Robust and Communication-Efficient Personalized Federated Learning for False Power Consumption Detection in Heterogeneous Smart Grids

Abstract

Detecting false power consumption data injection (FDI) attacks requires utilities to collaborate without sharing consumers’ raw data. Federated learning (FL) enables such collaboration. However, conventional FL exchanges complete models in every round and loses accuracy when the utilities’ data are not independent and identically distributed (non-IID). It also produces a shared detector that a malicious participant can exploit to craft evasion attacks. This paper proposes a personalized federated learning (PFL) approach in which utilities jointly train convolutional feature-extraction layers while keeping their classification layers local. Adversarial examples are incorporated into local training to improve resistance to evasion. The approach requires a single model per utility and no public dataset at the server. We evaluate it on the Ausgrid and Irish Smart Energy Trial datasets, with utilities that differ in both consumption patterns and attack characteristics. Compared with conventional FL, the proposed approach reduces the data exchanged per round and utility from 306.63 KB to 3.50 KB. With adversarial training, it improves accuracy by up to 23.75 and 29.82 percentage points on Ausgrid and ISET, respectively, and lowers the success rates of the evaluated FGSM and BIM attacks. These results show that personalization can ease the accuracy–robustness trade-off while substantially reducing communication costs.

1. Introduction

Smart power grids (SGs) represent a modernized electricity infrastructure that leverages communication, automated control, and data-driven technologies to optimize the generation, distribution, and consumption of electrical energy [1]. A key component of this infrastructure is the smart meter (SM), an electronic device deployed at consumer premises to monitor electricity usage in near real time and enable bidirectional communication between consumers and grid operators [2]. SMs provide detailed insights into consumption patterns, support dynamic pricing mechanisms, and enable rapid fault detection as well as remote control of power delivery. By facilitating real-time monitoring and control, SGs and SMs enable advanced demand-side management, seamless integration of renewable energy resources, and improved grid reliability and stability [1,2]. However, the increased connectivity and data exchange within SGs also introduce new cybersecurity vulnerabilities, including false power consumption data injection (FDI) attacks [3].

FDI attacks pose a significant threat to the reliable operation and financial integrity of modern power systems [3,4,5]. In such attacks, adversaries manipulate the energy consumption data reported by SMs to obtain financial benefits, such as reducing electricity bills or stealing power, while misleading control systems [6,7]. This manipulation can distort load estimation, degrade operational efficiency, and potentially destabilize grid performance. As energy networks become increasingly interconnected through Internet of Things (IoT) technologies, there is a growing need for detection mechanisms that are not only accurate and adaptive but also capable of preserving consumer privacy.

Machine learning (ML) techniques have shown strong potential for detecting anomalous consumption patterns associated with FDI attacks by learning normal behavioral patterns from historical data and identifying suspicious deviations in real time. However, most ML-based solutions rely on centralized data aggregation, which raises significant privacy concerns [5,8]. Fine-grained energy consumption data is highly sensitive, as it may reveal detailed information about users’ daily routines, occupancy patterns, lifestyle habits, and socioeconomic status. Centralized ML training approaches require transmitting raw data from distributed SMs to a central server for model training, thereby increasing the risk of data breaches and potential non-compliance with privacy regulations. To address these concerns, federated learning (FL) has emerged as a decentralized ML training paradigm that mitigates privacy risks by enabling collaborative model training without sharing raw data [9,10,11,12].

FL enables multiple edge entities—such as SMs, substations, or electrical utility companies (EUCs)—to collaboratively train a shared global model while keeping their local data private [13]. Instead of transmitting raw data, participating clients exchange model updates with a central aggregation server, which combines these updates to refine the global model. Despite its privacy advantages, FL performance can be significantly affected by non-independent and identically distributed (non-IID) data, which are common in heterogeneous SG environments where energy consumption patterns vary considerably due to differences in household appliances, occupancy schedules, weather conditions, and geographic factors. Such data heterogeneity can lead to reduced detection accuracy, slower convergence, and higher false alarm rates in conventional FL approaches [14].

In addition, FL can incur substantial communication overhead because clients and the aggregation server repeatedly exchange complete ML models containing a large number of parameters over multiple communication rounds until convergence is achieved. Beyond these challenges, ML-based detectors are also vulnerable to adversarial evasion attacks, in which attackers introduce carefully crafted perturbations into input data to mislead model predictions [15,16]. Although adversarial training (AT) is a promising defense that enhances robustness by incorporating adversarial examples into the training process [17,18], these robustness improvements may come at the cost of reduced detection accuracy on benign data.

To address these challenges, this paper develops a personalized federated learning (PFL)-based approach that enhances robustness against evasion attacks, reduces communication overhead, and maintains high classification performance in heterogeneous smart-grid environments, where utilities may differ in both power consumption patterns and attack characteristics. These objectives can involve competing requirements, particularly the tradeoff between accuracy on clean data and adversarial robustness.

Following the parameter-decoupling strategy [19,20,21] of FedPer [22], the proposed approach enables participating utilities to collaboratively train shared feature-extraction layers while retaining their classification layers locally. Each detector can therefore adapt to local consumption patterns without transferring raw consumption records to the aggregation server. Sharing only a subset of model parameters also reduces communication overhead, making the approach suitable for bandwidth-constrained SG environments. This personalization raises an important question: can adversarial examples generated using knowledge of one utility’s personalized detector also evade those of other utilities? We investigate this transferability and incorporate AT into local training to strengthen evasion resistance while limiting the loss of accuracy on clean data, thereby seeking a more favorable balance between accuracy and robustness. The approach requires no public dataset at the aggregation server.

We evaluate the proposed approach using two real-world smart meter datasets, Ausgrid and the Irish Smart Energy Trial (ISET). Non-IID partitions capture geographic differences through postcode-based grouping and behavioral differences through k-means clustering. The goal of this study is to develop a collaborative FDI detector for EUCs whose consumption data and attack patterns differ. The object of the study is the detection of false power consumption reports by multiple collaborating EUCs, and its subject is personalized federated detectors trained under non-IID data and adversarial evasion. To achieve this goal, we pursue three objectives: (O1) reducing the communication overhead of collaborative training by exchanging only the feature-extraction layers; (O2) maintaining high detection accuracy under heterogeneous data by keeping the classification layers local to each EUC; and (O3) improving robustness against evasion attacks by incorporating adversarial examples into local training and analyzing whether evasion examples transfer across EUCs.

To the best of our knowledge, this is the first study to jointly address communication efficiency, classification accuracy, and robustness against evasion attacks through partial layer sharing and adversarial training for personalized FDI detection in heterogeneous smart grids. The study provides insight into how personalization and adversarial training jointly affect detection performance and evasion robustness under non-IID conditions. The study adopts one benchmark PFL algorithm, FedPer [22], and compares it with conventional FL, examining how decoupling-based personalization interacts with adversarial training [15,16,17], communication cost, and cross-utility attack transferability.

The remainder of this paper is organized as follows. Section 2 reviews existing studies on FL-based false data detection and vulnerabilities to adversarial attacks. Section 3 presents the proposed PFL training approach. Section 4 describes the datasets and FDI attack models used in the experiments. Section 5 describes the experimental setup and presents the results of the performance and robustness evaluations. Section 6 discusses the results, practical implementation, limitations, and future research directions. Finally, Section 7 concludes the paper.

2. Related Works

This section first reviews state-of-the-art ML-based approaches for false power consumption data detection, including both centralized and decentralized approaches. It then examines existing applications of PFL. Finally, it highlights the key research gaps in the current literature that motivate the proposed work.

2.1. False Power Consumption Data Detection

ML techniques are increasingly used to detect falsified data in SGs. Existing research can generally be categorized into two main streams: centralized learning approaches [3,4,5,23,24,25] and distributed or decentralized learning approaches [11,26,27,28,29].

2.1.1. Centralized Approaches

Centralized ML approaches perform model training by aggregating data from multiple devices or electrical utility units at a central server, enabling global learning and comprehensive pattern extraction. Recent advances in FDI attack research investigate both attack strategies and defense mechanisms using diverse ML techniques [3,4,5,23,24,25].

For example, Xiao et al. [3] proposed a reinforcement learning (RL)-based FDI attack model that maximizes attack success by optimizing the selection of compromised meters and the injected data while minimizing attack cost. This approach uses measurement data and attack outcomes to generate attack vectors capable of evading detection and increasing state estimation errors. In contrast, Su et al. [4] developed an interpretable detection approach based on a dual-attention multi-head graph attention network, which captures both spatial and feature-level dependencies to improve detection accuracy while providing explainability. Furthermore, Miao et al. [5] addressed the challenge of imbalanced and partially labeled datasets by proposing an optimal transport-based self-training method that incorporates reweighting and debiasing techniques to improve detection performance when labeled data are limited.

Other studies transform time-series smart meter data into image representations to leverage deep learning models originally developed for computer vision tasks. For instance, Du et al. [23] converted one-dimensional time-series data into two-dimensional recurrence plots and applied VGGNet to achieve accurate classification of normal and tampered measurements. Similarly, Pan et al. [24] proposed a parallel convolutional neural network (CNN) architecture that encodes temporal data using multiple representation techniques, improving classification performance near decision boundaries. Additionally, Zhu et al. [25] introduced a lightweight detection and localization approach designed for resource-constrained devices, combining early-exit mechanisms and mixed-precision quantization to achieve efficient and accurate FDI attack detection across different grid configurations. However, these centralized approaches require consumption records from multiple consumers to be pooled at a central server, which raises privacy and regulatory concerns.

