X-DRIFT: A Dual-Stage Mutual Information Pruning Framework for Explanation Stability in Edge-IoT Intrusion Detection Systems

The use of Explainable Artificial Intelligence (XAI) in Internet of Things (IoT) network Intrusion Detection Systems (IDS) allows security analysts to gain insights into how and why network traffic is identified as malicious. However, previous XAI-IDS publications assume noise-free, static lab environments. In reality, this is rarely true because of the presence of physical sensors with thermal noise, quantization errors, and environmental drift. This paper introduces a lightweight auditing and defense framework that systematically quantifies and mitigates Explanation Drift, dubbed X-DRIFT. “Explanation Drift” refers to the degradation in the quality and consistency of the explanation. Three novel auditing metrics are introduced: The Explanation Instability Metric (EIM), the Top-K Feature Retention Rate (TKFRK), and the Efficiency-Stability Tradeoff Score (ESTS). We conducted experimental evaluations on a benchmark suite of features from UNSW-NB15 dataset (N=257,673) across five noise levels. Results demonstrate that our proposed dual-stage LightGBM model with Mutual Information feature pruning achieves superior explanation stability (EIM=0.2980 at σ=0.05) and retains 60% of Top-5 features while sustaining microsecond inference (≈ 1222 µs). This establishes the first empirical benchmark for XAI reliability in noisy IoT environments, outperforming standard baselines.