Pith. sign in

REVIEW 3 major objections 5 minor 36 references

Federated Learning for Anomaly Detection in Energy Consumption Data: Assessing the Vulnerability to Adversarial Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PGD attacks hit federated energy models harder than central models

desk verdict The paper's own accuracy tables contradict its headline: centralized models lose more accuracy than federated models under FGSM and PGD, so the central comparative claim is unsupported. read the letter →

arxiv 2502.05041 v1 pith:V24XOQ4M submitted 2025-02-07 cs.LG cs.AIcs.DC

Yohannis Kifle Telila , Damitha Senevirathne , Dumindu Tissera , Apurva Narayan , Miriam A.M. Capretz , Katarina Grolinger This is my paper · ORCID
classification cs.LGcs.AIcs.DC
keywords federatedlearningadversarialattacksanomalydetectionenergyconsumptiondatatimeseriesclassificationPGDattackFGSMsmartmeter
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether federated learning (FL) for anomaly detection in smart-meter energy data is more vulnerable to adversarial attacks than centralized training. It tests two white-box attacks, FGSM and PGD, against LSTM and Transformer models, both during inference and during training with malicious clients. The authors find that PGD causes larger accuracy drops than FGSM, and that the FL setting suffers equal or greater degradation than centralized learning. This suggests that the distributed, privacy-preserving setup itself expands the attack surface and motivates the need for FL-specific defenses.

What carries the argument

The central mechanism is the integration of white-box gradient-based attacks into the federated training loop: malicious clients compute FGSM or PGD perturbations on their local data using the current local model, train on the perturbed data, and send the resulting weights to the server, where FedAVG aggregates them into the global model. The iterative nature of PGD is the key factor that makes it more damaging than the single-step FGSM, because it refines the perturbation over multiple gradient steps.

What would settle it

Repeat the training-attack experiment with the same fraction of total training data perturbed in both settings (for example, by attacking the same number of clients but a larger share of each client's data, or by attacking all 19 FL clients on a smaller share), and check whether the FL accuracy drop still exceeds the centralized drop at the same epsilon. If the gap vanishes, the claimed FL-specific vulnerability is an artifact of unequal attack budgets.

Watch

Extended reading notes

Core claim

On the paper's own terms, adversarial attacks—especially iterative PGD—substantially degrade federated anomaly detection in energy consumption data. In experiments with 19 households, training with 9 malicious clients using PGD at epsilon 0.5 drops LSTM accuracy from 91.6% to 23.5%. The authors claim that FL is more sensitive to PGD than to FGSM because PGD's iterative refinement crafts stronger perturbations, and that FL is equally or more affected than centralized learning across both models and both 19- and 50-household datasets. Transformer consistently shows slightly more resilience than LSTM, but both are highly vulnerable, and the damage grows with attack strength and the fraction of malicious clients.

Load-bearing premise

The comparison between FL and centralized learning assumes that attacking 9 of 19 clients on 30% of their data is comparable to attacking 30% of the total data in the centralized setting, even though the FL condition actually perturbs only about 14% of total training data.

Editorial extensions

If this is right

  • If federated learning is indeed more vulnerable, then privacy-preserving distributed learning for energy anomaly detection will require dedicated defenses beyond the standard FL training procedure.
  • Attack success scales with both the perturbation strength epsilon and the fraction of malicious clients, so threat models for smart-meter federations must consider partial client compromise as a realistic risk.
  • Transformer-based detectors appear somewhat more robust than LSTM-based ones, suggesting that architecture choice can partly mitigate adversarial vulnerability.
  • Because the same FL and attack machinery applies to other time-series anomaly detection tasks, these findings likely extend beyond the energy domain to any federated sensor or IoT setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The FL-versus-central comparison in this paper is not apples-to-apples: attacking 9 of 19 clients on 30% of their data perturbs only about 14% of total training data, whereas the centralized baseline perturbs 30% of the total. A controlled experiment with identical perturbed-data fractions is needed to confirm that FL itself, rather than the budget mismatch, amplifies vulnerability.
  • Because the anomalies are synthetic, the models' vulnerability may partly depend on the synthetic anomaly distribution; testing on real labeled anomalies would strengthen the claim.
  • The same experimental setup could be used to evaluate defense mechanisms such as adversarial training, robust aggregation, or client filtering, providing a concrete testbed for future FL security research.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper presents an empirical evaluation of adversarial attacks (FGSM, PGD, AWGN, label flipping) on federated learning (FL) based anomaly detection for smart meter energy data, using LSTM and Transformer models. The authors simulate malicious clients that perturb their local training data and also evaluate attacks at inference time. The main claimed findings are that PGD is more effective than FGSM and that FL is more affected by these attacks than centralized learning, with the impact increasing with attack strength and the number of malicious clients.

