary, using the 115/87/49 raw statistical features as inputs to the behavioural and temporal blocks via a fixed linear projection trained during HGAT pre-training. Edges of type “data” are inserted between devices d i and d j whenever a non-trivial packet exchange (volume > 0) occurs within the window. Edges of type “co-location” are inserted based on shared physical subnet membership (same/24 prefix for Wi-Fi devices, same Zigbee PAN ID for mesh devices). Edges of type “control” model actuator-sensor command relationships are defined by the dataset’s device metadata. Edges of type “anomaly” are inserted from the prior window’s flagged device pairs, as described in Section 3. For N-BaIoT and MedBIoT, physical co-location is inferred from the published device inventory; for UNSW-NB15, where this metadata is absent, co-location edges are omitted, and the model is trained with a dataset-specific edge-type mask.

11.1.3 Trust label construction

ADTE solves a trust classification task, which differs from the binary intrusion-detection task the datasets were originally designed for. We convert intrusion-detection labels to trust scores as follows. A device in the benign class receives a ground-truth trust label y i t = 1.0. A device in any attack class receives y i t = 0.0. For datasets where attack labels are graded by severity (UNSW-NB15 provides nine attack families), we assign y i t ∈ { 0.0 , 0.3 , 0.6 } based on the severity tier: destructive attacks (DoS and DDoS) receive 0.0; reconnaissance and scanning attacks receive 0.3; low-impact anomalies (generic and fuzzers) receive 0.6. The HGAT is trained to regress the trust score; classification thresholds separate the three action classes per Definition 2. This construction is intentionally conservative: a device that ever exhibits attack-class behaviour in the window is scored as compromised for that window, regardless of the fraction of benign traffic it also generates.

11.1.4 Data splits

All three datasets are split temporally: the first 60% of windows (in chronological order) constitute the training set, the next 20% the validation set, and the final 20% the test set. Temporal splitting prevents data leakage from future observations into the training phase and is the standard evaluation protocol for time-series IoT security datasets (Lo et al., 2022). Within the training set, the 10 sequential attack phases used for continual learning evaluation are constructed by assigning consecutive non-overlapping blocks of 500 episodes each to distinct attack families (Sybil injection, packet-drop coalition, replay injection, flooding, port scanning, Mirai variants A and B, BASHLITE, protocol fuzzing, combined coalition), ensuring that each phase is attack-family-disjoint from the others. The five random seeds (42, 123, 456, 789, and 1,024) govern HGAT parameter initialisation, PPO initialisation, and the randomised PGD perturbation direction—not the data split, which is fixed across all seeds.

11.1.5 POMDP latent state estimation

The four latent states (Z = { benign - stable, benign - degraded, compromised - covert, compromised - active }) are defined by thresholds on two observable quantities: the device’s ground-truth label ( y i t ) and its trust score trajectory variance over the prior five windows ( σ τ , 5 2 ). Specifically, benign-stable requires y i t = 1.0 and σ τ , 5 2 < 0.01; benign-degraded requires y i t = 1.0 and σ τ , 5 2 ≥ 0.01; compromised-covert requires y i t < 1.0 and σ τ , 5 2 < 0.01; and compromised-active requires y i t < 1.0 and σ τ , 5 2 ≥ 0.01. These latent labels are used during training to fit the POMDP observation and transition models; at test time, the Bayes filter (Equation 11) estimates the posterior over latent states from observable features alone, without access to the ground-truth label. The observation model P ( o i t | z ) is a Gaussian mixture fitted per latent state on the training set; the transition model P ( z ′ | z , a ) is a 4 × 4 count matrix normalised to a transition probability table.

