Abstract
<title>Abstract</title> <p>Deep learning intrusion detection is often limited at the network edge by high latency and large memory footprints. We test whether block-sparse pruning of a Multi-Classifier Deep Neural Network resolves this, training and evaluating across 5 random seeds on the disjoint NSL-KDD KDDTest+ partition, on native Raspberry Pi 5 hardware. On 18,794 test records with training-seen labels, the pruned model (74.55% sparsity) reaches 81.2 ± 1.4% accuracy (macro F1 = 0.31 ± 0.02) versus 82.3 ± 1.1% (macro F1 = 0.31 ± 0.02) for the dense baseline; the remaining 3,750 records (16.6%) carry attack types absent from training. Contrary to the assumption that pruning changes latency, single-sample latency is formally equivalent between dense (0.0103 ± 0.0008 ms) and pruned (0.0101 ± 0.0002 ms) models (TOST equivalence test, ±0.001 ms margin, p = 0.039), indicating no benefit from sparsity without sparse-aware kernels. Confusion matrix analysis reveals two failure modes: majority-class collapse on back and guess_passwd (F1 ≈ 0.00, all seeds, both models), and seed-dependent instability under pruning on borderline classes such as smurf (mean F1 0.57 ± 0.34 pruned versus 0.89 ± 0.13 dense). These results correct the assumption that sparsity reliably confers or costs inference speed, characterizing class instability, not collapse, as pruning’s effect.</p>