2.1.2. Decentralized Approaches

Decentralized ML approaches, particularly FL, address privacy concerns by allowing local model training at individual devices or electrical utility units without sharing raw data with a central server. This enables collaborative model development while preserving data privacy [11,26,27,28,29].

Several studies have explored FL training approaches for FDI attack detection. For example, Li et al. [11] proposed an FL method that integrates Transformers with the Paillier cryptosystem to enable privacy-preserving collaborative detection of FDI attacks while maintaining high accuracy. Kesici et al. [26] introduced a vertical FL training approach in which attention-enhanced deep learning models are distributed across edge devices and servers to jointly capture spatial and temporal features. To mitigate inference risks in federated environments, Tran et al. [27] developed a cross-silo FL approach using double-layer encryption and secret sharing, providing strong privacy guarantees and resilience against honest-but-curious aggregators.

In addition, Abdel-Basset et al. [28] proposed a semi-supervised federated framework designed for industrial smart grids, incorporating temporal convolution-based generative models and a novel aggregation strategy to address class imbalance and limited labeled data. Li et al. [29] further introduced an end–edge–cloud collaborative training approach using temporal–spatial graph convolutional networks, enabling distributed FDI attack detection while reducing reliance on centralized infrastructure and protecting stakeholder data. However, these conventional FL approaches train a single global model, which may degrade under non-IID data, exchange the full model in every round, and do not consider evasion attacks against the shared detector.

2.2. Applications of PFL

PFL is an extension of conventional FL, with each paradigm offering distinct capabilities and addressing different application requirements. In both approaches, collaboration among participants is essential because individual clients often lack sufficient local data to train accurate and robust models independently. Consequently, knowledge sharing plays a critical role in improving model performance. In conventional FL, a single global model is collaboratively trained and shared among all participants. In contrast, PFL generates personalized models tailored to the unique characteristics of each participant’s local data while still benefiting from shared global knowledge [19,20,22,30,31,32,33,34].

PFL approaches generally fall into two categories: architecture-based methods, including parameter decoupling and knowledge distillation, and similarity-based methods, including multitask learning, model interpolation, and clustering [20]. Parameter decoupling shares only selected model parameters or layers during collaborative training, allowing clients to adapt the remaining parameters locally while benefiting from knowledge learned across the network [19]. Among parameter-decoupling methods, FedPer [22] shares the base layers of a single model among clients and keeps the top personalization layers local, updating both jointly. FedRep [30] uses the same split but alternates the updates, first training the local head with the shared representation frozen and then the shared layers. Ditto [31] instead maintains two complete models per client, a global model that is exchanged in full in every round and a personalized model regularized toward it, and addresses robustness against training-time poisoning rather than test-time evasion. These methods were developed for general benchmark tasks and do not consider FDI detection or evasion attacks.

Cao et al. [32] proposed a PFL framework for green Industrial Internet of Things (IIoT) systems to overcome the limitations of one-size-fits-all resource management and incentive mechanisms. The framework incorporates an incentive model that captures participant preferences and a personalized scheduling strategy that adapts to dynamic resource conditions. By integrating reinforcement learning with proximal policy optimization, the proposed approach improves training efficiency and achieves higher model accuracy than existing baseline methods.

Similarly, Yang et al. [33] introduced a physics-driven PFL framework for computed tomography (CT) reconstruction to address domain shift and privacy challenges associated with centralized deep learning approaches. Their method decomposes the learning process into local data adaptation and global imaging tasks through the use of an institution-specific hypernetwork coupled with a shared global model. By incorporating scanning protocol information, the framework enables personalized image reconstruction while learning robust domain-invariant representations, achieving competitive performance without requiring raw data sharing among institutions.

In another study, Molaei et al. [34] proposed an attention-based graph PFL framework to address data-view heterogeneity across multiple clinical datasets. Their approach employs client-specific projection layers to map heterogeneous feature spaces into a shared latent representation and utilizes personalized masking mechanisms to enable selective parameter sharing among clients. This design preserves local data characteristics, minimizes the need for extensive data preprocessing, and improves the generalization capability of the learned models across diverse clinical environments. Moreover, Chen et al. [35] investigate FDI in distributed energy sources integrated into electricity distribution networks. It divides a multilayer neural network into shared and local feature layers to distinguish common patterns from client-specific characteristics. It also uses the maximum information coefficient to capture temporal correlations in distributed renewable energy measurements. However, these studies address applications other than the detection of false power consumption reports from smart meters.

2.3. Research Gaps and Limitations

The works reviewed in Section 2.2 demonstrate growing interest in PFL in different applications, particularly for developing models tailored to the data characteristics of individual participants. In this context, the authors of [36] applied PFL to the detection of false power consumption data. Their approach deploys a bidirectional Transformer-based detector at each client and dynamically combines global and local model parameters to preserve sparse, client-specific attack features that might otherwise be diluted during global aggregation. However, the proposed approach has several limitations. First, it does not consider adversarial evasion attacks or evaluate the vulnerability of the resulting detectors against such attacks. Second, each client must maintain and train two complete models while also updating a mixing coefficient in each communication round, increasing local computational and memory requirements. In addition, clients exchange the full global model branch during each round, yet the associated communication overhead is not quantified. The approach also relies on a public dataset at the server to initialize the global model, introducing an additional data availability requirement that may not be feasible in practical deployments. Finally, the evaluation is conducted using only a single, relatively small dataset, leaving the generalizability of the approach across different datasets and operating conditions unexplored.

Previous studies by the authors also differ from the present work. The detectors in [6,8,37] are trained centrally without federated learning, ref. [18] proposes evasion attacks against conventional FL with a single global model, and ref. [12] addresses federated energy forecasting rather than false data detection. None of these studies considers personalized FL, the transferability of evasion attacks across personalized detectors, or the accuracy–robustness trade-off under combined consumption and attack heterogeneity.

In summary, centralized detectors [3,4,5,23,24,25] require sensitive consumption records to be pooled at a central server. Conventional FL detectors [11,26,27,28,29] keep data local but train a single global model that degrades under non-IID data, exchange the full model in every round, and expose a common detector to evasion attacks crafted by any participant. The only PFL study on false power consumption data [36] does not consider evasion attacks, requires a public dataset at the server and two models per client, and does not quantify its communication cost. No existing study jointly examines communication efficiency, detection accuracy under combined consumption and attack heterogeneity, and the evasion robustness of personalized FDI detectors.

3. The Proposed Approach

The proposed approach allows EUCs to learn from one another without collecting their consumption records at a central server. Each EUC maintains a CNN-based detector whose convolutional layers are learned collaboratively, while its classification layers are adapted to local data. Adversarial examples are incorporated into local learning to improve the detector’s ability to recognize FDI attacks designed to evade detection. In this section, we first describe the proposed detector and then explain the rationale behind its design.

3.1. Robust PFL-Based False Data Detector

3.1.1. System Model and Model Personalization

We consider N EUCs, each serving a group of consumers equipped with SMs. The meters periodically send electricity consumption readings to their respective EUCs. In addition to billing and operational monitoring, these readings provide the data needed to train FDI detectors.

For EUC i, the training dataset is

$${\mathcal{D}}_i={\left\{({\mathbf{x}}_{ij},y_{ij})\right\}}_{j=1}^{m_i},$$

(1)

where $m_i$ is the number of training examples, ${\mathbf{x}}_{ij}\in {\mathbb{R}}^T$ contains T readings recorded over one day, and $y_{ij}\in \{0,1\}$ indicates whether the daily profile is benign (0) or malicious (1). For categorical cross-entropy, each label is represented by the one-hot vector

$$\mathbf{e}\left(y\right)=\left[\begin{array}{c}1-y\\ y\end{array}\right].$$

(2)

Consumption habits, consumer composition, and attack characteristics can differ across EUCs. Consequently, their local datasets may follow different distributions. To accommodate these differences, and following FedPer [22], the detector is divided into a shared feature extractor and a local classification head. The feature extractor, denoted by $g_{\mathsf{\theta }}$, consists of convolutional layers with parameters $\mathsf{\theta }$. The classification head, denoted by $h_{{\mathsf{\varphi }}_i}$, contains dense layers whose parameters ${\mathsf{\varphi }}_i$ are specific to EUC i. Its final layer produces two logits:

$${\mathbf{z}}_i\left(\mathbf{x}\right)=h_{{\mathsf{\varphi }}_i}\left(g_{\mathsf{\theta }}\left(\mathbf{x}\right)\right)\in {\mathbb{R}}^2.$$

(3)

The detector applies softmax to these logits to obtain the class-probability vector:

$${\mathbf{p}}_i\left(\mathbf{x}\right)=f_i(\mathbf{x};\mathsf{\theta },{\mathsf{\varphi }}_i)=\mathrm{softmax}\left({\mathbf{z}}_i\left(\mathbf{x}\right)\right).$$

(4)

For class $c\in \{0,1\}$, the corresponding probability is

$$p_{i,c}\left(\mathbf{x}\right)={\displaystyle \frac{\exp \left(z_{i,c}\left(\mathbf{x}\right)\right)}{{\displaystyle {\displaystyle \sum _{q=0}^1}\exp \left(z_{i,q}\left(\mathbf{x}\right)\right)}}}.$$

(5)

Here, $p_{i,0}\left(\mathbf{x}\right)$ and $p_{i,1}\left(\mathbf{x}\right)$ are the probabilities of the benign and malicious classes, respectively, and their sum is one.

