2026
|
Elhajjout, A.; Houda, Z. A. E.; Moudoud, H.; Brik, B.; Jan, M. A. Federated Large Language Models for A Trustworthy and Privacy-Preserving Healthcare: Applications, Challenges, and Future Research Directions Article de journal Dans: IEEE Journal of Biomedical and Health Informatics, 2026, ISSN: 21682194 (ISSN). @article{elhajjoutFederatedLargeLanguage2026,
title = {Federated Large Language Models for A Trustworthy and Privacy-Preserving Healthcare: Applications, Challenges, and Future Research Directions},
author = {A. Elhajjout and Z. A. E. Houda and H. Moudoud and B. Brik and M. A. Jan},
url = {https://www.scopus.com/pages/publications/105034640126?origin=resultslist},
doi = {10.1109/JBHI.2026.3679612},
issn = {21682194 (ISSN)},
year = {2026},
date = {2026-01-01},
journal = {IEEE Journal of Biomedical and Health Informatics},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Large-scale foundation models, especially Federated Large Language Models (FLLMs), aim to transform digital health by enabling clinically-grade natural language processing while keeping sensitive data local. However, their adoption is hindered by two main issues: (i) the computational and communication burden of parameter-rich models on resource-constrained Internet-of-Medical-Things (IoMT) devices, and (ii) performance degradation caused by Non-Independent and Identically Distributed (Non-IID) patient data. This paper presents a comprehensive survey of Federated Learning (FL) for LLMs in Healthcare (FedMed-LLMs). We review the foundations of FL and medical LLMs. Then, we present the FL-enabled LLMs applications in healthcare, and we examine their issues in terms of privacy, robustness, and trustworthiness. Finally, we present a set of core research problems and a comprehensive research agenda that identifies future directions for building robust and scalable FedMed-LLMs systems. © 2013 IEEE.},
keywords = {},
pubstate = {published},
tppubtype = {article}
}
Large-scale foundation models, especially Federated Large Language Models (FLLMs), aim to transform digital health by enabling clinically-grade natural language processing while keeping sensitive data local. However, their adoption is hindered by two main issues: (i) the computational and communication burden of parameter-rich models on resource-constrained Internet-of-Medical-Things (IoMT) devices, and (ii) performance degradation caused by Non-Independent and Identically Distributed (Non-IID) patient data. This paper presents a comprehensive survey of Federated Learning (FL) for LLMs in Healthcare (FedMed-LLMs). We review the foundations of FL and medical LLMs. Then, we present the FL-enabled LLMs applications in healthcare, and we examine their issues in terms of privacy, robustness, and trustworthiness. Finally, we present a set of core research problems and a comprehensive research agenda that identifies future directions for building robust and scalable FedMed-LLMs systems. © 2013 IEEE. |
Malasi, J. -J. M.; Moudoud, H.; Missaoui, R. CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems Article d'actes Dans: Dig Tech Pap IEEE Int Conf Consum Electron, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 0747668X (ISSN); 979-833155343-2 (ISBN), (Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron). @inproceedings{malasiCausalGraphWhenCausal2026,
title = {CausalGraph: When Causal Reasoning Meets Large Language Models for Intrusion Detection Systems},
author = {J. -J. M. Malasi and H. Moudoud and R. Missaoui},
url = {https://www.scopus.com/pages/publications/105037367854?origin=resultslist},
doi = {10.1109/ICCE67443.2026.11449614},
isbn = {0747668X (ISSN); 979-833155343-2 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {Dig Tech Pap IEEE Int Conf Consum Electron},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Modern intrusion detection systems often achieve impressive benchmark accuracy yet fail in real-world deployment, where network behavior and attacker tactics continuously evolve. Under concept drift, decision boundaries learned offline can diverge from operational reality, triggering false-alarm cascades and creating detection blind spots that erode analyst trust. In this paper, we propose CausalGraph-IDS, a causal and language-model-assisted intrusion detection framework that moves beyond purely correlational scoring by explicitly verifying multi-stage attack chains. Additionally, we propose CHAIN-CRC, a unified algorithm that (i) learns a constrained attack-chain causal graph guided by knowledge-based priors derived from widely used adversary behavior taxonomies, (ii) computes robustness scores by testing whether