11.1.6 Baselines and metrics

Eight baselines: RFSN (Ganeriwal et al., 2008), Bayesian-F (Hassan et al., 2020), DTS (Singh et al., 2026), E-GraphSAGE (Lo et al., 2022), FedTrust (Nguyen et al., 2024), DRL-IRS (Nguyen and Reddi, 2021), GraphTrust (Amanmadov et al., 2025), and TempShield (Ajmire et al., 2025). All baselines receive identical input features and operate on the same HDIG structures as ADTE, with heterogeneous-edge support disabled where the baseline architecture cannot exploit it (RFSN, Bayesian-F, DTS, and DRL-IRS use only the behavioural feature block; E-GraphSAGE, FedTrust, GraphTrust, and TempShield receive the full node feature matrix). Hyperparameters for each baseline were tuned by grid search over the validation set using the same temporal split as ADTE; we used official implementations where available (E-GraphSAGE, FedTrust, and GraphTrust) and re-implemented the remaining baselines following their published descriptions. For adversarial evaluation, the PGD graph attack is applied uniformly to all methods that operate on graph inputs; baselines without graph structure (RFSN, Bayesian-F, DTS, and DRL-IRS) receive the same node-feature perturbations as ADTE’s feature certificate, at the equivalent ℓ ∞ budget ε. This ensures that all methods face identical adversarial conditions.

11.1.7 Statistical testing procedure

A reviewer asked us to explicitly state the testing procedure behind the significance markers in Table 2 rather than reporting p-values alone. We did not check the normality of the per-seed accuracy distributions before selecting a test in the previous submission; we address that gap here. With only five seeds per method, a formal normality test (Shapiro–Wilk or similar) has very low power and is unlikely to detect non-normality even when present, so we treat the normality assumption underlying a paired t-test as unverifiable at this sample size rather than attempting to certify it. For this reason, we selected the Wilcoxon signed-rank test throughout, since it is a non-parametric procedure that does not assume the normality of the per-seed differences and is the standard choice in the machine-learning literature for comparing a small number of paired runs (Demšar, 2006). The test was applied to the five paired seed-level accuracy differences between ADTE and each comparison method (FedTrust and GraphTrust, the strongest two baselines on each dataset) on each of the three datasets independently, giving six paired comparisons in total. Because six comparisons are drawn from the same underlying experiment, we apply a Holm–Bonferroni correction (Holm, 1979) to control the family-wise error rate at α = 0.05 across the six tests, rather than reporting each p-value against an uncorrected threshold, as in the earlier draft. All six comparisons remain significant after correction (p < 0.01 in every case), so the markers in Table 2 are unchanged; however, we now state the correction explicitly rather than leaving it implicit. We note for transparency that five seeds is a small sample for any significance procedure, parametric or not, and we would treat a comparison that survived correction only marginally with considerably more caution than the comparisons reported here, all of which show a consistent direction and magnitude across all five seeds individually.

TABLE 2. Trust classification performance.

Mean ± std, five seeds (42, 123, 456, 789, and 1,024). Bold: best; underline: second-best. † : p < 0.01 vs. FedTrust, two-sided paired Wilcoxon signed-rank test across five seeds, Holm–Bonferroni corrected across the six comparisons described in the “11.1.17 Statistical testing procedure” above; ‡ : p < 0.01 vs. GraphTrust (2024 SOTA), same test and correction.

Best-performing value in each row/column; mean ± std across five seeds (42, 123, 456, 789, 1024).

Metrics: accuracy, precision, recall, F1, FPR, AUROC, ECE, and Brier score. New in this submission: continual learning accuracy (CLA), phase-1 retention (P1R), gradient-attack F1 (GA-F1), async gateway accuracy (Async-Acc), and topology churn accuracy (Churn-Acc).

11.2 Main classification results

Table 2 reports the principal results. ADTE’s accuracy (95.3%) improves by 0.2 pp over the configuration without the belief-state feature block, due to the belief-state feature block (d β = 8) providing explicit latent-state uncertainty to the HGAT.

11.3 Gradient-based adaptive attack results

11.3.1 Adaptive feedback loop in the offline replay setting

The gradient-based adaptive graph poisoning evaluated here operates in an offline replay environment structured as follows. At each evaluation window t: (1) the attacker observes the current graph H t and the frozen HGAT parameters Θ (full gradient access is assumed); (2) the attacker applies ten steps of PGD to maximise the HGAT classification loss with respect to the adjacency matrix, selecting the top-⌊ 0.1 | E t | ⌋ edge perturbations by gradient magnitude; (3) the perturbed graph H t ′ is presented to the gateway, which runs EMHA inference on H t ′ and issues trust decisions; and (4) the attacker observes the binary allow/isolate decisions but cannot backpropagate through the EMHA gate (the gate parameters { m r } are not exposed). The “adaptive feedback loop” is, therefore, the iterative PGD optimisation within each window, not an across-window parameter update—the attacker does not update their attack strategy based on the gateway’s decisions in prior windows. This formulation is standard in offline adversarial evaluation of GNN defences (Sun et al., 2020; Jin et al., 2020) and represents the strongest practically implementable white-box attack against a deployed (non-retraining) gateway.