During local training, each EUC updates both parts of its detector. Only the convolutional parameters are sent to the aggregation server; the classification head remains local throughout training. This arrangement allows the EUCs to develop a common representation of consumption patterns without requiring them to use the same decision boundary. The input layer itself has no trainable parameters to aggregate.

For unperturbed training examples, the local classification loss is

$${\mathcal{L}}_i^{\mathrm{clean}}={\displaystyle \frac{1}{m_i}}{\displaystyle \sum _{j=1}^{m_i}}\ell \left({\mathbf{p}}_i\left({\mathbf{x}}_{ij}\right),\mathbf{e}\left(y_{ij}\right)\right),$$

(6)

where categorical cross-entropy is defined as

$$\ell (\mathbf{p},\mathbf{e}\left(y\right))=-{\displaystyle \sum _{c=0}^1}{e}_c\left(y\right)\log p_c.$$

(7)

For a one-hot label, this loss is the negative logarithm of the probability assigned to the true class.

Here, “clean” means that no adversarial evasion perturbation has been added. The clean dataset therefore includes both benign profiles and profiles containing FDI attacks.

3.1.2. Adversarial Training at Each EUC

An FDI attack may become harder to detect when the attacker adjusts the falsified readings using knowledge of the detector. To account for this behavior, each EUC generates adversarial versions of malicious training profiles and includes them in local training. These examples retain the malicious label: changing a profile to conceal an attack does not make the underlying activity benign.

Let ${\mathcal{D}}_i^{+}$ denote the malicious subset of ${\mathcal{D}}_i$, and let $\mathbf{e}\left(1\right)={[0,1]}^{\mathsf{T}}$ be the one-hot label of the malicious class. For a profile $\mathbf{x}$ in this subset, the adversarial perturbation is defined by

$${\mathsf{\delta }}_i^{*}\in \underset{\delta \in {\Delta }_i\left(\mathbf{x}\right)}{\arg \max } \ell \left(f_i(\mathbf{x}+\mathsf{\delta };\mathsf{\theta },{\mathsf{\varphi }}_i),\mathbf{e}\left(1\right)\right),$$

(8)

where

$${\Delta }_i\left(\mathbf{x}\right)=\left\{\mathsf{\delta }:{\parallel \mathsf{\delta }\parallel }_{\infty }\le ϵ,\mathbf{x}+\mathsf{\delta }\in {\mathcal{X}}_i\right\}.$$

(9)

The budget $ϵ$ limits the change to each reading, while ${\mathcal{X}}_i$ represents the input bounds enforced during attack generation. Both must be defined in the coordinate system in which the perturbation is applied. In our experiments, ${\mathcal{X}}_i$ requires every adversarial sample to remain physically valid and to preserve the purpose of the original FDI attack: (i) all readings are non-negative; and (ii) the daily consumption of the generated sample is at least 50% less than that of the original sample.

For a malicious input, categorical cross-entropy reduces to $-\log p_{i,1}\left(\mathbf{x}\right)$. Maximizing this loss therefore encourages the detector to assign a lower probability to the malicious class and, because the two softmax probabilities sum to one, a higher probability to the benign class.

For brevity, the model parameters are omitted from $f_i$ in the following expressions. The Fast Gradient Sign Method (FGSM) approximates the optimization with one gradient step:

$${\mathbf{x}}^{\mathrm{adv}}={\Pi }_{{\mathcal{B}}_{\infty }(\mathbf{x},ϵ)\cap {\mathcal{X}}_i}\left[\mathbf{x}+ϵ\mathrm{sign}\left({\nabla }_{\mathbf{x}}\ell \left(f_i\left(\mathbf{x}\right),\mathbf{e}\left(1\right)\right)\right)\right].$$

(10)

Here, $\Pi$ denotes projection onto the feasible input set, and ${\mathcal{B}}_{\infty }(\mathbf{x},ϵ)$ is the ${\ell }_{\infty }$ ball centered at $\mathbf{x}$. The Basic Iterative Method (BIM) instead applies a sequence of smaller updates:

$$\begin{array}{c}\hfill {\mathbf{x}}^{(k+1)}={\Pi }_{{\mathcal{B}}_{\infty }(\mathbf{x},ϵ)\cap {\mathcal{X}}_i}\left[{\mathbf{x}}^{\left(k\right)}+\alpha \mathrm{sign}\left({\nabla }_{{\mathbf{x}}^{\left(k\right)}}\ell \left(f_i\left({\mathbf{x}}^{\left(k\right)}\right),\mathbf{e}\left(1\right)\right)\right)\right].\end{array}$$

(11)

Here, ${\mathbf{x}}^{\left(0\right)}=\mathbf{x}$, $\alpha$ is the step size, and the final adversarial example is ${\mathbf{x}}^{\mathrm{adv}}={\mathbf{x}}^{\left(K\right)}$ after K iterations. In both methods, gradients are computed through the current local detector, including its personalized head.

The adversarial loss is

$${\mathcal{L}}_i^{\mathrm{adv}}={\displaystyle \frac{1}{|{\mathcal{D}}_i^{+}|}}\sum _{(\mathbf{x},1)\in {\mathcal{D}}_i^{+}}\ell \left(f_i\left({\mathbf{x}}^{\mathrm{adv}}\right),\mathbf{e}\left(1\right)\right).$$

(12)

Local training balances the original detection task with resistance to evasion:

$${\mathcal{L}}_i=(1-\lambda ){\mathcal{L}}_i^{\mathrm{clean}}+\lambda {\mathcal{L}}_i^{\mathrm{adv}},0\le \lambda \le 1.$$

(13)

The weight $\lambda$ determines the contribution of adversarial examples. Setting $\lambda =0$ gives training without adversarial examples. If a local dataset contains no malicious examples, that EUC uses the clean loss alone. The attack settings and loss weighting are specified in the experimental setup.

Across the participating EUCs, the learning objective is

$$\underset{\mathsf{\theta },{\mathsf{\varphi }}_1,\dots ,{\mathsf{\varphi }}_N}{\min }{\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{\mathcal{L}}_i(\mathsf{\theta },{\mathsf{\varphi }}_i).$$

(14)

Thus, the EUCs jointly learn the feature extractor while each retains control over its own classification head.

3.1.3. Collaborative Training Procedure

Figure 1 shows the exchange between the EUCs and the aggregation server. Initially, the server creates the shared parameters ${\mathsf{\theta }}^0$, and each EUC initializes its local head ${\mathsf{\varphi }}_i^0$. The server does not need a public dataset because its role is to initialize, aggregate, and distribute the shared parameters.

Figure 1. Training and inference phases of the proposed PFL-based FDI detector. EUCs exchange feature-extraction layers while retaining their classification layers locally.

At the beginning of round r, EUC i receives ${\mathsf{\theta }}^r$ and combines it with the head retained from its previous local training. It then updates both components over its local minibatches. A gradient-based update can be expressed as

$$\begin{array}{c}{\mathsf{\theta }}_i\leftarrow {\mathsf{\theta }}_i-{\eta }_{\theta }{\nabla }_{{\mathsf{\theta }}_i}{\widehat{\mathcal{L}}}_i,\hfill \\ {\mathsf{\varphi }}_i\leftarrow {\mathsf{\varphi }}_i-{\eta }_{\varphi }{\nabla }_{{\mathsf{\varphi }}_i}{\widehat{\mathcal{L}}}_i,\hfill \end{array}$$

(15)

where ${\widehat{\mathcal{L}}}_i$ is the minibatch loss computed using categorical cross-entropy, and ${\eta }_{\theta }$ and ${\eta }_{\varphi }$ are the learning rates. Adversarial examples are generated using the current model and treated as fixed inputs when updating its parameters.

After the local epochs are completed, the EUC uploads ${\mathsf{\theta }}_i^{r+1}$ and retains ${\mathsf{\varphi }}_i^{r+1}$. The server averages the uploaded shared parameters:

$${\mathsf{\theta }}^{r+1}={\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{\mathsf{\theta }}_i^{r+1}.$$

(16)

This equal-weight rule gives each participating EUC the same contribution to the shared model. The resulting parameters are distributed for the next round, while the local heads are carried forward without aggregation. Because all EUCs hold local datasets of equal size in our experiments (Section 5), the sample-size weights $m_i/{\sum }_j{m}_j$ of standard FedAvg reduce to $1/N$, so Equation (16) is equivalent to FedAvg. When local datasets differ in size, the sample-size-weighted rule should be used instead. Algorithm 1 summarizes the training process.