Significance. If the comparative claim about FL being more vulnerable than centralized learning were supported, this would be a useful empirical contribution to the security literature on FL in energy applications. The paper uses real smart meter data, two architectures, several attack types, and includes a sensitivity analysis (Fig. 4) that is informative. The experimental protocol is described in enough detail to be reproduced. However, the paper's headline claim is directly contradicted by its own accuracy tables, which show larger accuracy drops for central models. Since the comparison is also confounded by unequal attack budgets, the paper as it stands does not establish its stated contribution; a corrected version with a reversed or removed comparative claim would be a more modest but still potentially valid study.

major comments (3)
  1. [Abstract, V-D, VI, Tables I-III] The paper's central claim that FL is more affected than centralized learning is contradicted by the accuracy data it reports. For the LSTM in Table II, centralized accuracy falls from 95.74% to 33.13% under FGSM (a 62.61-point drop) and to 22.36% under PGD (a 73.38-point drop), while FL accuracy falls from 91.6% to 36.6% (a 55.0-point drop) and to 23.5% (a 68.1-point drop), respectively. The same pattern holds for the Transformer in Table II and for both models in Tables I and III. Thus the data show larger absolute and relative accuracy degradation under centralized learning, not under FL. The abstract and the Conclusion (Section VI) make a claim that the paper's own results refute; this must be corrected before the paper can be considered.
  2. [V-D] The comparison between central and FL training is confounded by unequal attack budgets. With 9 of 19 clients malicious and 30% of each malicious client's data perturbed, roughly 14.2% of the total training data is attacked, whereas the centralized setting attacks 30% of the total data. This means the two conditions are not comparable; if anything, the FL condition receives a smaller perturbation budget. The conclusions in Section V-D should be revised or the experiments re-run with matched budgets.
  3. [V-C, Eq. (8)] The Attack Success Rate as defined in Eq. (8) measures the fraction of samples whose predicted labels change after the attack, not the fraction that change from correct to incorrect. Since the FL models start from lower clean accuracy, a label flip can be a wrong-to-right change, so ASR is not a valid proxy for performance degradation. Arguments based on ASR (e.g., the claim in Section V-C that 'FGSM and PGD attacks led to a higher ASR for the FL model') must be replaced with accuracy or error-rate comparisons; in fact, Table I shows that for PGD the ASR is higher for the central model for both architectures, so even the ASR claim is not supported by the reported numbers.
minor comments (5)
  1. [V-D] In the sentence 'followed by FSGM, label flipping, and random perturbations', 'FSGM' is a typo for 'FGSM'.
  2. [IV-A] The class balance of the final anomaly detection dataset is not reported; please state the ratio of anomalous to normal samples, as it affects the reported metrics and the behavior of the focal loss.
  3. [V-D] The label flipping attack is not described in Section III or IV; please specify how labels are flipped and for which clients and data.
  4. [Fig. 4] The caption reads 'Accuracy for varied attach strengths'; 'attach' should be 'attack'.
  5. [II-A] 'Non-IDD' should be 'non-IID'.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the paper's claims are empirical comparisons, not derived from fitted parameters or self-citation chains.

full rationale

This paper is an empirical vulnerability study and contains no derivation chain in which a quantity is fitted to a subset of data and then reported as a prediction of that same data. The attack algorithms FGSM and PGD are standard, externally defined perturbations, and the FL-versus-central comparison is an experimental contrast rather than an identity. The self-citations (e.g., [10], [11], [22]) support model selection only and are not load-bearing for the attack-vulnerability conclusions. Any concern that the FL and central attack budgets differ (Section V-D) is a validity or confounding issue, not circularity: the conclusion is not equivalent to an input by construction. Accordingly, no circular step is identified.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The study depends on several experimental choices that are not derived from data or theory: synthetic anomaly generation parameters, PGD iteration count, epsilon values, and the malicious client fraction. None of these are fit to a target result, so they are not circular, but they bound the generality of the findings. The data and code are not released, so the exact experiments cannot be reproduced.