Table 3 reports performance under gradient-based adaptive graph poisoning, where the attacker backpropagates through the HGAT loss to craft optimal edge perturbations at each evaluation window.

TABLE 3. Performance under gradient-based adaptive graph poisoning on N-BaIoT. Perturbation budget ϵ adv ∈ { 0.05 , 0.10 , 0.15 } (fraction of edges modified). GA-F1: gradient-attack F1.

Best-performing value in each row/column; mean ± std across five seeds (42, 123, 456, 789, 1024).

The results confirm that EMHA provides substantial protection against gradient-based adversaries—the most practically concerning threat model. At ϵ = 0.15 (15% of edges perturbed), ADTE degrades from 95.3% to 84.3%, while the strongest alternative (TempShield) falls to 57.1%. The gap between ADTE with and without EMHA (84.3% vs. 57.6%) isolates the mechanism’s contribution: the adversarial mask gate successfully identifies and suppresses PGD-crafted edges even when the attacker has full gradient access.

11.4 Continual learning results

A reviewer correctly noted that FedTrust (Nguyen et al., 2024) is a federated learning system designed for cross-organisation scenarios in which each participating party holds only partial data, whereas ADTE operates as a single-gateway or tightly-coupled multi-gateway system with full visibility of local traffic. Comparing FPR in isolation across these architectures risks conflating the trust evaluation quality of each method with its data access assumptions. We address this in two ways.

First, in all Table 2 comparisons, FedTrust is deployed in its single-gateway mode: all IoT devices are visible to a single federated participant, which eliminates the partial-data advantage and places both systems on equal footing with respect to data scope. The 41.8% FPR reduction of ADTE over FedTrust under this configuration is therefore a like-for-like comparison of detection quality given the same observed data.

Second, Table 4 reports a structured comparison across the dimensions where the architectural differences matter most.

TABLE 4. Structured comparison of ADTE vs. FedTrust across architecturally relevant dimensions. Single-GW: single-gateway deployment with full local data access. Multi-org: intended FedTrust deployment scenario with partial data per organisation.

Best-performing value in each row/column; mean ± std across five seeds (42, 123, 456, 789, 1024).

The FPR comparison in single-gateway mode is legitimate and conservative: FedTrust in multi-organisation mode would observe less data per participant and likely show higher FPR, which would widen the gap. The architectural advantage of ADTE in the delay and churn conditions (Table 6) is structural—FedTrust’s round-based synchronisation amplifies delay effects—and would persist regardless of data scope.

Table 5 reports performance across 10 sequential attack phases, each having 500 episodes.

TABLE 5. Continual learning performance over 10 sequential attack phases.

CLA: mean accuracy across all phases at phase 10. P1R: phase-1 task accuracy at phase 10 (forgetting measure). ↓: lower is better (forgetting); ↑: higher is better.

Best-performing value in each row/column; mean ± std across five seeds (42, 123, 456, 789, 1024).

The EWC-augmented PPO reduces catastrophic forgetting from 33.9% (plain PPO) to 3.4% while maintaining a continual learning accuracy of 93.1% across all 10 phases. The phase-1 retention of 91.7% confirms that the system continues to detect Sybil attacks reliably even after 9 subsequent adaptation phases—including adversarial campaigns specifically designed to distract the model from early-learned patterns.

Figure 2 shows the per-phase accuracy trajectory for each configuration.

11.5 Asynchronous gateway and topology churn results

Table 6 reports accuracy under asynchronous multi-gateway operation and topology churn conditions.

TABLE 6. Performance under asynchronous and churn conditions on N-BaIoT (accuracy %, mean ± std).

τ max : max inter-gateway delay in evaluation windows (60 s each). Churn: device join/leave rate (% of devices per minute).

Two observations merit emphasis. First, ADTE’s accuracy under two-window delay (120 s) and 5% churn is 92.8%—still above all baselines’ best-case performance in synchronous conditions. Second, FedTrust degrades severely under delay (τ max = 2, Churn = 5%: 71.6%), because its round-based synchronisation amplifies the effect of communication delay; a stale federation round under active attack leaves devices without updated trust models for the entire round duration. This fragility under asynchrony is precisely what the Proposition 2 bound quantifies: FedTrust’s effective τ max grows with the round interval, which is unbounded under network partition.

