Differentially Private Federated Learning for Remaining Useful Life Prediction

Abstract

Accurate remaining useful life (RUL) prediction is essential for the safe and cost-effective operation of safety-critical systems such as electronic components and engines. While data-driven machine learning approaches have demonstrated strong performance for RUL estimation, their effectiveness is limited by the lack of full run-to-failure data and by strict privacy and intellectual property constraints in industrial settings. Federated learning (FL) enables collaborative model training across multiple data owners without direct data sharing, but it does not, by itself, provide formal privacy guarantees and remains vulnerable to information leakage. This paper presents a privacy-preserving DP-enhanced FL setup for RUL prediction that combines federated learning with differential privacy (DP). We describe an end-to-end implementation based on the Opacus DP library, highlight practical challenges arising from the integration of DP into recurrent neural network architectures, and propose solutions to address them. Using two representative RUL datasets (CMAPSS and SiC MOSFET), we analyze the effect of DP noise on prediction performance and on the functional dependence between the predicted RUL and the already lived life feature. The results demonstrate that differential privacy can be integrated into federated RUL prediction with limited degradation in predictive performance, providing practical insights for deploying privacy-aware collaborative models in industrial environments.

1. Introduction

Remaining useful life (RUL) prediction plays a crucial role in maintenance planning for safety-critical systems such as electronic components and engines [1]. Its accurate estimation helps to reduce unexpected failures, optimize maintenance schedules, and extend asset life. However, due to the proprietary nature of industrial data, privacy concerns become a significant challenge in developing robust RUL prediction models. The estimation of RUL can be formulated as a regression task where time-series sensor data is mapped to the predicted remaining lifetime [2]. Traditional physics-based and statistical models require detailed knowledge of system degradation, which is often unavailable or costly to obtain. Recent advances in machine learning have enabled data-driven RUL prediction; however, the need for large, diverse datasets remains a key bottleneck, particularly in the heterogeneous domain of electronic component manufacturing. While individual manufacturers differentiate themselves through proprietary designs, materials, and process parameters, many electronic components share common physical principles, architectures, and failure mechanisms. Accordingly, if distinct manufacturers were willing and able to share component characterization and degradation data, the aggregated knowledge could benefit all participating parties. A combined dataset would not only increase data volume but also expand variability across operating conditions, design configurations, and usage profiles. Consequently, machine learning models trained on such enriched datasets would be better positioned to generalize and deliver more reliable RUL predictions for electronic components across diverse application contexts.

Ensuring continuous operation of engineered systems is a major challenge in their deployment and use. A key requirement for addressing this challenge is the ability to accurately assess the system’s health state at any given time. As the complexity of modern safety-critical products and assets has increased, an engineering discipline and research area dedicated to the systematic evaluation of system degradation has emerged, known as prognostics and health management (PHM). PHM aims to estimate the state of health of a system and to develop actionable maintenance plans based on these estimates. State-of-health estimation can be performed in several ways, one of the most common being the estimation of the RUL. RUL is defined as the remaining operational time of an asset until a specified failure criterion is reached. RUL estimation can be carried out using a variety of approaches, including statistical analysis, simulation, and physics- or model-based methods.

Due to recent advancements, it is common to use machine learning to predict RUL. Indeed, when one has access to full run-to-failure (RTF) trajectories, RUL prediction is conveniently described as a supervised machine learning problem, where a mapping is learned from system measurements over time (usually time series) to the corresponding RUL. The main challenge with this approach is to gather a sufficient amount of training data so that the model can attain acceptable performance. As noted, training data must contain full RTF trajectories, which can be difficult, expensive and risky to collect. For safety-critical assets, examples of RTF histories are rare or non-existent. This means that existing data need to be leveraged efficiently. To this end, multiple solutions have been suggested, ranging from unsupervised machine learning methods to relying on synthetic data.

One promising approach is to use data from multiple actors to train the models, thereby increasing the training data size. However, simply pooling data from actors is often infeasible, due to e.g., privacy, data governance, and intellectual property issues [3]. To overcome this challenge, distributed machine learning methods can be used, such as federated learning (FL). In FL, actors (or clients in FL terminology) do not share training data among themselves; only model updates are shared. In this way, data sharing issues are ameliorated while still enabling the model to train on a larger set of samples, in a collaborative manner [4].