alarms persist under feasible counterfactual security interventions, and (iii) applies conformal risk control to enforce operator-defined false-positive budgets with finite-sample guarantees.Generative models are integrated in strictly assistive roles through three modules: prior induction to distill causal constraints from unstructured threat reports, counterfactual generation to propose realistic and operationally feasible interventions, and causal logic justification to produce human-readable explanations grounded in the learned attack chain. Experiments on two widely used network intrusion detection benchmarks show that CausalGraph-IDS provides robust, explainable, and risk-governed detection, maintaining strong recall at low false-positive rates while delivering actionable causal insights for mitigation. © 2026 IEEE.},
note = {Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron},
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}
Modern intrusion detection systems often achieve impressive benchmark accuracy yet fail in real-world deployment, where network behavior and attacker tactics continuously evolve. Under concept drift, decision boundaries learned offline can diverge from operational reality, triggering false-alarm cascades and creating detection blind spots that erode analyst trust. In this paper, we propose CausalGraph-IDS, a causal and language-model-assisted intrusion detection framework that moves beyond purely correlational scoring by explicitly verifying multi-stage attack chains. Additionally, we propose CHAIN-CRC, a unified algorithm that (i) learns a constrained attack-chain causal graph guided by knowledge-based priors derived from widely used adversary behavior taxonomies, (ii) computes robustness scores by testing whether alarms persist under feasible counterfactual security interventions, and (iii) applies conformal risk control to enforce operator-defined false-positive budgets with finite-sample guarantees.Generative models are integrated in strictly assistive roles through three modules: prior induction to distill causal constraints from unstructured threat reports, counterfactual generation to propose realistic and operationally feasible interventions, and causal logic justification to produce human-readable explanations grounded in the learned attack chain. Experiments on two widely used network intrusion detection benchmarks show that CausalGraph-IDS provides robust, explainable, and risk-governed detection, maintaining strong recall at low false-positive rates while delivering actionable causal insights for mitigation. © 2026 IEEE. |
Laamari, A.; Moudoud, H.; Houda, Z. A. El Lightweight LLM Adaptation for Intrusion Detection via Token-Efficient Flow Representation Article d'actes Dans: IEEE Conf. Artif. Intell., CAI, p. 2122–2127, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 979-833156039-3 (ISBN), (Journal Abbreviation: IEEE Conf. Artif. Intell., CAI). @inproceedings{laamariLightweightLLMAdaptation2026,
title = {Lightweight LLM Adaptation for Intrusion Detection via Token-Efficient Flow Representation},
author = {A. Laamari and H. Moudoud and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105042133342?origin=resultslist},
doi = {10.1109/CAI68641.2026.11536533},
isbn = {979-833156039-3 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Conf. Artif. Intell., CAI},
pages = {2122–2127},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {Large language models (LLMs) are emerging as a promising approach for intrusion detection using structured network flow data. However, their practical deployment is constrained by context window limitations and the excessive token overhead introduced by conventional tabular serialization formats such as JSON. Verbose data representations inflate sequence lengths, often exceeding model input limits and causing feature truncation. Additionally, it remains unclear which LLM architecture is more suitable for structured intrusion detection tasks under limited training resources. To tackle this issue, we propose a novel representation-aware intrusion detection framework based on Token-Oriented Object Notation (TOON), a compact serialization format that maximizes token efficiency while preserving schema structure. Also, we integrate a Low-Rank Adaptation (LoRA) scheme to enable parameter-efficient fine-tuning. Finally, we evaluate the proposed framework as an encoder-decoder model (T5-Small) with a decoder-only model (Qwen2.5) on three benchmark datasets, including NSL-KDD, UNSW-NB15, and CIC-IDS2018 for binary and multi-class classification scenarios. The results show that our tokenizer-aligned, representation-aware preprocessing combined with lightweight encoder-decoder adaptation provides a practical and resource-efficient foundation for LLM-based intrusion detection. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Conf. Artif. Intell., CAI},