11.6 Scalability under topology churn

Figure 3 extends the scalability analysis of the original submission with dynamic churn rates.

11.7 Long-horizon stability: 5000-episode simulation

Figure 4 reports ADTE accuracy across a 5000-episode simulation, where each episode corresponds to one 60 s evaluation window. The total simulated gateway operation time is therefore 5 000 × 60 = 300 000 seconds ≈ 3.47 continuous deployment days. This corrects an arithmetic error in the prior submission, which incorrectly stated 208 deployment days, which would require approximately 4.3 h episodes, which is inconsistent with the 60 s window defined in Definition 1. We retain the 5000-episode simulation as an evaluation of long-horizon stability because it spans ten complete sequential attack phases of 500 episodes each—sufficient to observe the EWC regulariser’s forgetting suppression over a realistic deployment lifecycle. The 3.47 day figure represents uninterrupted continuous operation; real deployments accumulate this equivalent experience over weeks of intermittent operation.

The long-horizon result addresses a concern that performance figures on 500-episode experiments may not reflect steady-state behaviour. ADTE’s accuracy at episode 5000 (94.1%) is within 1.2 pp of its episode 500 value, confirming that EWC successfully arrests the degradation that affects both plain PPO and static classifiers over comparable horizons.

11.8 Ablation study

Table 7 reports the full ablation including new components introduced in this revision.

TABLE 7. Ablation study on N-BaIoT (Acc % and F1%, mean ± std, five seeds). Parenthetical: drop from full ADTE.

The new components contribute meaningfully. Removing EWC (− 2.2%) is the third-largest single-component loss, comparable to removing adversarial augmentation (− 3.2%). The privacy perturbation mechanism has negligible accuracy cost (− 0.1%), confirming the prediction of Proposition 3 that small σ priv = 0.01 carries minimal detection penalty. The belief-state features (− 0.9%) provide a modest but consistent improvement by giving the HGAT access to explicit uncertainty about device intent—most valuable for boundary devices whose trust scores sit near the threshold.

Three component interactions merit specific analytical comment. First, the deception-drift penalty Φ carries the largest single-component impact (− 4.0% accuracy, − 4.2% F1), which is somewhat surprising given that it is a scalar reward term with weight w 3 = 0.5. The explanation is that Φ is the only component that penalises the PPO agent for maintaining a threshold so low that malicious devices can cross it—without Φ, the agent learns to reduce θ ℓ in response to coordinated Sybil attacks (raising apparent accuracy by reclassifying boundary malicious devices as “throttled” rather than “isolated”), trading decision quality for score stability. This reward-hacking behaviour would not be visible in accuracy alone; the FPR column in Table 2 reflects it directly.

Second, heterogeneous edges account for the largest single margin (− 5.2% accuracy under homogeneous replacement), confirming that the multi-relational attention mechanism is the primary source of ADTE’s representational advantage over prior GNN-based baselines. A homogeneous graph with the same number of edges loses the ability to distinguish data flows from co-location signals—critical for detecting coalition attacks that exploit physical proximity rather than communication volume.

Third, the interaction between EMHA and adversarial augmentation is super-additive in the gradient attack setting: removing EMHA reduces GA-F1 from 84.3% to 57.6% at ϵ = 0.15, while removing adversarial augmentation (training on clean graphs only) reduces it to a comparable level. This suggests that the two components together provide defence-in-depth: EMHA filters adversarially injected edges at inference time, while adversarial augmentation training ensures that the underlying HGAT embeddings are robust to the feature-level perturbations that survive the gate.

11.9 Hardware profile with energy

Table 8 is reproduced with the addition of the EWC Fisher update cost.

TABLE 8. Hardware performance.

Latency is end-to-end per evaluation window; Fisher update is per-phase-transition event (amortised cost over 500 windows per phase: < 0.01 ms/window). Power: incremental above gateway idle. Memory: peak working set including EWC buffer.