Federated learning has been explored for RUL estimation [5,6,7]. But FL alone does not guarantee privacy, since portions of data can be extracted from the shared model to which all parties can gain access. Differential privacy (DP) is a possible solution to make a private system even more private.

In this paper we develop an implementation for privacy-preserving RUL estimation leveraging FL and DP, discuss challenges and solutions that arise in the implementation using the Opacus DP library, and analyze the privacy–utility trade-off that results from applying DP. While this study utilizes laboratory data, these serve as proxies for real-world monitoring telemetry from power electronics. Such data are inherently sensitive as they capture the precise usage profiles and operational stress of the devices. If an adversary were to gain insight into how these devices are utilized, the consequences are twofold. From a user privacy perspective, such as in heavy electric vehicle operations, revealing load profiles can expose driving patterns, schedules, and locations. More critically, from an industrial perspective, these data often contain intellectual property. If the attacker is a competitor, inferring the usage profile can reveal proprietary control strategies or specific configuration parameters, potentially leading to a loss of competitive advantage and economic losses. Work operates under an honest-but-curious threat model, where the server and clients strictly adhere to the training protocol but analyze all incoming information (gradients, updates, side-channels) to infer private data. DP serves as a robust defense in this setting. DP does not guarantee correctness against such malicious actors; however, we argue that the honest-but-curious model is the most realistic assumption for the power electronics monitoring domain. In this context, participants are likely to be industrial entities or grid operators within a consortium; they share a strong economic incentive to collaborate on a high-performing RUL model (disincentivizing malicious destruction) but remain business competitors with a potential incentive to glean proprietary insights from one another (incentivizing curiosity). Thus, DP provides the necessary assurance to enable collaboration among competitors.

2. Background

2.1. Federated Learning

Federated learning (FL) is a distributed approach to training machine learning models [8]. It was introduced to address the limitation of centralized training, which requires all training data to be collected in a single location. In many practical settings, this requirement is infeasible because training data are often sensitive, private, or proprietary, making centralized data aggregation unacceptable.

In FL, training data are never shared; only model parameters are exchanged. Each participant in the federation, referred to as a client, maintains a private local training dataset. However, privacy leakage may still occur through the transmission of model updates (gradients or weight differences). These updates are computed from local training data and therefore encode structured information about input features and target values. Training proceeds over multiple federation rounds, selected to allow the global model to converge. Before training, the global model is randomly initialized and distributed to each of the K clients. During each federation round, clients train the global model locally on their own data for E epochs. The locally updated models are then sent to a central coordinating server, which aggregates the K client updates. Aggregation can be performed using various methods, most commonly the Federated Averaging (FedAvg) algorithm [8], which computes a weighted average of the client models. The resulting global model is then redistributed to the clients to initiate the next federation round.

A key advantage of FL is that local training data remain on the clients, improving data privacy. However, standard FL remains vulnerable to attacks such as membership inference [9] and gradient inversion [10]. As a result, additional privacy-preserving mechanisms, such as differential privacy, are often required.

2.2. Differential Privacy

Differential privacy (DP) is a mathematical framework designed to ensure that the inclusion or exclusion of any single data sample, referred to as a data point, in a dataset does not significantly affect the output of a model [11]. It provides formal privacy guarantees by introducing calibrated random noise either to the data, gradients, or model parameters during training. This noise prevents adversaries from inferring whether specific data points were part of the training set, thus mitigating privacy risks such as membership inference or model inversion attacks.

Differential privacy is commonly formalized using the $(\epsilon ,\delta )$-differential privacy definition [11], which quantifies privacy leakage through two parameters. An algorithm is said to satisfy $(\epsilon ,\delta )$-DP if, for any two neighboring datasets differing by a single data point, the probability of any given output differs by at most a multiplicative factor of $e^{\epsilon }$, plus an additive term $\delta$. The parameter $\epsilon$ bounds the worst-case influence of an individual data point on the output, with smaller values corresponding to stronger privacy guarantees, while $\delta$ represents a small probability of privacy failure beyond the $\epsilon$ bound. This relaxation enables the use of practical mechanisms, such as Gaussian noise, while still providing rigorous and quantifiable protection against adversaries with arbitrary side information.

