FedLLM-API: Privacy-Preserving Large Language Model Federation for Zero-Day API Threat Detection Across Organizational Boundaries

The proliferation of application programming interfaces in modern cloud-native architectures has introduced unprecedented security challenges, with zero-day API vulnerabilities causing substantial financial and reputational damage across organizational boundaries. While large language models have demonstrated remarkable capabilities in cybersecurity applications, their deployment for API threat intelligence remains constrained by privacy concerns and the need for centralized training on sensitive organizational data. This paper introduces FedLLM-API, a novel privacy-preserving federated learning framework that enables collaborative zero-day API threat detection across multiple organizations without exposing proprietary API logic or sensitive data. Our approach combines parameterefficient fine-tuning of lightweight language models with Byzantinerobust aggregation and differential privacy guarantees to achieve both high detection accuracy and strong privacy protection. We propose a semantic API encoding scheme that preserves privacy while capturing behavioral patterns indicative of novel attacks, alongside a prompt-based aggregation mechanism that reduces communication overhead by 68% compared to traditional gradient-based federated learning. Through extensive evaluation on six real-world datasets spanning REST APIs, GraphQL endpoints, and microservices architectures from AWS, Azure, and Google Cloud Platform, FedLLM-API achieves 97.2% accuracy in detecting zero-day threats with ε = 0.5 differential privacy, surpassing centralized baselines by 1.4% points while requiring no raw data sharing. Our ablation studies demonstrate the critical importance of federated prompt tuning and Byzantine-robust aggregation in maintaining model performance under adversarial conditions. The framework provides practical deployment guidelines for multi-cloud environments and establishes a new paradigm for privacy-preserving collaborative threat intelligence in zero-trust architectures.