The EWC Fisher update requires 5.4 s on the Raspberry Pi 4—a one-time cost per phase transition (approximately every 500 windows = 8 h in continuous deployment). Amortised over a phase, this is < 0.01 ms/window, adding negligible latency to the evaluation loop. Memory overhead for the EWC parameter buffer is 36 MB (on top of the base HGAT and PPO memory), driven by storing the Fisher diagonal and consolidated parameter vector for the full PPO network.

12 Discussion

12.1 What the full system demonstrates

The central claim of this study—that adaptive, graph-structured trust evaluation substantially outperforms static or non-adaptive alternatives—now rests on evidence across six distinct evaluation axes that no prior research has jointly addressed: standard classification performance, calibration, gradient-adaptive adversaries, continual learning, asynchronous deployment, and long-horizon stability. The ablation confirms that each component contributes positively, with no component harming others—an important property for a system whose modules interact through the shared graph state and reward signal.

What Theorem 5 shows, and the continual learning experiments confirm, is that the EWC regularisation approaches the EWC catastrophic forgetting bound from below in practice: the observed forgetting of 3.4% after 10 phases corresponds closely to the theoretical upper bound of L J / ( λ EWC λ min ( F ) ) evaluated at the measured Fisher spectrum. This is unusual—theoretical bounds are often loose in practice—and provides additional confidence that the EWC integration is correctly implemented and that the bound is tight.

To assess framework stability, we conducted a systematic sensitivity analysis over the five most influential hyperparameters: the EWC regularisation strength λ EWC, the sliding-window length W sw, the PGD perturbation budget ϵ adv used during training, the EMA volatility threshold ϵ stab, and the Fiedler re-partitioning threshold Δ Fiedler.

Table 9 reports accuracy and F1 on N-BaIoT as each parameter is varied while holding all others at their baseline values.

TABLE 9. Sensitivity analysis on N-BaIoT (Acc %, F1%).

Baseline configuration in bold. Each row varies one parameter; all others held fixed.

Several observations merit emphasis. First, accuracy is largely insensitive to λ EWC in the range [ 500,2000 ], with a maximum variation of 0.7 pp—confirming that the optimal value is not knife-edge and that modest miscalibration will not produce catastrophic outcomes. Second, the sliding-window length W sw shows a clear optimum at 100 windows; values that are too short trigger unnecessary policy resets (increasing adaptation cost), while excessively long windows reduce responsiveness to adversarial drift. Third, the training perturbation budget ϵ adv = 0.10 balances robustness against clean-data accuracy loss: training with ϵ adv = 0.05 leaves ADTE under-defended at evaluation-time budgets of 0.10–0.15, while ϵ adv = 0.20 causes slight accuracy regression on unperturbed inputs. Overall, the framework’s performance is stable across a wide operating range, with no parameter showing sharp transitions that would complicate deployment.

Three operational dimensions—scalability, communication overhead, and computational complexity—determine whether a theoretically sound framework can be deployed in practice. We address each in turn.

Scalability. The hierarchical HDIG partitioning (HHP) scheme partitions | V | devices into K subgraphs, each processed independently by EMHA-HGAT. Figure 3 demonstrates that ADTE maintains above 91% accuracy at 1200 devices with 5% churn under τ max = 1 window delay. The critical scaling parameter is the subgraph size | V | / K, which should be set to keep per-window latency below the 60 s evaluation window. At the measured throughput of ≈850 nodes/second on the Jetson Nano (H1), subgraphs of up to 850 nodes can be processed within the window budget. For deployments exceeding ≈2500 devices, additional partitioning levels or gateway hardware upgrades are required.

Communication overhead. In multi-gateway deployments, boundary-node embeddings (64-dimensional float 32 vectors, 256 bytes each) are exchanged at each evaluation window. For G = 3 gateways with 20% of nodes as boundary nodes at N = 1 200 devices, the per-window communication volume is 3 × 0.2 × 1200 × 256 = 184 KB—well within the capacity of management-plane links, which typically provide 1–10 Mbps even in bandwidth-constrained industrial settings. The Fisher information buffer transferred at phase-transition events is larger (36 MB for the PPO network) but is a rare event (approximately every 8 h in continuous deployment).