In machine learning (ML) applications, there are three primary approaches for introducing differential privacy through noise injection [12], as illustrated in Figure 1:

• Data-level DP: Applying DP directly to the data can achieve strong privacy guarantees, but often results in poor utility due to the substantial distortion required to obfuscate individual data samples.
• Training-level DP: Incorporating DP into the training process via a privacy-aware optimizer is currently the most widely adopted approach. It offers the best trade-off between data-level and gradient-level DP by directly influencing learning dynamics and reducing the risk of the model memorizing specific data characteristics.
• Model-level DP: Applying DP to the final model or its gradients typically yields the highest utility. However, this allows the model to learn more precise information about the data, which can limit the achievable privacy guarantees unless significant noise is added.

One common approach is adding noise to the gradients used for model updates during training [13]. This approach typically offers one of the best privacy–utility trade-offs and was therefore selected for applying DP to the machine learning models in this work. However, the introduction of noise inevitably degrades learning accuracy: gradient updates become less precise, training convergence slows, and training loss remains higher compared to non-private training.

The magnitude and structure of the injected noise are determined by the chosen DP mechanism. The most widely used mechanisms are the Laplace and Gaussian mechanisms [11,14], from which more advanced formulations such as Rényi differential privacy [15] have been derived. Each successive mechanism improves on earlier ones, either by reducing the amount of noise required for a given privacy level or by providing tighter bounds on the privacy parameters, enabling stronger privacy guarantees for the same utility.

A theoretical comparison of available DP libraries motivated the selection of Opacus [16]. A possible alternative—TensorFlow Privacy [17]—requires manual configuration of the privacy accountant, including precomputing parameters such as the noise multiplier to achieve a target privacy level [13]. In contrast, Opacus allows direct specification of the desired privacy budget, with the library automatically managing the accounting process using Rényi differential privacy [15]. For these reasons, Opacus was employed in this work and adapted in two distinct ways to meet the specific requirements of our neural models.

In the considered FL + DP setting, all input features used for RUL prediction are treated as sensitive industrial information. These features include sensor measurements and their behavior patterns during degradation. If an adversary is able to acquire individual sensor values or their change during time, it may be able to identify valuable proprietary information such as design patterns and materials that the competitors are using. Also, life-cycle information (time until failure) and degradation profiles (how fast performance degrades) of specific examples should be kept private, as leaked such information could provide adversaries with advantages for product market positioning and pricing. The addition of noise through the application of DP reduces the possibility of the possible attacker inferring such information.

2.3. Differentially Private Training with Opacus

Opacus is a PyTorch v2.6 library that implements differentially private training by instantiating the Differentially Private Stochastic Gradient Descent (DP-SGD) algorithm [13] and exposing it via a small set of wrappers around the model, optimizer, and data loader [16]. DP-SGD enforces privacy at each optimization step by bounding the contribution of each example through per-example gradient clipping, and adding calibrated Gaussian noise to the aggregated update. For a minibatch $B_t$, loss function $\mathcal{L}$, and model parameters ${\theta }_t$, DP-SGD first computes per-example gradients $g_i={\nabla }_{{\theta }_t}\mathcal{L}({\theta }_t;x_i)$, $x_i\in B$ and clips them to an ${\mathsf{\ell }}_2$ norm bound C:

$${\overline{g}}_i={\displaystyle \frac{g_i}{max\left(1,\parallel g_i{\parallel }_2/C\right)}}.$$

(1)

It then

averages the clipped gradients and adds isotropic Gaussian noise:

$${\tilde{g}}_t={\displaystyle \frac{1}{|B_t|}}\left(\sum _{i\in B_t}{\overline{g}}_i+\mathcal{N}\left(0,{\sigma }^2{C}^{2}I\right)\right),{\theta }_{t+1}={\theta }_t-\eta {\tilde{g}}_t,$$

(2)

where $\sigma$ is the noise multiplier and $\eta$ is the learning rate. Clipping bounds the step sensitivity, while the Gaussian perturbation yields a (subsampled) Gaussian mechanism whose repeated application can be composed into a final $(\epsilon ,\delta )$ guarantee [11,13].