free parameters (7)
  • Synthetic spike amplitude range r = [0.5, 1.5]
    Chosen by hand in Section IV-A to simulate appliance malfunctions; directly affects anomaly difficulty and the behavior of the learned detector.
  • Anomaly duration l = 1 or 2 timesteps
    Only durations of 1 and 2 are simulated, per Section IV-A; real anomalies may last longer, so this choice bounds the evaluation.
  • PGD iterations T = 10
    Stated in Section V-A; attack strength scales with T, and choosing a different T would change the reported PGD effectiveness.
  • Main attack strength epsilon = 0.5
    Used for both FGSM and PGD in the main experiments, chosen without a reported sensitivity justification at that point.
  • Malicious client fraction = 9 of 19 (47%)
    Set in Section V-D; this is a very high compromise rate and may not represent typical FL deployments, influencing the magnitude of performance drops.
  • Per-client data perturbation fraction = 30%
    Set in Section V-D; combined with 9/19 clients, this gives roughly 14% of total data perturbed in FL, much less than the 30% used in centralized training.
  • Focal loss hyperparameters (alpha, gamma)
    The paper states Binary Focal Loss is used but does not report alpha or gamma, so the exact training objective cannot be reproduced.
assumptions (5)
  • domain assumption Synthetic anomalies faithfully represent real-world anomalies in smart meter data.
    All evaluations use anomalies generated by the rules in Section IV-A; no validation against real anomalies is provided, so the vulnerability results may not transfer.
  • domain assumption White-box attacks are the relevant threat model for the malicious-client scenario.
    The paper assumes attackers know the model and data. In FL, a malicious client may only have full access to its local model, and the paper does not discuss whether this difference matters.
  • domain assumption FedAvg aggregation is representative of federated learning in energy settings.
    Only FedAvg is used, per Section IV-C, so conclusions may not generalize to other aggregation methods such as secure aggregation or robust aggregation.
  • domain assumption The London Hydro dataset is representative of residential energy consumption patterns.
    The dataset covers 19 and 50 households in one city; broader generalization to other regions and consumer types is assumed without discussion.
  • standard math Evaluation metrics capture attack impact in an imbalanced anomaly detection setting.
    Accuracy and ASR are standard but can be misleading for imbalanced classes; the paper reports precision and F1 as well, but the over-reliance on accuracy for conclusions about FL versus central vulnerability remains.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Federated Learning for Anomaly Detection in Energy Consumption Data: Assessing the Vulnerability to Adversarial Attacks." pith.science (2026). https://pith.science/paper/V24XOQ4M

@misc{pith2026250205041,
  author       = {Pith},
  title        = {Pith review of: Federated Learning for Anomaly Detection in Energy Consumption Data: Assessing the Vulnerability to Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V24XOQ4M}},
  note         = {Machine review of arXiv:2502.05041}
}
read the original abstract

Anomaly detection is crucial in the energy sector to identify irregular patterns indicating equipment failures, energy theft, or other issues. Machine learning techniques for anomaly detection have achieved great success, but are typically centralized, involving sharing local data with a central server which raises privacy and security concerns. Federated Learning (FL) has been gaining popularity as it enables distributed learning without sharing local data. However, FL depends on neural networks, which are vulnerable to adversarial attacks that manipulate data, leading models to make erroneous predictions. While adversarial attacks have been explored in the image domain, they remain largely unexplored in time series problems, especially in the energy domain. Moreover, the effect of adversarial attacks in the FL setting is also mostly unknown. This paper assesses the vulnerability of FL-based anomaly detection in energy data to adversarial attacks. Specifically, two state-of-the-art models, Long Short Term Memory (LSTM) and Transformers, are used to detect anomalies in an FL setting, and two white-box attack methods, Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD), are employed to perturb the data. The results show that FL is more sensitive to PGD attacks than to FGSM attacks, attributed to PGD's iterative nature, resulting in an accuracy drop of over 10% even with naive, weaker attacks. Moreover, FL is more affected by these attacks than centralized learning, highlighting the need for defense mechanisms in FL.

Figures

Figures reproduced from arXiv: 2502.05041 by the authors.