Algorithm 1 Training the Proposed Robust PFL Detector

Require: Local datasets ${\left\{{\mathcal{D}}_i\right\}}_{i=1}^N$; rounds R; local epochs E; AT weight $\lambda$; attack settings. Ensure: Personalized detectors ${\left\{f_i(·;{\mathsf{\theta }}^R,{\mathsf{\varphi }}_i^R)\right\}}_{i=1}^N$.   1: Server initializes ${\mathsf{\theta }}^0$.   2: Each EUC i initializes ${\mathsf{\varphi }}_i^0$.   3: for $r=0,\dots ,R-1$ do   4:    Server distributes ${\mathsf{\theta }}^r$.   5:    for each EUC i in parallel do   6:      Set ${\mathsf{\theta }}_i\leftarrow {\mathsf{\theta }}^r$ and retain the local head ${\mathsf{\varphi }}_i^r$.   7:      for $e=1,\dots ,E$ do   8:         for each local minibatch do   9:           Encode labels as one-hot vectors. 10:           if $\lambda >0$ and malicious examples are available then 11:              Generate adversarial examples using the current local detector and categorical cross-entropy. 12:              Compute the combined loss in Equation (13). 13:           else 14:              Compute the clean categorical cross-entropy loss. 15:           end if 16:           Update both shared and private parameters. 17:         end for 18:      end for 19:      Retain ${\mathsf{\varphi }}_i^{r+1}$ and upload ${\mathsf{\theta }}_i^{r+1}$. 20:    end for 21:    Compute ${\mathsf{\theta }}^{r+1}$ using Equation (16). 22: end for 23: Server distributes ${\mathsf{\theta }}^R$. 24: Each EUC combines ${\mathsf{\theta }}^R$ with its retained head ${\mathsf{\varphi }}_i^R$.

3.1.4. Inference Phase

Once training is complete, each EUC uses its personalized detector to assess daily profiles received from its consumers. The same preprocessing used during training is applied before classification. The decision is based on the softmax probability assigned to the malicious class:

$${\widehat{y}}_i=\left\{\begin{array}{cc}1,\hfill & p_{i,1}\left(\mathbf{x}\right)\ge {\tau }_i,\hfill \\ 0,\hfill & p_{i,1}\left(\mathbf{x}\right)<{\tau }_i,\hfill \end{array}\right.$$

(17)

where ${\tau }_i$ is the detection threshold. Since the two class probabilities sum to one, setting ${\tau }_i=0.5$ selects the class with the higher probability, with ties assigned to the malicious class. In all experiments, a uniform threshold ${\tau }_i=0.5$ is used for every EUC and for both FL and PFL, without per-EUC tuning.

The EUC performs inference locally. Neither the consumption profile nor the prediction needs to pass through the aggregation server.

3.2. Design Rationale

Adapting detection to individual EUCs: A detector trained on pooled data or through conventional FL uses a common decision function across participants. This can be restrictive when a consumption pattern that is typical for one EUC is unusual for another. Retaining local classification layers gives each EUC room to account for these differences, while the shared convolutional layers allow it to benefit from patterns observed elsewhere. The usefulness of this separation depends on how much transferable structure exists across the local datasets.

Reducing the exchanged model size: Only the shared portion of the detector is transmitted during training. Let $P_s$ and $P_p$ denote the numbers of shared and private parameters, respectively, and let b be the number of bytes used to represent one parameter. With N participating EUCs, R rounds, and one upload and one unicast download per EUC per round, the parameter communication cost is approximately

$$C_{\mathrm{PFL}}=2RNb{P}_s.$$

(18)

Sharing the complete model under the same conditions would require

$$C_{\mathrm{FL}}=2RNb(P_s+P_p).$$

(19)

The corresponding reduction is

$$\rho =1-{\displaystyle \frac{C_{\mathrm{PFL}}}{C_{\mathrm{FL}}}}={\displaystyle \frac{P_p}{P_s+P_p}}.$$

(20)

These expressions exclude protocol overhead and assume the same number of rounds.

Learning temporal features with a CNN: Daily consumption profiles contain local structures, such as sustained increases, sharp changes, and repeated patterns. One-dimensional convolutional filters can learn these structures by applying the same weights at different positions in the input sequence. A layer with kernel width k, $C_{\mathrm{in}}$ input channels, and $C_{\mathrm{out}}$ output channels contains

$$P_{\mathrm{conv}}=k{C}_{\mathrm{in}}{C}_{\mathrm{out}}+C_{\mathrm{out}}$$

(21)

trainable parameters when biases are included. Its parameter count is independent of the sequence length, although its computational cost is not. Deeper layers combine local responses over a wider receptive field. This architecture supports the proposed division between shared temporal features and local classification, without assuming that every CNN is smaller or faster than every recurrent alternative.

Training against attempts to evade detection: Ordinary supervised training does not explicitly account for attackers who adapt their inputs to evade the detector. We address this limitation by generating examples that increase the model’s loss and incorporating them into training with their correct labels. Generating these examples against the complete personalized detector allows both its shared feature extractor and local classification layers to be trained against evasion.

We consider two attack scenarios that differ in the attacker’s knowledge of the detection models. In the first, attackers submit false consumption data without using adversarial evasion techniques or having access to any EUC’s personalized detector. In the second, a malicious EUC uses its own personalized detector to craft adversarial examples using FGSM and BIM. We then evaluate these examples against other EUCs’ personalized detectors to assess whether attacks crafted for one utility can evade detection at another. This scenario examines attack transferability across utilities without requiring access to the target utilities’ models. Although the attacker has greater knowledge in this setting, the attack’s success depends on how effectively the adversarial examples transfer between personalized detectors.

Keeping consumer records within each EUC: The collaborative process exchanges shared model parameters rather than consumption records. Adversarial examples and personalized heads also remain local. This reduces the need to disclose consumer-level information to the aggregation server.

The proposed design brings these choices together in one detector per EUC. Shared convolutional learning supports collaboration, local classification layers provide personalization, and training on adversarial examples prepares the detector for the evaluated evasion attacks. Their combined effect is assessed through detection performance, attack success rate, and communication cost.

4. Datasets and FDI Attacks

This section begins with a description of the datasets used in our experiments and then discusses the FDI cyber-attacks targeting power consumption data.

4.1. Datasets

Our experiments use two publicly available, real-world electricity consumption datasets: the Ausgrid Solar Home Electricity dataset [38], collected and released by the Australian electricity distributor Ausgrid, and the Irish Smart Energy Trial (ISET) dataset [39], originating from the Electricity Customer Behaviour Trial conducted by Ireland’s Commission for Energy Regulation (CER). Table 1 summarizes the key characteristics of both datasets, including the number of consumers ($\mathcal{C}$), the number of collection days ($\mathcal{D}$), the number of readings per day, and the sampling interval.

Table 1. Description of Datasets.

	Dataset #1	Dataset #2
Name	Ausgrid	ISET
Readings	48 per day (30 min)	48 per day (30 min)
Total Days $\left(\mathcal{D}\right)$	324	536
Consumers $\left(\mathcal{C}\right)$	300 (100 PostalCode)	3639

Dataset #1 (Ausgrid): This dataset contains SM electricity consumption data collected from residential customers in Sydney city and surrounding regions in Australia. The dataset provides half-hourly electricity usage measurements, resulting in 48 readings per household per day, and spans approximately one year. In addition to detailed energy consumption records, the dataset includes selected household demographic and socioeconomic attributes, such as customer classifications and dwelling-related information. The high temporal resolution of the data enables the analysis of daily, weekly, and seasonal consumption patterns, making it well suited for energy forecasting, demand response studies, consumer behavior analysis, false data detection, and privacy-preserving machine learning research in smart grid environments.

Dataset #2 (ISET): This dataset contains high-resolution smart meter electricity consumption data collected from 3639 residential customers. The dataset provides half-hourly energy usage measurements, yielding 48 consumption readings per household per day over an extended monitoring period. In addition to detailed load profiles, it includes rich household-level metadata describing dwelling characteristics, appliance ownership, occupancy patterns, socioeconomic factors, and occupant behavior. These complementary attributes enable comprehensive analyses of the factors influencing residential electricity demand and facilitate the development of personalized energy management strategies. The combination of fine-grained consumption records and extensive contextual information makes the dataset particularly valuable for load forecasting, customer segmentation, demand response analysis, energy consumption modeling, false data detection, privacy-preserving machine learning, and explainable artificial intelligence applications in smart grid environments.

To ensure high-quality and accurate results, data preparation techniques such as cleaning and normalization were applied to eliminate noise and inconsistencies [40]. Missing values, duplicates, and errors were addressed during cleaning, while normalization standardized feature scales. As a result, the datasets were well-structured and appropriate for effective model training.

4.2. Attacks and Threat Model

Electricity consumption reports allow utilities to calculate bills and monitor demand across SG. An honest consumer submits readings that match their actual usage, denoted by $R_b\left(t\right)=R_{\mathrm{actual}}\left(t\right)$. A malicious consumer instead reports altered readings, denoted by $R_m\left(t\right)$, to reduce electricity charges or mislead the utility about their consumption.

This study considers two attacker settings. In the first, consumers manipulate their readings using predefined FDI strategies without knowing how the utility detects false data. In the second, attackers know the ML-based detector and use this knowledge to adjust false readings so that they appear benign to the model. In both settings, the attacker controls the readings submitted by the compromised consumer. The attacks target the detector’s inputs rather than the model updates exchanged during training.

4.2.1. FDI Attacks Without Adversarial Evasion

Building on attack strategies described in the literature [41], we develop five FDI attacks and consider them in this paper. Their resulting consumption profiles are denoted by $R_{m1}$ through $R_{m5}$. Some strategies alter readings throughout the day, whereas others modify only a selected period.