Opacus centralizes DP training through PrivacyEngine, whose make_private method returns DP-aware analogues of the training objects [16]:

• Model wrapper (per-sample gradients). A GradSampleModule wrapper instruments the network to compute and store per-sample gradients (e.g., in p.grad_sample) needed by DP-SGD.
• DP optimizer (clip + noise). A DP optimizer consumes per-sample gradients, applies norm clipping, adds Gaussian noise, and writes the privatized batch gradient used by the underlying base optimizer step.
• DP data loader (Poisson sampling). A DPDataLoader replaces standard fixed-size minibatching with Poisson (independent) sampling, matching the subsampling assumptions typically used for privacy amplification and accounting in DP-SGD.

Standard PyTorch autograd computes gradients aggregated at the batch level, whereas DP-SGD requires gradients to be computed on a per-example basis so that each individual contribution can be clipped prior to aggregation. Opacus computes per-sample gradients using a hooks-based approach (GradSampleModule) with layer-specific implementations; this enables vectorized computation for common modules (often substantially faster than microbatching).

Some layers and training behaviors can invalidate per-sample gradient semantics or introduce cross-example coupling (e.g., batch-dependent normalization statistics). Opacus provides a ModuleValidator workflow to detect incompatibilities and (when possible) rewrite the model into DP-compatible alternatives.

DP guarantees for iterative DP-SGD depend on both the noise mechanism and how minibatches are formed. Under Poisson subsampling, privacy amplification results apply, improving the effective privacy loss relative to full-dataset access [18]. To report a final privacy budget, Opacus composes the per-step guarantees using explicit privacy accountants. In particular, it supports (at least) Rényi DP (RDP) accounting [19], Gaussian differential privacy (GDP) accounting [14], and Privacy Random Variable (PRV)-based numerical composition [20]. These accountants map the training configuration (sampling rate, noise multiplier, number of steps) and a target $\delta$ to a corresponding $\epsilon$.

3. Datasets

For testing our MLP-LSTM-MLP model, we utilized the NASA open-source database C-MAPSS [21], which provides sequential data from aircraft engine sensor measurements. This dataset is widely regarded for its reliability and comprehensiveness in capturing degradation patterns and operational behaviors of complex systems under varying conditions. On the other hand, for our ConvGRU model, we employed the MOSFET database, which is a closed-source dataset [22,23]. The MOSFET database comprises proprietary experimental data collected from 3.3 kV SiC (Silicon Carbide) MOSFETs under carefully controlled electrical and thermal stress tests. Similar to C-MAPSS, the MOSFET dataset provides sequential degradation data over time, which can be used to assess the RUL of power semiconductor devices by tracking the progression of key indicators such as threshold voltage and on-resistance under stress.

3.1. C-MAPSS Dataset

The Commercial Aero-Propulsion System Simulation (C-MAPSS) dataset features comprehensive RTF trajectories collected from simulated degradation of turbofan jet engines, initially presented and developed by [21]. The dataset consists of simulated flight cycles with data recorded from 24 sensors. In our experiments to train the model, we use 18 parameters: the cycle index (from which the already lived life and sequence length can be derived), followed by 21 sensor measurements, including total temperature measurements at multiple compressor/turbine stages, pressure measurements, fan and core rotational speeds, fuel flow, and bleed enthalpy. Detailed sensor descriptions are provided in the original NASA C-MAPSS documentation.

The dataset consists of four subsets (FD001, FD002, FD003, and FD004) comprising a variety of operating conditions and fault modes. In addition, for each subset, a data split is provided for model development purposes, ensuring users have the same samples in training and testing. In

Table 1. The C-MAPSS dataset details. Here, HPC means high pressure compressor.

Dataset	Train	Val.	Test	Op. Con.	Fault Modes
FD001	80	20	100	1	HPC degradation
FD002	208	52	259	6	HPC degr.
FD003	80	20	100	1	HPC and fan degr.
FD004	199	50	248	6	HPC and fan degr.

the dataset is summarized, including training/testing split, number of operating conditions, and fault mode.