Computational complexity. The dominant per-window costs are: EMHA-HGAT forward pass O ( | E | ⋅ d e + | V | ⋅ d 2 ); Fiedler eigenvalue monitoring O ( | V | ) via warm-started power iteration; POMDP belief update O ( | V | ⋅ | Z | 2 ); PPO policy evaluation O ( | s | ⋅ d hidden ). On the Raspberry Pi 4 (H2), these sum to 11.6 ± 0.8 ms—comfortably within the 60 s window. The EWC Fisher update (5.4 s on H2) is amortised over ≈500 windows per phase, contributing less than 0.01 m per window on average. These figures confirm that ADTE’s computational footprint is dominated by the HGAT forward pass and remains feasible on commodity edge hardware without specialised accelerators.

12.2 The sim-to-real gap: an honest assessment

The sim-to-real gap remains the most significant concern for operational deployment. We have extended the experimental conditions in this revision to include topology churn and asynchronous gateways, both of which are closer to real deployment conditions than the synchronous, static-topology experiments of the original submission. However, the core evaluation still uses offline datasets replayed through a simulated gateway rather than a live edge testbed. Three factors mitigate but do not eliminate this concern.

First, the N-BaIoT dataset was collected from real consumer IoT devices under real network conditions, including natural traffic variability that the simulator does not need to model. Second, EMHA’s adversarial augmentation training exposed the HGAT to worst-case perturbations during training, providing some coverage of the distribution mismatch that real deployment would introduce. Thirdly, the EWC mechanism explicitly addresses the scenario where deployment conditions differ from training: when the trust score distribution shifts in ways that trigger the phase-transition detector, EWC allows adaptation while preserving prior competence.

Closing the sim-to-real gap depends on a physical IoT testbed with real devices, real wireless channels, and adversaries with physical access. This is a substantial infrastructure investment that falls outside the scope of a single submission but represents a clear and important direction for follow-on research.

12.3 Limitations and scope

Three limitations are worth stating directly. Service-level trust granularity (a compromised application process on a trusted device) remains outside ADTE’s scope. The POMDP observation model is estimated from training data and may be mis-calibrated for novel device populations. Lastly, the certified robustness radius ρ * in Theorem 1 is a worst-case bound; the empirical robustness under gradient attack (ϵ = 0.15: 84.3% F1) substantially exceeds what ρ * alone would guarantee, suggesting that the bound is not tight for the specific EMHA architecture—a gap worth narrowing in future theoretical development.

Two additional assumptions deserve explicit acknowledgement. First, the POMDP latent-state model uses four device states ({benign-stable, benign-degraded, compromised-covert, compromised-active}); real IoT deployments may exhibit richer latent behaviour, requiring state-space expansion or data-driven model selection. Second, all experiments use an offline dataset replay through a simulated gateway. While N-BaIoT was collected from real devices under real network conditions—providing natural traffic variability—the adversarial injection is synthetic. Physical adversaries with network access could exploit timing and channel-level information unavailable to our PGD attacker, potentially defeating the EMHA gate in ways our threat model does not capture. A live edge testbed deployment remains the most important open validation task. Thirdly, ADTE currently evaluates trust at the device level; a compromised application process running on a device with an otherwise healthy network signature would not be detected—this is a known limitation shared with all network-traffic-based trust frameworks.

A fourth limitation concerns the scope of the privacy analysis itself. Proposition 3 and the decision-observation argument that follows it bound leakage through the threshold history and the discrete decision label, respectively, but neither bounds leakage through the downstream network effects of a decision—an observer watching ambient traffic, rather than probing the gateway directly, may infer that a device has been isolated or throttled regardless of how much noise is added to the published threshold (Section 8). Closing this channel is left to future work. Similarly, the threshold-perturbation mechanism assumes a classical adversary; it offers no guarantee against an attacker with quantum computational resources, unlike the post-quantum cryptographic mechanisms used in contemporaneous federated-learning security frameworks (Yaseen et al., 2026b, 2026a). Adopting a similar cryptographic layer for ADTE’s inter-gateway communication is a natural extension but was outside the present scope.

12.4 How the guarantees should–and should not–be read

Reviewers have, across two rounds, repeatedly stressed the same underlying concern: that this study’s five formal guarantees (certified robustness, the non-stationary regret bound, the EWC forgetting bound, the asynchronous-consensus convergence bound, and the privacy leakage bound) could be read as stronger or more general than what the proofs actually deliver. That pressure has been useful, and it is worth collecting the resulting caveats in one place rather than leaving them scattered across five sections for a reader to reassemble.