Let $R_b\left(t\right)$ represent a benign reading in a daily profile containing T equally spaced intervals, where $t\in \{0,\dots ,T-1\}$. The mean reading for that day is

$${\mathrm{Avg}}_d={\displaystyle \frac{1}{T}}{\displaystyle \sum _{t=0}^{T-1}}{R}_b\left(t\right).$$

(22)

• Continuous scaling. The consumer reports a fixed fraction of their actual usage at every interval:

  $$R_{m1}\left(t\right)=\alpha R_b\left(t\right),0<\alpha <1.$$

  (23)

  This reduces the reported consumption while retaining the original pattern of peaks and troughs.
• Intermittent scaling. The consumer underreports usage only between $t_{\mathrm{s}}$ and $t_{\mathrm{e}}$, using a reduction factor $\beta$:

  $$R_{m2}\left(t\right)=\left\{\begin{array}{cc}\beta R_b\left(t\right),\hfill & t_{\mathrm{s}}\le t\le t_{\mathrm{e}},\hfill \\ R_b\left(t\right),\hfill & \mathrm{otherwise},\hfill \end{array}\right.0<\beta <1.$$

  (24)

  Outside this period, the submitted readings match the actual consumption.
• Daily-mean replacement. Every reading is replaced with the mean of the actual daily profile:

  $$R_{m3}\left(t\right)={\mathrm{Avg}}_d.$$

  (25)

  The resulting profile is constant throughout the day. Although its daily total is unchanged, it conceals when electricity was consumed by removing the original fluctuations.
• Scaled daily-mean replacement. The consumer reports a reduced version of the daily mean at every interval:

  $$R_{m4}\left(t\right)=\gamma {\mathrm{Avg}}_d,0<\gamma <1.$$

  (26)

  This produces a flat profile with a lower daily total, combining temporal manipulation with underreporting.
• Time shifting. The consumer changes the reported timing of electricity use without changing the daily total. A circular shift of $\tau$ intervals is written as

  $$R_{m5}\left(t\right)=R_b\left((t-\tau )\mathrm{mod}T\right).$$

  (27)

  When electricity prices vary by time of day, a suitable shift can place higher readings in cheaper tariff periods and lower readings in more expensive periods. Whether this reduces the bill depends on the tariff schedule, the consumption pattern, and the chosen shift.

Figure 2 shows how these strategies change the daily readings of representative consumers from the Ausgrid and ISET datasets. Scaling reduces the reported usage, mean replacement removes fluctuations, and time shifting moves readings to different reporting intervals. These examples illustrate why false-data detection must consider both the amount of electricity reported and its distribution over time. An unchanged daily total does not necessarily indicate an honest report.

Figure 2. Actual and manipulated daily consumption profiles for representative consumers from the Ausgrid and ISET datasets.

4.2.2. FDI Attacks with Adversarial Evasion

An attacker with knowledge of the detector can take an additional step: adjusting an already falsified profile to make it less likely to be flagged. Rather than replacing the original FDI strategy, adversarial evasion adds a small perturbation to the false readings it produces.

Let ${\mathbf{R}}_{mx}$ denote a malicious profile generated by attack $x\in \{1,\dots ,5\}$. Its adversarial version is

$${\tilde{\mathbf{R}}}_{mx}={\mathbf{R}}_{mx}+\mathsf{\eta },{\parallel \mathsf{\eta }\parallel }_{\infty }\le ϵ,$$

(28)

where $\mathsf{\eta }$ is the added perturbation and $ϵ$ limits the change to each input component. The attacker seeks a profile that the detector accepts as benign while still serving the original false-reporting objective.

We consider the Fast Gradient Sign Method (FGSM) [16] and the Basic Iterative Method (BIM) [15]. Both use input gradients to increase the detector’s loss for the true malicious label. Because the detector performs binary classification, an incorrect prediction for a malicious sample assigns it to the benign class.

FGSM changes the profile in a single step:

$${\tilde{\mathbf{R}}}_{mx}={\mathbf{R}}_{mx}+ϵ\mathrm{sign}\left({\nabla }_{{\mathbf{R}}_{mx}}L({\mathbf{R}}_{mx},y;\theta )\right).$$

(29)

BIM makes several smaller changes, recalculating the gradient after each update. Starting from ${\mathbf{R}}_{mx}^{\left(0\right)}={\mathbf{R}}_{mx}$, it computes

$$\begin{array}{c}{\mathbf{R}}_{mx}^{(n+1)}={\mathrm{clip}}_{[{\mathbf{R}}_{mx}^{\left(0\right)}-ϵ,{\mathbf{R}}_{mx}^{\left(0\right)}+ϵ]}({\mathbf{R}}_{mx}^{\left(n\right)}+\delta \mathrm{sign}\left({\nabla }_{{\mathbf{R}}_{mx}^{\left(n\right)}}L({\mathbf{R}}_{mx}^{\left(n\right)},y;\theta )\right)),\hfill \end{array}$$

(30)

for $n=\{0,\dots ,N-1\}$. The final profile is ${\tilde{\mathbf{R}}}_{mx}={\mathbf{R}}_{mx}^{\left(N\right)}$. Clipping keeps each reading within $ϵ$ of its value in the initial malicious profile.

Here, y is the malicious label, $\theta$ contains the detector parameters, and L is the classification loss. The gradient is taken with respect to the input profile. The parameters $\delta$ and N determine the BIM step size and number of updates. If the detector uses normalized readings, the perturbation budget and step size are measured in those normalized units. Keeping the perturbation small limits how much the evasion attack changes the initial false profile. In addition to the budget $ϵ$, every evasion profile is required to satisfy the constraints of the feasible set ${\mathcal{X}}_i$ in Equation (9) after each perturbation step: all readings remain non-negative, and the daily consumption of the generated sample is at least 50% less than that of the original sample. Hence, the evaluated evasion examples remain physically valid and practically relevant electricity theft attacks.

For PFL, we evaluate evasion attacks under a transfer-based threat model. A malicious EUC has full knowledge of its own personalized detector, including its architecture, parameters, preprocessing, and loss function. It uses this detector to generate adversarial examples, which are then evaluated against the personalized detectors of other EUCs. The attacker therefore has white-box access to the source detector but no access to the target EUCs’ private classification layers. This setting allows us to assess whether adversarial examples crafted for one utility can evade detection at another.

For conventional FL, the attacker generates adversarial examples using the global model, which is available to all participating EUCs and serves as their common detector. The attacker consequently has white-box access to the detector being targeted. These two settings reflect the model information available to a malicious participant under each learning approach.

In both settings, the attacker can access its own local consumption readings to construct the initial false profiles; access to other consumers’ private training data is not required. Participation in PFL does not, by itself, reveal another EUC’s private classification layers. Our experiments therefore assess cross-utility attack transferability in PFL and direct white-box evasion in conventional FL. Although the two settings provide different levels of attacker knowledge, both evaluations assess how effectively a malicious EUC can attack other EUCs using the model information available within each learning paradigm. The same initial samples, attack algorithms, and perturbation budget are used in both settings. In FL, access to the shared global detector enables white-box attacks, whereas in PFL, private classification layers require the attacker to transfer adversarial examples generated using its own detector. Accordingly, the lower $ASR$ observed for PFL reflects its performance under this combination of adversarial training and restricted access to target detectors.

5. Performance Evaluation

This section describes the experimental setup, evaluation metrics, and results. We compare conventional FL with PFL in terms of false data detection, communication requirements, and robustness against adversarial evasion.

5.1. Experimental Setup

The experiments were conducted on a high-performance computing cluster at Tennessee Technological University (TTU). We used the datasets and FDI strategies described in Section 4 to train and evaluate the detectors. The implementation relied on Python libraries, including Pandas, Keras, Matplotlib, and Scikit-learn.

Detection model: Both FL and PFL use the same CNN-based detector [37]. The input layer receives 48 consumption readings representing one day of half-hourly measurements. A one-dimensional convolutional (Conv1D) layer with 128 filters and ReLU activation extracts patterns from neighboring readings. Its output is passed to three dense layers with 256, 128, and 64 units, using ReLU, ReLU, and sigmoid activations, respectively, which distinguish benign profiles from false reports. An output layer with two units and softmax activation produces the class probabilities. In PFL, the Input and Conv1D layers form the shared feature-extraction layers, whereas the dense and output layers remain local to each EUC. This architecture allows the detector to learn variations in consumption magnitude and local temporal structure.

Hyperparameter selection: We used random search to select the detector configuration. Candidate values were defined for the parameters being tuned, and randomly sampled combinations were assessed on the validation set. The selected configuration used the Adam optimizer, a learning rate of ${10}^{-4}$, a batch size of 50, and categorical cross-entropy loss. Federated training was performed for 100 communication rounds. The same backbone architecture and stated training settings were used for FL and PFL to support their comparison. The results in Table 2 and Table 3 are reported as the mean ± standard deviation over 5 independent runs with different random seeds for model initialization.

Evasion attack settings: FGSM was evaluated using perturbation budgets in the range $0.01<ϵ<0.5$, and the optimal $ϵ$ was selected through a search within this range. This selected value was then used as the perturbation budget for BIM, with the step size set as a fraction of the optimal $ϵ$ by dividing it by N, where $N=100$ is the number of iterations. These settings allowed us to examine how the permitted input modification affects evasion success. The perturbation budget and step size are expressed in the input units used by the detector.