Figure 1
Figure 1. Federated learning without and with adversarial attacks. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Average 24-hour electricity usage for each house. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Clean (without attack) sample and its PGD and FGSM [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Accuracy for varied attach strengths. former again demonstrated slight resilience compared to the LSTM, though both models were highly vulnerable. Overall, the FL setting showed comparable vulnerability to the attacks as central learning. The FGSM and PGD attacks cause…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 34 canonical work pages

  1. [1]

    Global Status Report for Buildings and Construction,

    UN, “Global Status Report for Buildings and Construction,”

    work page

  2. [2]

    Net zero coalition,

    ——, “Net zero coalition,” 2024. [Online]. Available: https://www.un. org/en/climatechange/net-zero-coalition

    work page 2024

  3. [3]

    Anomaly detection: A survey,

    V . Chandola, A. Banerjee, and V . Kumar, “Anomaly detection: A survey,” ACM computing surveys , vol. 41, no. 3, pp. 1–58, 2009

    work page 2009

  4. [4]

    High-dimensional energy consumption anomaly detection: A deep learning-based method for detecting anoma- lies,

    H. Pan, Z. Yin, and X. Jiang, “High-dimensional energy consumption anomaly detection: A deep learning-based method for detecting anoma- lies,” Energies, vol. 15, no. 17, p. 6139, 2022

    work page 2022

  5. [5]

    Enhanced anomaly-based fault detection system in electrical power grids,

    W. Elmasry and M. Wadi, “Enhanced anomaly-based fault detection system in electrical power grids,” Int. Transactions on Electrical Energy Systems, vol. 2022, no. 1, p. 1870136, 2022

    work page 2022

  6. [6]

    An anomaly detection framework for identifying energy theft and defective meters in smart grids,

    S.-C. Yip, W.-N. Tan et al. , “An anomaly detection framework for identifying energy theft and defective meters in smart grids,” Int. Journal of Electrical Power & Energy Systems , vol. 101, pp. 189–203, 2018

    work page 2018

  7. [7]

    Distributed anomaly detection in smart grids: a federated learning-based approach,

    J. Jithish, B. Alangot et al. , “Distributed anomaly detection in smart grids: a federated learning-based approach,” IEEE Access , vol. 11, pp. 7157–7179, 2023

    work page 2023

  8. [8]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan et al. , “Advances and open problems in federated learning,” Foundations and trends in machine learning, vol. 14, no. 1–2, pp. 1–210, 2021

    work page 2021

Show all 36 references
  1. [9]

    Privacy preservation in federated learning: An insightful survey from the gdpr perspective,

    N. Truong, K. Sun et al., “Privacy preservation in federated learning: An insightful survey from the gdpr perspective,” Computers & Security, vol. 110, p. 102402, 2021

    2021

  2. [10]

    Distributed load forecasting using smart meter data: Federated learning with recurrent neural networks,

    M. N. Fekri, K. Grolinger, and S. Mir, “Distributed load forecasting using smart meter data: Federated learning with recurrent neural networks,” Int. Journal of Electrical Power & Energy Systems, vol. 137, p. 107669, 2022

    2022

  3. [11]

    Asynchronous adaptive federated learning for distributed load forecasting with smart meter data,

    ——, “Asynchronous adaptive federated learning for distributed load forecasting with smart meter data,” Int. Journal of Electrical Power & Energy Systems, vol. 153, p. 109285, 2023

    2023

  4. [12]

    When the curious abandon honesty: Federated learning is not private,

    F. Boenisch, A. Dziedzic et al. , “When the curious abandon honesty: Federated learning is not private,” in IEEE 8th European Symposium on Security and Privacy , 2023, pp. 175–199

    2023

  5. [13]

    Robbing the fed: Directly obtaining pri- vate data in federated learning with modified models,

    L. Fowl, J. Geiping et al. , “Robbing the fed: Directly obtaining pri- vate data in federated learning with modified models,” arXiv preprint arXiv:2110.13057, 2021

    2021 arXiv

  6. [14]

    Vulnerabilities in federated learning,

    N. Bouacida and P. Mohapatra, “Vulnerabilities in federated learning,” IEEE Access, vol. 9, pp. 63 229–63 249, 2021

    2021

  7. [15]

    Delving into the adversarial robustness of federated learning,

    J. Zhang, B. Li et al., “Delving into the adversarial robustness of federated learning,” in AAAI Conf. on Artif. Intelligence , 2023, pp. 11 245–11 253

    2023

  8. [16]

    Gear: a margin-based federated adver- sarial training approach,

    C. Chen, J. Zhang, and L. Lyu, “Gear: a margin-based federated adver- sarial training approach,” in Int. Workshop on Trustable, Verifiable, and Auditable Federated Learning in AAAI , 2022

    2022

  9. [17]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Int. Conf. on Learning Representations , 2015

    2015

  10. [18]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov et al. , “Towards deep learning models resistant to adversarial attacks,” in Int. Conf. on Learning Representations , 2018

    2018

  11. [19]