3.2. SiC MOSFET Dataset

The SiC MOSFET dataset was developed in response to the growing complexity of modern electronics and the lack of monitoring capabilities for such components. To ensure the safety and reliability of electronics components, proper prognostics and health monitoring systems need to be implemented. Gathering real-world degradation data from electronics components is often difficult and costly, leading to a scarcity of such data. To address this challenge, the SiC MOSFET dataset was developed, to promote research in PHM for electronics and drive innovation in RUL prediction for power electronics.

The dataset consists of RTF trajectories of 33 wire-bonded SiC MOSFETs. In particular, the devices were subjected to accelerated aging through power cycling, which involves heating the devices by passing a current for some specified duration (ON time), and subsequently cooling the devices by stopping the current for some other duration (OFF time). This heating/cooling cycle causes stress and fatigue in the devices and eventually leads to failure, mainly related to bond wire fatigue modes [24]. Further details of the SiC MOSFET dataset can be found in the paper introducing the dataset, and it is used for RUL prediction [6].

The three main factors determining degradation acceleration are the current and the ON/OFF time durations. A higher current passed through the SiC MOSFET means more heat is generated (larger temperature swings), which in turn decreases the time to failure. Similarly, longer ON duration led to shorter lifespans. The settings for the four experiment rounds are presented in

Table 2. The SiC MOSFET dataset, indexed by experiment number. In total, four rounds are included with varying currents, number of devices (see DUT column), and ON/OFF durations.

Exp. No.	Current (A)	DUT	ON (s)	OFF (s)
1	25 A	5	10	10
2	23 A	10	10	10
3	24 A	10	10	10
5	25 A	10	15	10

.

From the MOSFET dataset, we use 19 features, including the cycle index, end voltage, end resistance, differential resistance, cleaned differential resistance, minimum and maximum temperature values, two sets of block temperature measurements, water inlet and outlet temperature statistics, mean block temperature, voltage derived from mean block temperature, differential voltage, and cleaned differential voltage. These feature sets collectively capture the operational and degradation characteristics required for remaining useful life prediction.

4. Related Work

Accurate RUL prediction for safety-critical systems has advanced significantly through data-driven machine learning methods, particularly deep learning applied to time-series degradation data [25]. Federated learning (FL) has emerged as a promising approach for industrial prognostics by allowing collaborative model training through the exchange of model updates instead of raw data [26]. However, FL alone does not provide formal privacy guarantees and remains vulnerable to privacy attacks, motivating its integration with differential privacy (DP) to create Differentially Private Federated Learning (DP-FL). This section reviews related work on RUL prediction from three perspectives: (i) the integration of DP with FL, (ii) FL-based RUL prediction, and (iii) DP-based approaches.

Differential privacy has been extensively studied in the context of federated learning [27,28,29,30], yet few works apply differentially private FL to RUL prediction tasks. Namatevs et al. [31] surveyed DP mechanisms across machine learning paradigms, including FL, emphasizing that while DP definitions provably limit information leakage, real-world implementations often contain subtle vulnerabilities that require pre-deployment auditing using attack-based schemes to verify $(\epsilon ,\delta )$-differential privacy guarantees. Sudars et al. [32] empirically demonstrated gradient inversion attacks on transformer-based models in FL settings with time-series data, successfully reconstructing sensitive signals from shared gradients. This vulnerability to gradient-based leakage motivates the use of differential privacy mechanisms to mitigate information exposure during collaborative model training. Incorporating differential privacy mechanisms such as DP-SGD into this process adds calibrated noise to gradients or updates, providing formal privacy guarantees in terms of differential privacy parameters, although the practical privacy–utility trade-off depends on the noise scale.

To our knowledge, only two studies explicitly combine FL and deep learning for RUL estimation. Wang et al. [33] proposed a federated state-of-health evaluation framework based on Transformer-LSTM models, incorporating three personalization strategies to address data heterogeneity between distributed data sources. The authors applied the Gaussian mechanism for DP during local training, achieving privacy budgets with $\epsilon <10$, which is consistent with trends reported in the broader differentail privacy literature, where $\epsilon$ values occasionally exceed 10 [12]. Zhu et al. [34] proposed a collaborative federated health prognostic framework employing client-level DP-SGD, augmented with dynamic weighting and an attention mechanism to capture inter-feature correlations. In their approach, each FL client applies DP-SGD to provide differential privacy guarantees. However, ref.  [34] do not report comparative results across different privacy budgets, as their evaluation is restricted to a single DP-SGD configuration.