5.2. Evaluation Metrics

We evaluate detection performance using accuracy ($ACC$), detection rate ($DR$), precision ($PR$), F1-score ($F1$), false alarm rate ($FA$), and highest difference ($HD$). Malicious profiles are treated as the positive class. Thus, a true positive ($TP$) is a malicious profile correctly detected, and a true negative ($TN$) is a benign profile correctly accepted. A false negative ($FN$) is a malicious profile classified as benign, whereas a false positive ($FP$) is a benign profile incorrectly flagged as malicious.

Accuracy measures the proportion of correctly classified profiles:

$$ACC={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}.$$

(31)

Detection rate, also referred to as recall, measures the fraction of malicious profiles identified by the detector:

$$DR={\displaystyle \frac{TP}{TP+FN}}.$$

(32)

Precision measures the fraction of flagged profiles that are actually malicious:

$$PR={\displaystyle \frac{TP}{TP+FP}}.$$

(33)

The F1-score combines precision and detection rate through their harmonic mean:

$$F1={\displaystyle \frac{2DRPR}{DR+PR}}.$$

(34)

The false alarm rate measures how often benign profiles are incorrectly classified as malicious:

$$FA={\displaystyle \frac{FP}{FP+TN}}.$$

(35)

The $HD$ metric captures the difference between detecting malicious profiles and incorrectly flagging benign ones. This difference is commonly called Youden’s J statistic and balances detection of malicious samples against false alarms on benign samples. It is computed as follows:

$$HD=DR-FA.$$

(36)

Higher $ACC$, $DR$, $PR$, $F1$, and $HD$ values indicate better detection performance, whereas a lower $FA$ is preferable.

The FL global model is evaluated on the union of the five EUC test sets, whereas each personalized detector is evaluated on the test set of its own EUC. Because the five test sets have equal size and the same 1:1 ratio of benign to malicious profiles, the column “All EUCs” in Table 2, Table 3, Table 4 and Table 5 reports the performance of the personalized detectors on the same combined test set used for FL, computed from the pooled confusion matrices. This enables a direct comparison on identical samples.

To compare communication requirements, we report the size of the model information exchanged during each collaborative training round, denoted by $MS$ and measured in kilobytes (KB). Conventional FL exchanges the full set of model parameters, whereas PFL exchanges only the shared parameters. This quantity should be distinguished from the size of the complete detector retained by each EUC.

Robustness against evasion attacks is evaluated using the attack success rate ($ASR$), defined as the percentage of malicious evasion samples that the detector misclassifies as benign:

$$ASR={\displaystyle \frac{N_{\mathrm{evasion}\to \mathrm{benign}}}{N_{\mathrm{evasion}}}}$$

(37)

where $N_{\mathrm{evasion}}$ is the total number of malicious evasion samples evaluated, and $N_{\mathrm{evasion}\to \mathrm{benign}}$ is the number classified as benign. A higher $ASR$ indicates more successful evasion and lower detector robustness. This metric includes all evaluated evasion samples, regardless of whether their original malicious profiles were correctly detected before perturbation. Each $ASR$ value is computed over $N_{\mathrm{evasion}}=6083$ evasion samples for Ausgrid and $N_{\mathrm{evasion}}=3560$ for ISET. When none of these samples evades a detector, the true attack success rate is not necessarily zero but is bounded: by the rule of three [42], its 95% upper confidence bound is approximately $3/N_{\mathrm{evasion}}$, i.e., 0.05% for Ausgrid and 0.08% for ISET. We therefore describe such cases as “no successful evasion observed under the tested conditions”.

5.3. Experimental Results

The evaluation consists of two experiments. Experiment #1 compares the detection performance and communication requirements of conventional FL and PFL without adversarial training. Experiment #2 evaluates the detection performance of the defended detectors and their robustness against FGSM and BIM attacks.

In both experiments, the Ausgrid and ISET datasets are partitioned into five local datasets, each representing an EUC. The partitions reflect differences in consumption patterns, while a different distribution of FDI strategies is assigned to each EUC to introduce variation in the malicious profiles. Together, these differences emulate a heterogeneous smart grid with non-IID local data.

For Ausgrid, consumers are grouped by postcode into five simulated EUCs: 2008–2087, 2088–2204, 2205–2259, 2260–2285, and 2286–2330. Figure 3 shows the geographic distribution of these groups. This partition represents utilities serving different geographic areas, where consumer characteristics and electricity usage may vary.

Figure 3. Geographic distribution of the Ausgrid postcode groups used to represent five EUCs.

For ISET, consumers are grouped according to their consumption patterns because geographic attributes are unavailable for the partitioning used in this study. We apply k-means clustering to form five groups, each representing an EUC. The choice of $k=5$ is guided by the elbow analysis shown in Figure 4. This partition represents utilities serving consumers with different electricity usage patterns.

Figure 4. Elbow-method analysis used to select five consumption-based clusters for the ISET dataset.

To introduce heterogeneity in attack characteristics, each EUC receives malicious samples from all five FDI strategies, but in different proportions. Specifically, $R_{m1}$ predominates at EUC1, $R_{m2}$ at EUC2, $R_{m3}$ at EUC3, $R_{m4}$ at EUC4, and $R_{m5}$ at EUC5, while each utility also receives smaller proportions of samples generated by the other four strategies. The same allocation scheme is used for both datasets. This setup allows us to evaluate collaborative detection when utilities differ in both their benign consumption patterns and the distribution of FDI attacks they encounter. After partitioning, the local datasets were down-sampled to the same size, so that each EUC holds 47,300 samples for Ausgrid and 21,440 samples for ISET, balanced between benign and malicious samples.

5.3.1. Experiment #1: Detection Performance and Communication Requirements

FL and PFL configurations: In conventional FL, each EUC sends the complete model parameters to the central server for aggregation. The resulting global detector is then used across the participating utilities. In PFL, only the trainable parameters of the Conv1D feature-extraction layer are shared and aggregated. The input layer specifies the input format and has no trainable parameters to exchange. Each EUC retains its dense and output layers locally, allowing its classification decisions to adapt to its own consumption patterns and FDI strategy. Both approaches therefore use the same detector architecture, but differ in which parameters are shared.

Ausgrid results: Table 2 compares the two approaches using $ACC$, $DR$, $PR$, $F1$, $FA$, $HD$, and $MS$. The conventional FL detector achieves an accuracy of 81.55%, whereas the personalized detectors achieve 95.35%, 97.75%, 97.40%, 96.70%, and 91.35% for EUC1 through EUC5, respectively. These correspond to accuracy gains of 13.80, 16.20, 15.85, 15.15, and 9.80 percentage points. The results indicate that retaining local classification layers helps the detectors accommodate differences among utilities. Although all five personalized detectors improve on the reported FL accuracy, their performance varies, showing that the benefit of personalization depends on the local data and attack characteristics.

The reported communication quantity also decreases from 306.63 KB per training round and EUC for FL to 3.50 KB for PFL, a reduction of approximately 98.86%. This saving arises from exchanging only the shared feature-extraction parameters rather than the complete model. On the same combined test set used for FL, the PFL detectors achieve an average accuracy of 95.71% and an average $HD$ of 91.02%, compared with 81.55% and 63.10% for FL.

ISET results: Table 3 presents the corresponding comparison for ISET. Conventional FL achieves an accuracy of 75.35%, while PFL achieves between 98.12% and 99.00% across the five EUCs. The resulting gains range from 22.77 to 23.65 percentage points. On the combined test set, PFL achieves an average accuracy of 98.82% and an average $HD$ of 97.93%, compared with 75.35% and 50.71% for FL.

As in the Ausgrid experiment, the reported communication quantity decreases from 306.63 KB for each training round to 3.50 KB. Together, these results show that partial sharing of model parameters can reduce communication requirements while allowing each utility to maintain a detector suited to its local data. Table 2 and Table 3 also report the number of communication rounds, out of the 100 training rounds, required for convergence. PFL converges in fewer rounds than FL on both datasets, so the per-round reduction translates into an even larger reduction in total communication cost.

Table 2. Performance comparison between the undefended FL and PFL detectors on the Ausgrid dataset.

	FL	Our PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	81.55 ± 0.45	95.35 ± 0.84	97.75 ± 0.38	97.40 ± 0.11	96.70 ± 0.12	91.35 ± 0.27	95.71 ± 0.34
$DR$	69.62 ± 1.38	95.10 ± 1.36	98.50 ± 0.72	99.00 ± 0.01	99.00 ± 0.01	90.40 ± 0.81	96.40± 0.58
$PR$	91.44 ± 0.43	95.58 ± 0.40	97.04 ± 0.92	95.06 ± 0.20	93.81 ± 0.22	92.15 ± 0.46	94.71± 0.44
$F1$	79.05 ± 0.71	95.34 ± 0.87	97.76 ± 0.37	96.99 ± 0.10	96.34 ± 0.11	91.27 ± 0.31	95.55± 0.35
$FA$	6.52 ± 0.50	4.40 ± 0.36	3.00 ± 0.96	5.20 ± 0.22	6.60 ± 0.24	7.70 ± 0.54	5.38 ± 0.46
$HD$	63.10 ± 0.89	90.70 ± 1.68	95.50 ± 0.76	93.80 ± 0.22	92.40 ± 0.24	82.70 ± 0.55	91.02 ± 0.69
$MS$	306.63 KB	3.50 KB
Conv. rounds	79 ± 5	64 ± 4	52 ± 6	36 ± 3	42 ± 4	73 ± 3	53 ± 4

Table 2. Performance comparison between the undefended FL and PFL detectors on the Ausgrid dataset.