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}
Large language models (LLMs) are emerging as a promising approach for intrusion detection using structured network flow data. However, their practical deployment is constrained by context window limitations and the excessive token overhead introduced by conventional tabular serialization formats such as JSON. Verbose data representations inflate sequence lengths, often exceeding model input limits and causing feature truncation. Additionally, it remains unclear which LLM architecture is more suitable for structured intrusion detection tasks under limited training resources. To tackle this issue, we propose a novel representation-aware intrusion detection framework based on Token-Oriented Object Notation (TOON), a compact serialization format that maximizes token efficiency while preserving schema structure. Also, we integrate a Low-Rank Adaptation (LoRA) scheme to enable parameter-efficient fine-tuning. Finally, we evaluate the proposed framework as an encoder-decoder model (T5-Small) with a decoder-only model (Qwen2.5) on three benchmark datasets, including NSL-KDD, UNSW-NB15, and CIC-IDS2018 for binary and multi-class classification scenarios. The results show that our tokenizer-aligned, representation-aware preprocessing combined with lightweight encoder-decoder adaptation provides a practical and resource-efficient foundation for LLM-based intrusion detection. © 2026 IEEE. |
Mehrban, A.; Moudoud, H.; Brik, B.; Houda, Z. A. El Enhancing Spectral Efficiency and Resilience in SAGIN-ITS: An IRS-Assisted Semantic Offloading Framework Article de journal Dans: IEEE Internet of Things Magazine, vol. 9, no 4, p. 30–36, 2026, ISSN: 25763180 (ISSN). @article{mehrbanEnhancingSpectralEfficiency2026,
title = {Enhancing Spectral Efficiency and Resilience in SAGIN-ITS: An IRS-Assisted Semantic Offloading Framework},
author = {A. Mehrban and H. Moudoud and B. Brik and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105036681552?origin=resultslist},
doi = {10.1109/MIOT.2026.3676349},
issn = {25763180 (ISSN)},
year = {2026},
date = {2026-01-01},
journal = {IEEE Internet of Things Magazine},
volume = {9},
number = {4},
pages = {30–36},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {In dense Vehicle-to-Everything (V2X) scenarios within Space-Air-Ground Integrated Networks (SAGIN), connected autonomous cars (CAVs) generate a large volume of sensor data, which leads to significant bandwidth congestion. There is a risk to safety because of the poor Packet Success Rate (PSR) and dangerous transmission delays caused by this congestion. To address this issue, we introduce SemantIRS, a framework that integrates semantic offloading with Intelligent Reflecting Surface (IRS)-assisted links to achieve high network resilience, when compute resources permit and lower latency. SemantIRS deploys lightweight Large Language Models (LLMs) as encoders to compress massive sensor data at the edge of the SAGIN network before transmission through IRS-assisted links. Intent-Based Networking (IBN) and Federated Learning (FL) are also integrated to automate resilience policies and preserve distributed offloading privacy throughout SAGIN layers, respectively. We conduct our experiments using a 12-state hardware benchmark of three LLM encoders (Phi-2, Llama-2-7B-Chat, and Mistral-7B-Instruct-v0.2) on four compute tiers (TPU v6e-1, A100, L4, and Intel Xeon CPU). The measured inference latencies are then fed into an IEEE 802.11p airtime simulator. Our obtained results show that, in congested network conditions, SemantIRS improves the packet success rate from 1.7% to 66.4% while reducing transmission energy by 90%. © 2026 IEEE.},
keywords = {},
pubstate = {published},
tppubtype = {article}
}