More broadly, most FL-based RUL studies prioritize privacy through mechanisms such as parameter sharing or secure aggregation, rather than through explicit differential privacy guarantees [7]. Altinpulluk et al. [35] introduced a federated learning framework for diagnosis, prognosis, and RUL estimation that relies exclusively on model parameter sharing without raw data exchange. While privacy-preserving by design, this approach does not incorporate differential privacy mechanisms. López et al. [36] proposed the FedHEONN model, which combines federated learning with homomorphic encryption to enable computations on encrypted model parameters, thereby enhancing privacy while preserving prediction accuracy. Zhong et al. [37] presented an FL-based RUL prediction framework using a denoising recursive autoencoder–transformer (DRAT) architecture for accurate estimation without centralizing client data, relying on standard FL principles—local training and parameter sharing—without DP mechanisms such as noise injection or $\epsilon$-based guarantees. Ma et al. [38] proposed a privacy-preserving federated semi-supervised learning framework for collaborative RUL prediction that uses the semi-supervised learning framework for collaborative RUL prediction that leverages FL safeguards and secure aggregation, but similarly omits explicit differential privacy integration.

Beyond primary applications, the NASA C-MAPSS jet engine dataset has been explored in the context of federated learning [5,39,40]. However, to the best of our knowledge, no existing studies investigate the incorporation of explicit differential privacy mechanisms into machine learning models trained on the C-MAPSS dataset. Arunan et al. [41] proposed FedMA, a federated learning framework for industrial prognostics that enables heterogeneous edge devices to collaboratively predict equipment health through matched feature extraction. Validated on the C-MAPSS dataset and related multivariate time-series benchmarks, their approach improves robustness and generalization while avoiding raw data sharing.

Existing literature on MOSFET RUL prediction predominantly relies on centralized modeling approaches without incorporating FL frameworks. Wu et al. [42] proposed a non-linear Wiener process-based model specifically for SiC MOSFET RUL prediction that explicitly accounts for uncertainty in the failure threshold through maximum likelihood estimation and first hitting time distributions. Lv et al. [43] introduced the GTLMSM model—a linear multi-fractional Lévy stable motion driven by GRU-based similarity transfer—to predict MOSFET RUL by capturing non-Gaussian heavy-tailed noise, long-range dependence, and multifractal degradation dynamics in power electronic devices. To the best of our knowledge, no recent studies have explicitly integrated SiC MOSFET degradation datasets into federated learning frameworks to enable collaborative RUL prediction while preserving data locality and client confidentiality.

5. Methods

This work aims to enhance the privacy guarantees of an existing FL-based RUL prediction framework, building on previous studies using the C-MAPSS dataset [5] and a SiC MOSFET dataset. Specifically, differential privacy is incorporated into the FL training process, and the impact of key hyperparameters is systematically analyzed to balance formal $(\epsilon ,\delta )-DP$ guarantees against predictive performance, with comparisons to non-private FL baselines.

Building upon previous work on FL-based RUL estimation [5], we extended the framework by introducing DP features. While the FL models already benefit from the inherent privacy advantages of federated learning, the addition of DP further strengthens their resistance to privacy attacks. The FL framework implements two models: MLP-LSTM-MLP [44], which is used for the C-MAPSS dataset, and Convolutional Gated Recurrent Unit (ConvGRU) [45], used for the SiC MOSFET dataset.

To incorporate DP functionality into them, we employed the Opacus library. We adopt the Gaussian mechanism for DP, as it provides a practical balance between theoretical guarantees and empirical stability when training deep neural networks. The Gaussian mechanism is particularly well-suited for gradient-based learning frameworks, since it integrates smoothly into stochastic optimization and ensures more reliable privacy accounting under composition [46].