	FL	Our PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	81.55 ± 0.45	95.35 ± 0.84	97.75 ± 0.38	97.40 ± 0.11	96.70 ± 0.12	91.35 ± 0.27	95.71 ± 0.34
$DR$	69.62 ± 1.38	95.10 ± 1.36	98.50 ± 0.72	99.00 ± 0.01	99.00 ± 0.01	90.40 ± 0.81	96.40± 0.58
$PR$	91.44 ± 0.43	95.58 ± 0.40	97.04 ± 0.92	95.06 ± 0.20	93.81 ± 0.22	92.15 ± 0.46	94.71± 0.44
$F1$	79.05 ± 0.71	95.34 ± 0.87	97.76 ± 0.37	96.99 ± 0.10	96.34 ± 0.11	91.27 ± 0.31	95.55± 0.35
$FA$	6.52 ± 0.50	4.40 ± 0.36	3.00 ± 0.96	5.20 ± 0.22	6.60 ± 0.24	7.70 ± 0.54	5.38 ± 0.46
$HD$	63.10 ± 0.89	90.70 ± 1.68	95.50 ± 0.76	93.80 ± 0.22	92.40 ± 0.24	82.70 ± 0.55	91.02 ± 0.69
$MS$	306.63 KB	3.50 KB
Conv. rounds	79 ± 5	64 ± 4	52 ± 6	36 ± 3	42 ± 4	73 ± 3	53 ± 4

Table 3. Performance comparison between the undefended FL and PFL detectors on the ISET dataset.

	FL	Our PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	75.35 ± 0.52	99.00 ± 0.17	99.00 ± 0.33	99.00 ± 0.16	99.00 ± 0.32	98.12 ± 0.66	98.82 ± 0.33
$DR$	52.61 ± 1.09	99.00 ± 0.15	99.00 ± 0.23	99.00 ± 0.20	99.00 ± 0.30	97.81 ± 1.03	98.76 ± 0.38
$PR$	96.52 ± 0.04	99.00 ± 0.26	98.83 ± 0.50	99.00 ± 0.13	99.00 ± 0.40	98.42 ± 0.32	99.17 ± 0.32
$F1$	68.10 ± 0.89	99.00 ± 0.17	98.91 ± 0.33	99.00 ± 0.16	99.00 ± 0.32	98.11 ± 0.67	98.96 ± 0.33
$FA$	1.90 ± 0.06	0.56 ± 0.26	1.18 ± 0.50	0.10 ± 0.13	0.73 ± 0.40	1.57 ± 0.32	0.83 ± 0.32
$HD$	50.71 ± 1.04	98.44 ± 0.35	97.82 ± 0.66	98.90 ± 0.32	98.27 ± 0.63	96.24 ± 1.33	97.93 ± 0.66
$MS$	306.63 KB	3.50 KB
Conv. rounds	68 ± 3	66 ± 3	41 ± 2	38 ± 2	32 ± 3	59 ± 4	47 ± 3

Table 3. Performance comparison between the undefended FL and PFL detectors on the ISET dataset.

	FL	Our PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	75.35 ± 0.52	99.00 ± 0.17	99.00 ± 0.33	99.00 ± 0.16	99.00 ± 0.32	98.12 ± 0.66	98.82 ± 0.33
$DR$	52.61 ± 1.09	99.00 ± 0.15	99.00 ± 0.23	99.00 ± 0.20	99.00 ± 0.30	97.81 ± 1.03	98.76 ± 0.38
$PR$	96.52 ± 0.04	99.00 ± 0.26	98.83 ± 0.50	99.00 ± 0.13	99.00 ± 0.40	98.42 ± 0.32	99.17 ± 0.32
$F1$	68.10 ± 0.89	99.00 ± 0.17	98.91 ± 0.33	99.00 ± 0.16	99.00 ± 0.32	98.11 ± 0.67	98.96 ± 0.33
$FA$	1.90 ± 0.06	0.56 ± 0.26	1.18 ± 0.50	0.10 ± 0.13	0.73 ± 0.40	1.57 ± 0.32	0.83 ± 0.32
$HD$	50.71 ± 1.04	98.44 ± 0.35	97.82 ± 0.66	98.90 ± 0.32	98.27 ± 0.63	96.24 ± 1.33	97.93 ± 0.66
$MS$	306.63 KB	3.50 KB
Conv. rounds	68 ± 3	66 ± 3	41 ± 2	38 ± 2	32 ± 3	59 ± 4	47 ± 3

5.3.2. Experiment #2: Adversarial Robustness Evaluation

This experiment examines whether the defended detectors can resist evasion attacks while maintaining reliable false-data detection. A key challenge is the potential trade-off between adversarial robustness and classification performance: training with adversarial examples can improve resistance to evasion but may reduce accuracy on unperturbed profiles.

We retrained the FL and PFL detectors from Experiment #1 using adversarial examples generated by BIM. These examples were derived from malicious consumption profiles and retained their malicious labels. Benign profiles accounted for half of the training samples, while the other half comprised malicious profiles, including adversarial examples.

We first evaluated robustness by applying FGSM and BIM to both sets of detectors and comparing their attack success rates ($ASR$). We then compared their classification performance on unperturbed benign and malicious profiles to assess the impact of the defense on the classification performance. Both evaluations were conducted using the Ausgrid and ISET datasets.

1. Robustness Against Evasion Attacks

Figure 5 shows the FGSM attack success rates on Ausgrid, with Figure 5a–e corresponding to attackers from EUC1–EUC5. Without defense, high $ASR$ values indicate that the detectors frequently accept perturbed malicious profiles as benign. With defense, attack success drops substantially for both FL and PFL.

Figure 5. The $ASR$ of the FGSM attack (Ausgrid Dataset).

The attacks use the model information available to each malicious participant. In FL, the attacker crafts examples using the global model that is also being targeted. In PFL, the attacker crafts examples using its own personalized model and tests them against other utilities’ detectors. Consequently, the FL results describe direct white-box evasion, while the PFL results show how well attacks transfer between utilities.

The varying attack success rates across personalized detectors suggest that examples crafted for one EUC do not affect all other EUCs equally. Differences in the learned models may restrict transferability, although these results alone do not establish which model or data characteristics are responsible. Some undefended PFL detectors already exhibit low $ASR$ (e.g., EUC_2 and EUC_5 in Figure 5a), indicating that part of the lower $ASR$ of PFL reflects limited transferability rather than adversarial training alone. We regard this reduced transferability as a practical security benefit of personalization, since a malicious participant cannot obtain the decision layers of other utilities.

For the EUC1 attacker in Figure 5a, the defense reduces the FL detector’s $ASR$ from 89.6% to 5.1%. The PFL detectors also become more resistant. In the same panel, the attack success rate against EUC4 falls from 90.6% to 0%. No successful evasion was therefore observed for this detector under the tested conditions.

Figure 6 presents the BIM results. Without defense, BIM achieves higher attack success rates than FGSM under the evaluated settings. Its repeated updates give the attacker several opportunities to adjust the perturbation using the model’s gradients. The defended detectors substantially reduce the success of BIM against both FL and PFL, following the same broad pattern observed for FGSM.

Figure 6. The $ASR$ of BIM attack (Ausgrid Dataset).

The ISET evaluation in Figure 7 leads to similar findings. Undefended detectors remain vulnerable to FGSM and BIM, whereas adversarially trained detectors show much lower attack success rates. For space considerations, Figure 7 includes only attacks generated by EUC1. Similar trends were observed for EUC2–EUC5: the undefended detectors were vulnerable to both FGSM and BIM, and adversarial training substantially reduced the $ASR$ for both FL and PFL, as shown in Appendix A.

Figure 7. The $ASR$ of FGSM and BIM attacks launched by EUC_1 using the ISET dataset.

Taken together, the experiments show that both FL and PFL benefit from the defense, with defended PFL detectors achieving lower attack success rates against the evaluated FGSM and BIM attacks, partly because of the reduced transferability of evasion examples across personalized detectors, while retaining the communication benefits of partial parameter sharing. The findings across both datasets support the use of defended PFL in the heterogeneous utility settings examined in this study. However, these robustness gains should be considered alongside the defense’s impact on classification performance, as discussed in the next subsection.

2. Detection Performance of Defended Detectors

Table 4 reports the performance of the defended detectors on Ausgrid. It can be seen that our PFL detectors achieve higher accuracy, detection rate, precision, F1-score, and $HD$ than the defended conventional FL detector. Their advantage in false alarm rate varies across utilities: EUC1–EUC4 achieve lower rates than defended FL, whereas EUC5 exhibits a higher rate. Nevertheless, all five PFL detectors achieve substantially higher $HD$ values. Since $HD=DR-FA$, these results indicate a better balance between detecting malicious profiles and avoiding false alarms.