In dense Vehicle-to-Everything (V2X) scenarios within Space-Air-Ground Integrated Networks (SAGIN), connected autonomous cars (CAVs) generate a large volume of sensor data, which leads to significant bandwidth congestion. There is a risk to safety because of the poor Packet Success Rate (PSR) and dangerous transmission delays caused by this congestion. To address this issue, we introduce SemantIRS, a framework that integrates semantic offloading with Intelligent Reflecting Surface (IRS)-assisted links to achieve high network resilience, when compute resources permit and lower latency. SemantIRS deploys lightweight Large Language Models (LLMs) as encoders to compress massive sensor data at the edge of the SAGIN network before transmission through IRS-assisted links. Intent-Based Networking (IBN) and Federated Learning (FL) are also integrated to automate resilience policies and preserve distributed offloading privacy throughout SAGIN layers, respectively. We conduct our experiments using a 12-state hardware benchmark of three LLM encoders (Phi-2, Llama-2-7B-Chat, and Mistral-7B-Instruct-v0.2) on four compute tiers (TPU v6e-1, A100, L4, and Intel Xeon CPU). The measured inference latencies are then fed into an IEEE 802.11p airtime simulator. Our obtained results show that, in congested network conditions, SemantIRS improves the packet success rate from 1.7% to 66.4% while reducing transmission energy by 90%. © 2026 IEEE. |
Selamnia, A.; Moudoud, H.; Khoukhi, L.; Brik, B.; Houda, Z. A. El QSFL-ID: Quantum-Split Federated Learning for Intrusion Detection in IIoT Networks Article d'actes Dans: IEEE Int Conf Commun, Institute of Electrical and Electronics Engineers Inc., 2026, ISBN: 15503607 (ISSN); 979-831954209-0 (ISBN), (Journal Abbreviation: IEEE Int Conf Commun). @inproceedings{selamniaQSFLIDQuantumSplitFederated2026,
title = {QSFL-ID: Quantum-Split Federated Learning for Intrusion Detection in IIoT Networks},
author = {A. Selamnia and H. Moudoud and L. Khoukhi and B. Brik and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105045419288?origin=resultslist},
doi = {10.1109/ICC59461.2026.11587037},
isbn = {15503607 (ISSN); 979-831954209-0 (ISBN)},
year = {2026},
date = {2026-01-01},
booktitle = {IEEE Int Conf Commun},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {The Industrial Internet of Things (IIoT) is reshaping industrial automation through interconnected, intelligent systems. However, this evolution increases exposure to sophisticated cyber threats, especially given the constraints of IIoT devices such as limited processing power, bandwidth, and heterogeneous protocols. Traditional machine learning methods often fail to meet these security demands due to their computational intensity and centralized data requirements. To address this, we propose a hybrid quantum-classical Split Federated Learning (SFL) framework for intrusion detection in IIoT networks. Our method integrates Variational Quantum Circuits (VQCs) to model complex, non-linear data relationships, enhancing detection accuracy while preserving data privacy through decentralized learning. The architecture assigns lightweight preprocessing to edge devices and complex analysis to a quantum backend, ensuring efficiency and scalability. To evaluate the proposed framework, we conduct extensive experiments on the real-world EDGE-IIoT dataset; the experimental results demonstrate that the model attains 95.5% training accuracy, significantly surpassing classical SFL (85.7%). In addition, the quantum model's enhanced entanglement properties and expressibility strengthen its generalization performance. This approach offers an efficient and privacy-preserving solution for securing IIoT systems. © 2026 IEEE.},
note = {Journal Abbreviation: IEEE Int Conf Commun},
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}
The Industrial Internet of Things (IIoT) is reshaping industrial automation through interconnected, intelligent systems. However, this evolution increases exposure to sophisticated cyber threats, especially given the constraints of IIoT devices such as limited processing power, bandwidth, and heterogeneous protocols. Traditional machine learning methods often fail to meet these security demands due to their computational intensity and centralized data requirements. To address this, we propose a hybrid quantum-classical Split Federated Learning (SFL) framework for intrusion detection in IIoT networks. Our method integrates Variational Quantum Circuits (VQCs) to model complex, non-linear data relationships, enhancing detection accuracy while preserving data privacy through decentralized learning. The architecture assigns lightweight preprocessing to edge devices and complex analysis to a quantum backend, ensuring efficiency and scalability. To evaluate the proposed framework, we conduct extensive experiments on the real-world EDGE-IIoT dataset; the experimental results demonstrate that the model attains 95.5% training accuracy, significantly surpassing classical SFL (85.7%). In addition, the quantum model's enhanced entanglement properties and expressibility strengthen its generalization performance. This approach offers an efficient and privacy-preserving solution for securing IIoT systems. © 2026 IEEE. |