Although Opacus is designed to be readily integrable with a wide range of deep learning models, it could not be directly applied to our ConvGRU architecture, requiring the development of customized adaptations to ensure compatibility. Unlike other types of networks, ConvGRU architectures combine recurrent gating mechanisms with convolutional operations, leading to complex tensor layouts when hidden states are carried across time steps, and gradient dependencies across temporal and spatial dimensions. This structure breaks the layer-wise symmetry and per-sample independence assumed by differential privacy frameworks, making standard per-sample gradient computation non-trivial.

5.1. MLP-LSTM-MLP Model

The model is based on the Long Short-Term Memory (LSTM) network [47] that is a type of recurrent neural network (RNN) designed to model sequential data while mitigating the vanishing and exploding gradient problems that standard RNNs often face. The gating structure allows LSTMs to maintain long-term dependencies and selectively remember or forget information over extended sequences. LSTMs are particularly effective for time-series forecasting, for example, remaining useful life estimation in engineering systems.

The MLP-LSTM-MLP model consists of three main components: an initial MLP, an LSTM and a final MLP, which outputs the predicted RUL.

The initial MLP embeds the multivariate time-series data through a non-linear mapping, which is subsequently passed to the LSTM model. The LSTM learns to capture time-dependent features in the data and outputs a final hidden state, which is fed into the final MLP. Finally, the last MLP maps the hidden state of the LSTM to a RUL prediction, one prediction per time step. In Figure 2 the MLP-LSTM-MLP architecture is shown schematically.

5.2. ConvGRU Model

The ConvGRU architecture [45] is an extension of the standard Gated Recurrent Unit (GRU) [48] that integrates convolutional operations to better handle spatiotemporal data. Unlike traditional GRUs, which use fully connected layers to process sequential inputs, ConvGRUs replace these with convolutional layers, allowing the network to capture local spatial correlations while maintaining temporal dependencies. The architecture consists of a series of recurrent units where each unit has reset and update gates, similar to a standard GRU, but the operations inside the gates are convolutional rather than linear. This enables the model to process sequences of multidimensional inputs, such as images, videos, or sensor arrays, while preserving spatial structure across time [49].

ConvGRU networks are typically composed of stacked ConvGRU layers, followed by additional convolutional or fully connected layers depending on the task. The convolutional kernels extract spatial features, while the recurrent gating mechanisms manage temporal dynamics, allowing the network to remember or forget information as needed. Regularization techniques such as dropout and gradient clipping are applied during training to improve generalization and stability. ConvGRUs are particularly well-suited for tasks where both spatial and temporal patterns are important, for example, remaining useful life estimation from sequences of sensor readings.

The ConvGRU model, shown in Figure 3, consists of three main parts: a 1D-CNN encoder, several GRU layers, and a final RUL output layer. The encoder takes as input a sequence of time series of predetermined length and maps the input to a lower dimensional encoding, while still preserving important features. After each convolutional layer, the ELU activation function [50] is applied to introduce non-linearity to the transformations. The ELU activation is defined as follows:

$$\begin{array}{cc}\hfill \mathrm{ELU}(x;\alpha )& =\left\{\begin{array}{cc}x\hfill & \mathrm{if}x\ge 0\hfill \\ \alpha (exp(x)-1)\hfill & \mathrm{if}x<0\hfill \end{array}\right.\hfill \end{array}$$

(3)

where $\alpha =1$. This encoding, z, is subsequently passed to the GRU layers. Each GRU layer consists of several GRU cells, which are specialized neural networks for temporal data. The final layer is an MLP that outputs a single number for each time step, interpreted as the predicted RUL.

5.3. Differential Privacy for MLP-LSTM-MLP Model

For the MLP-LSTM-MLP model, we used the standard privacy engine provided by the Opacus library. By using this tool we created the $(\epsilon ,\delta )$-private counterparts of the model, including the optimizer and the data loader to be used in the private training procedure. We applied the function make_private_with_epsilon of the Opacus library, which utilizes the provided epsilon value to compute the magnitude of Gaussian noise added to the gradients during each training epoch. We tested multiple epsilon values to identify the optimal balance between model accuracy and privacy protection; see Section 6.1. Vanilla training parameters such as learning rate, batch size, gradient clipping limit, and weight decay remained constant just like for the non-private training because a better configuration for these parameters was not found. It was possible to configure other parameters as well, but as these parameters were found to impact the model results the most, they were left out for future work.