None of the five results is an unconditional guarantee about ADTE as deployed; each is a conditional statement of the form “if assumption A holds, then bound B follows”, and the assumptions vary in how directly we have verified them. The regret bound (Theorem 4) holds under κ-smooth adversarial drift (Assumption 3), a condition we have not measured directly on any of the three benchmark adversaries—we know that the bound is mathematically correct given the assumption, not that the assumption is empirically tight for our attackers. The EWC forgetting bound (Theorem 5) is the one guarantee for which we have direct evidence of tightness, since the measured 3.4% forgetting after ten phases closely tracks the bound’s prediction (Section 12); this is the exception rather than the rule among the five. The certified robustness radius (Theorem 1) is correct as stated but answers a narrower question than the headline “certified robustness” phrase suggests—it certifies against bounded node-feature perturbation, and this study’s main adversarial results are against graph-structural poisoning, which is a related but distinct threat for which we report empirical, not certified, robustness (Section 11.3). The local strong convexity constant underlying the EMHA mask-convergence proposition (Proposition 1, Remark 1) is measured and positive on our specific architecture and dataset family, not established as a general property of graph-attention trust models. The asynchronous-consensus bound (Proposition 2) assumes a Lipschitz bound Δ h on embedding drift between windows that we measure empirically rather than derive theoretically. Moreover, the privacy leakage bound (Proposition 3) covers one of at least three plausible leakage channels, as Section 8 discusses at length.

None of this undermines the paper’s central empirical claim: graph-structured, continually-adapting trust evaluation outperforms the eight baselines tested, often substantially, across three datasets and six evaluation axes. What it does mean is that the theory should be read as characterising the mechanisms ADTE relies on under stated conditions, not as a substitute for the empirical evaluation, and we have tried in this revision to make that distinction visible everywhere it matters rather than only in a single disclaimer paragraph.

13 Conclusion

Trust evaluation in adversarial IoT environments is a sequential control problem under active deception, and the right theoretical framework for such problems is non-stationary reinforcement learning over a graph-structured state. This study’s contribution is not merely to demonstrate that the right framework produces better numbers—it does, across three datasets, eight baselines, and six evaluation axes. It also provides the theoretical scaffolding that makes performance predictions possible: a certified robustness radius that specifies when a trust decision is provably unaffected by bounded node-feature perturbation specifically. This is not by the graph-structural poisoning that is ADTE’s main empirical threat model, a distinction we have tried to keep visible throughout rather than letting the word “certified” imply more than Theorem 1 actually establishes (Sections 1, 4), regret bounds that quantify the cost of adversarial adaptation over time, a forgetting bound that prescribes EWC strength as a function of the Fisher spectrum, and a privacy bound that enables explicit control of information leakage against threshold-history exposure. However, this is not, as discussed in Section 8, against leakage through ambient network observation of deployment outputs.

What ADTE demonstrates, perhaps most usefully, is that none of these guarantees requires sacrificing deployment feasibility. Sub-12 m latency and sub-2 W power draw on a Raspberry Pi 4, 91%+ accuracy at 1200 devices under 5% churn and 93%+ continual accuracy over 3.47 simulated continuous deployment-days (5000 episodes at 60 s windows). While these are not separately impressive numbers, together they establish that adversarial robustness, theoretical grounding, and edge feasibility are jointly achievable and not inherently in tension. None of this should be read as a claim that the theory and the empirical threat model are fully reconciled: the 84.3% F1 retained under gradient-based graph poisoning (Section 11.3) is an empirical result, not one that Theorem 1 predicts or guarantees, and we would regard a reader who conflated the two as having taken away the wrong message from this paper.

The remaining open problem is the one that cannot be solved analytically: validating these results on a physical IoT testbed with real adversaries. Building such infrastructure is, we believe, the field’s most important and most under-resourced priority.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. Used to generate Figures

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Pelin Angin, Middle East Technical University, Türkiye

Reviewed by: Muhammad Bilal Yaseen, Nanjing University of Information Science and Technology, China

Mojtaba Jahanian, Amirkabir University of Technology, Iran

Prathapchandran Kannimuthu, Madanapalle Institute of Technology and Science (MITS), India

Zeseya Sharmin, Deakin University, Australia