A comparison with Table 2 shows how the defense affects classification performance. For conventional FL, accuracy decreases from 81.55% to 74.20%, while the false alarm rate increases from 6.52% to 20.74%. For PFL, the undefended detectors achieve accuracies of 95.35%, 97.75%, 97.40%, 96.70%, and 91.35% for EUC1–EUC5, respectively. After incorporating the defense, these values become 88.50%, 92.95%, 97.95%, 87.80%, and 86.25%. Accuracy therefore decreases for four EUCs, whereas EUC3 shows a slight improvement. The false alarm rates change from 4.40%, 3.00%, 5.20%, 6.60%, and 7.70% for the undefended detectors to 18.60%, 14.10%, 4.10%, 20.40%, and 21.40%, respectively, increasing for all utilities except EUC3.

Although the defense affects each utility differently, all five defended PFL detectors retain higher accuracy than defended FL, with gains ranging from 12.05 to 23.75 percentage points. These findings suggest that retaining local classification layers helps utilities distinguish benign from malicious profiles when adversarial examples are included in training. However, the benefit varies with local data and attack characteristics. In particular, EUC5 has a higher false alarm rate than defended FL despite achieving higher accuracy, showing that better overall classification does not necessarily translate into fewer unnecessary alerts. On the same combined test set, the defended PFL detectors achieve an average accuracy of 90.69%, compared with 74.20% for defended FL.

The ISET results in Table 5 show a clearer advantage for the defended PFL detectors. Their accuracies are 95.62%, 94.86%, 95.17%, 93.06%, and 93.46% for EUC1–EUC5, respectively, compared with 65.80% for defended FL. Their false alarm rates range from 7.30% to 11.18%, consistently below the 14.56% recorded for defended FL. Compared with Experiment #1, accuracy decreases by 9.55 percentage points for FL and by 3.38–5.94 percentage points for PFL. All five personalized detectors therefore retain higher accuracy and experience a smaller accuracy loss after incorporating the defense. On the combined test set, the defended PFL detectors achieve an average accuracy of 94.43%, compared with 65.80% for defended FL.

Experiment #1 shows that PFL substantially reduces communication requirements compared with conventional FL by sharing only selected model parameters with the server. Experiment #2 demonstrates that, although adversarial training generally reduces classification performance, the defended PFL detectors retain higher accuracy than defended FL. These findings suggest that personalization helps alleviate the trade-off between detection performance and adversarial robustness. By retaining local classification layers, PFL maintains strong detection performance while improving resistance to evasion attacks. Although the accuracy loss varies across utilities, it is smaller than that of FL for most Ausgrid detectors and all ISET detectors. PFL therefore offers a favorable balance among detection performance, communication efficiency, and resistance to the evaluated evasion attacks.

Table 4. Performance comparison between the defended FL and PFL detectors on the Ausgrid dataset.

	Defended FL	Our Defended PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	74.20	88.50	92.95	97.95	87.80	86.25	90.69
$DR$	69.14	95.60	99.00	99.00	99.00	93.90	97.30
$PR$	76.92	83.71	87.64	96.06	80.39	81.44	86.09
$F1$	72.82	89.26	92.97	97.51	88.73	87.23	91.35
$FA$	20.74	18.60	14.10	4.10	20.40	21.40	15.72
$HD$	48.40	77.00	84.90	94.90	78.60	72.50	81.58

Table 4. Performance comparison between the defended FL and PFL detectors on the Ausgrid dataset.

	Defended FL	Our Defended PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	74.20	88.50	92.95	97.95	87.80	86.25	90.69
$DR$	69.14	95.60	99.00	99.00	99.00	93.90	97.30
$PR$	76.92	83.71	87.64	96.06	80.39	81.44	86.09
$F1$	72.82	89.26	92.97	97.51	88.73	87.23	91.35
$FA$	20.74	18.60	14.10	4.10	20.40	21.40	15.72
$HD$	48.40	77.00	84.90	94.90	78.60	72.50	81.58

Table 5. Performance comparison between the defended FL and PFL detectors on the ISET dataset.

	Defended FL	Our Defended PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	65.80	95.62	94.86	95.17	93.06	93.46	94.43
$DR$	46.16	99.00	98.88	97.64	95.84	98.09	97.89
$PR$	76.02	91.94	91.52	93.04	90.79	89.77	91.39
$F1$	57.44	95.34	95.06	95.28	93.25	93.75	94.53
$FA$	14.56	8.76	9.16	7.30	9.72	11.18	9.22
$HD$	31.60	90.24	89.72	90.34	86.12	86.91	88.67

Table 5. Performance comparison between the defended FL and PFL detectors on the ISET dataset.

	Defended FL	Our Defended PFL Detectors
	Global Model	EUC_1	EUC_2	EUC_3	EUC_4	EUC_5	All EUCs
$ACC$	65.80	95.62	94.86	95.17	93.06	93.46	94.43
$DR$	46.16	99.00	98.88	97.64	95.84	98.09	97.89
$PR$	76.02	91.94	91.52	93.04	90.79	89.77	91.39
$F1$	57.44	95.34	95.06	95.28	93.25	93.75	94.53
$FA$	14.56	8.76	9.16	7.30	9.72	11.18	9.22
$HD$	31.60	90.24	89.72	90.34	86.12	86.91	88.67

6. Discussion

6.1. Summary of the Results and Practical Implementation

The experiments show that sharing only the feature-extraction layers reduces the data exchanged per round and utility from 306.63 KB to 3.50 KB while allowing each EUC to maintain a detector suited to its local data and attack mix. Adversarial training substantially reduced the success of the evaluated FGSM and BIM attacks for both FL and PFL, and the accuracy loss caused by the defense was smaller for most personalized detectors than for the global FL model. Part of the lower $ASR$ observed for PFL reflects the reduced transferability of evasion examples across personalized detectors, which is a practical security benefit of keeping the classification layers private.

A new EUC can join the federation without retraining the existing detectors: it receives the current shared layers, trains its own classification layers on its local data, and then participates in subsequent rounds. Because the classification layers of the existing EUCs are never aggregated, their decision functions are not overwritten, while the newcomer can adapt to an attack distribution that differs from those of the other EUCs, as observed in our experiments, where each EUC was dominated by a different FDI attack type.

The proposed approach can be integrated into the existing advanced metering infrastructure (AMI) of each utility. Smart meters already transmit half-hourly readings to the utility’s head-end system and meter data management system (MDMS), where the daily profiles used by the detector are available. Local training and inference can therefore run on the utility’s existing servers, without access to individual meters and without new field hardware. The aggregation server performs only parameter averaging and can be hosted by a neutral party, such as a regulator or system operator, or by one of the participating utilities. The additional costs for utilities are therefore limited to software integration, a modest computing allocation for training, and the operation of the aggregation server and its secure communication channel, while exchanging only the feature-extraction layers substantially reduces network costs.

6.2. Limitations

Both datasets contain residential consumers; small and medium-sized enterprises, whose consumption depends on varying production processes, may exhibit substantially different profiles. In addition, the EUCs were simulated by partitioning the datasets, and the FDI attacks were synthetically generated. The defended detectors were evaluated only against FGSM and BIM, the attacks used in adversarial training, which does not guarantee robustness against optimization-based, gradient-free, or adaptive attacks [43,44]. Finally, although raw data and classification layers remain local, the shared convolutional updates may still reveal information about each EUC’s data, such as its dominant attack type, through property-inference [45] or gradient-inversion attacks [46,47], as in conventional FL.

6.3. Future Research Directions

Future work will address the limitations identified above. First, the approach will be validated on commercial and industrial consumption data and on data from real utility deployments with naturally partitioned EUCs and real-world FDI incidents. Second, robustness will be evaluated against optimization-based, gradient-free, and adaptive evasion attacks, together with ways to reduce false alarms without weakening adversarial robustness. Third, privacy-enhancing protection of the shared updates, such as secure aggregation [48] and differential privacy [11,27], will be integrated to mitigate this leakage risk, and its effect on detection performance will be quantified; its additional computational cost is reduced because only the feature-extraction parameters are exchanged. Finally, the approach will be benchmarked against other PFL algorithms under adversarial training.

7. Conclusions

This paper investigated how utilities can collaboratively detect false consumption reports when their data and attack patterns differ. We developed a PFL approach that shares feature-extraction parameters while keeping classification layers local to each utility. Adversarial training was incorporated to strengthen resistance to evasion. The approach keeps raw consumption data at each utility, requires only one detector per participant, and does not rely on a public dataset at the server.

Experiments on Ausgrid and ISET showed that both FL and PFL were vulnerable to FGSM and BIM before adversarial training. After training with adversarial examples, attack success rates decreased substantially, with no successful evasion observed for some personalized detectors under the tested conditions. The defended PFL detectors achieved accuracies of 86.25–97.95% on Ausgrid and 93.06–95.62% on ISET. Their accuracy exceeded that of defended FL by up to 23.75 and 29.82 percentage points, respectively. Sharing only selected parameters also reduced the reported communication quantity by approximately 98.86%.

The benefits of adversarial training came with some loss of classification accuracy, but personalization helped limit this loss for most Ausgrid utilities and all ISET utilities. Overall, sharing only the feature-extraction layers reduced the communication per round by approximately 98.86% while improving detection accuracy over conventional FL and, with adversarial training, increasing robustness against the evaluated evasion attacks. These results show that partial parameter sharing and local personalization offer a practical route to accurate, communication-efficient, and robust FDI detection in heterogeneous smart grids.