    Adversarial attacks on deep neural networks for time series classification,

    H. I. Fawaz, G. Forestier et al. , “Adversarial attacks on deep neural networks for time series classification,” in Int. Joint Conf. on Neural Networks. IEEE, 2019, pp. 1–8

    2019

  12. [20]

    Adversarial examples in deep learning for multivariate time series regression,

    G. R. Mode and K. A. Hoque, “Adversarial examples in deep learning for multivariate time series regression,” in IEEE Applied Imagery Pattern Recognition Workshop, 2020, pp. 1–10

    2020

  13. [21]

    LSTM based long-term energy consumption prediction with periodicity,

    J. Q. Wang, Y . Du, and J. Wang, “LSTM based long-term energy consumption prediction with periodicity,” Energy, vol. 197, p. 117197, 2020

    2020

  14. [22]

    Transformer-based model for electrical load forecasting,

    A. L’Heureux, K. Grolinger, and M. A. Capretz, “Transformer-based model for electrical load forecasting,” Energies, vol. 15, no. 14, 2022

    2022

  15. [23]

    Power consumption predicting and anomaly detection based on transformer and k-means,

    J. Zhang, H. Zhang et al., “Power consumption predicting and anomaly detection based on transformer and k-means,” Frontiers in Energy Re- search, vol. 9, p. 779587, 2021

    2021

  16. [24]

    Privacy-preserving federated learning against label-flipping attacks on non-iid data,

    X. Shen, Y . Liu et al. , “Privacy-preserving federated learning against label-flipping attacks on non-iid data,” IEEE Internet of Things Journal , vol. 11, no. 1, pp. 1241–1255, 2023

    2023

  17. [25]

    A novel approach for detecting anomalous energy consumption based on micro-moments and deep neural networks,

    Y . Himeur, A. Alsalemi et al., “A novel approach for detecting anomalous energy consumption based on micro-moments and deep neural networks,” Cognitive Computation, vol. 12, no. 6, pp. 1381–1401, 2020

    2020

  18. [26]

    A deep learning approach for anomaly detection and prediction in power consumption data,

    C. Chahla, H. Snoussi et al. , “A deep learning approach for anomaly detection and prediction in power consumption data,” Energy Efficiency, vol. 13, no. 8, pp. 1633–1651, 2020

    2020

  19. [27]

    A deep learning framework for building energy consumption forecast,

    N. Somu, G. R. MR, and K. Ramamritham, “A deep learning framework for building energy consumption forecast,” Renewable and Sustainable Energy Reviews, vol. 137, p. 110591, 2021

    2021

  20. [28]

    Anomaly detection with machine learning al- gorithms and big data in electricity consumption,

    S.-V . Oprea, A. Bˆara et al., “Anomaly detection with machine learning al- gorithms and big data in electricity consumption,” Sustainability, vol. 13, no. 19, p. 10963, 2021

    2021

  21. [29]

    Gpt-4 technical report,

    J. Achiam, S. Adler et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774, 2023

    2023 arXiv

  22. [30]

    Forecasting energy consumption demand of customers in smart grid using temporal fusion transformer (TFT),

    A. Nazir, A. K. Shaikh et al., “Forecasting energy consumption demand of customers in smart grid using temporal fusion transformer (TFT),” Results in Engineering , vol. 17, p. 100888, 2023

    2023

  23. [31]

    A federated learning approach to anomaly detection in smart buildings,

    R. A. Sater and A. B. Hamza, “A federated learning approach to anomaly detection in smart buildings,” ACM Transactions on Internet of Things , vol. 2, no. 4, pp. 1–23, 2021

    2021

  24. [32]

    Adversarial examples in the physical world,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Int. Conf. on Learning Representations , 2017

    2017

  25. [33]

    Novel evasion attacks against adversarial training defense for smart grid federated learning,

    A. H. Bondok, M. Mahmoud et al. , “Novel evasion attacks against adversarial training defense for smart grid federated learning,” IEEE Access, 2023

    2023

  26. [34]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore et al., “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics. PMLR, 2017, pp. 1273–1282

    2017

  27. [35]

    Focal loss for dense object detection,

    T.-Y . Lin, P. Goyal et al., “Focal loss for dense object detection,” in IEEE Int. Conf. on Computer Vision , 2017, pp. 2980–2988

    2017

  28. [2024]

    Available: https://www.unep.org/resources/report/ global-status-report-buildings-and-construction

    [Online]. Available: https://www.unep.org/resources/report/ global-status-report-buildings-and-construction

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.