Security and Resilience of AI-Enabled Edge Computing in Industrial IoT: Vulnerabilities, Defense Strategies, and Future Directions

Industrial Internet of Things (IIoT) deployments increasingly move intrusion detection from the cloud to edge gateways, where machine learning (ML) models inspect traffic close to programmable logic controllers, sensors, and supervisory systems. This shift shortens response times but places the detector itself inside the attack surface. This paper combines a structured analysis of threats and defenses for AI-driven IIoT edge security with a reproducible experimental study on the network partition of the TON_IoT testbed. We first show that the evaluation protocol is itself a vulnerability: host identifiers inflate the ten-class macro-F1 of a random forest by 3.8 points, and 55.6% of the raw flows are exact duplicates once identifiers are removed. On a leakage-free corpus of 93,299 flows, gradient-boosted trees reach a binary macro-F1 of 0.996 and a ten-class macro-F1 of 0.956, while an 85 KB neural detector classifies a flow in 0.015 ms. Every undefended detector proved evadable. White-box projected gradient descent reduces the detection rate of the neural network from 0.996 to 0.002, and a gradient-free search with at most 100 queries evades XGBoost for 74% of attack flows. Adversarial training was the only defense that remained robust against transfer, adaptive white-box, and black-box attacks, at a cost of about three false-positive points. Adversarial data augmentation of XGBoost appeared robust but raised false alarms on equally perturbed benign traffic to 86%. Federated training matched centralized accuracy under homogeneous data yet lost up to 36 points under severe class skew; coordinate-wise median aggregation tolerated four Byzantine gateways out of ten. INT8 quantization combined with pruning produced 22–53 KB detectors within 1.3 points of the dense model. Explanations based on Shapley values reveal that five of the six most influential features can be inflated by an attacker, which links interpretability directly to the evasion surface. The paper closes with deployment guidelines and open research directions.