To follow the $(\epsilon ,\delta )-DP$ privacy guarantees we have to set $\delta \ll {\displaystyle \frac{1}{n}}$, so we configured the delta parameter to be ${\displaystyle \frac{1}{2n}}$ .

5.4. MLP-LSTM-MLP Model Correlation Analysis

If a single input parameter has a stronger influence on the output prediction than others, it is less protected. Differential privacy reduces the influence of individual parameters, ideally leading to a balanced contribution of all inputs. Otherwise, strong output dependence may allow sensitive input parameters to be inferred, which DP is designed to prevent.

To assess the impact of DP on an individual input parameter, we analyze the already lived life (input length). Systems with equivalent operational lifetimes are generally regarded as similar. For instance, if multiple systems of the same type are used, it is expected that their lifetimes will be comparable. The CMAPSS database comprises sensor measurements of engines, and the model predicts RUL. Consequently, it is reasonable to assume that a key parameter is the number of cycles the engine has already completed, making the correlation between this parameter and the final RUL prediction an important aspect of analysis.

In RUL prediction, one parameter that plays a dominant role is the already lived life of a component. Since this feature is strongly correlated with the target variable, it introduces a risk, where the model might rely excessively on it rather than learning generalizable degradation patterns. To mitigate this, the parameter can be clipped, limiting its maximum contribution during training and thus preventing it from dominating the learning process. However, this introduces a trade-off between model accuracy and privacy. The model’s accuracy can be evaluated through validation loss, while the level of privacy preservation can be estimated by analyzing the correlation between the model’s outputs and the already lived life parameter.

5.5. Differential Privacy for ConvGRU Model

To obtain a differentially private ConvGRU model, we adopted a more customized approach while leveraging the full functionality of the Opacus library. Although the standard Opacus training pipeline was preserved, limitations were encountered when applying the clip_and_accumulate function to the ConvGRU architecture.

The ConvGRU model operates on input data shaped as [batch, sequence_len, input_size], and due to varying patch sizes across its layers, the gradient tensors exhibit inconsistent dimensions. Specifically, our model consists of 20 layers, where the first 14 layers have gradient tensors with a first-dimension size of 1, while the remaining layers have only one dimension of size 127. This variability in tensor sizes poses a challenge when using the Opacus v1.5.3 library, as its clip_and_accumulate function relies on PyTorch’s stack method, which requires all tensors to be of equal size.

The original Opacus clip_and_accumulate implementation assumes all per-sample gradients can be stacked into a single tensor before computing per-sample ${\mathsf{\ell }}_2$ norms. This fails with models that have heterogeneous parameter shapes, which is our case, where stacking tensors of incompatible dimensions raises shape mismatch errors. Mathematically, the original implementation constructs a single vector whose length equals the total number of trainable parameters in the network by concatenating all $g_p^{\left(i\right)}$, and then computes $\parallel g^{\left(i\right)}{\parallel }_2$ on that vector. This is equivalent to stacking all parameter gradients into one tensor per sample. When parameter tensors have different shapes (e.g., conv filters vs. linear weights vs biases), stacking them in a uniform way is not supported. Therefore, the “stack then norm” approach is not usable for models with heterogeneous parameter dimensions. The key identity is that the squared L2 norm of the concatenated vector equals the sum of the squared L2 norms of the blocks:

$$\begin{array}{c}\hfill \parallel g^{\left(i\right)}{\parallel }_2^2=\sum _{p=1}^P{\parallel g_p^{\left(i\right)}\parallel }_2^2\end{array}$$

(4)

Our approach involves, for each parameter block p and each sample i, computing $n_p^{\left(i\right)}={\parallel g_p^{\left(i\right)}\parallel }_2^2$. We then sum over all parameter blocks $N^{\left(i\right)}={\sum }_{p=1}^P\left(n_p^{\left(i\right)}\right)$ and take the square root over result $\sqrt{N^{\left(i\right)}}$, and finally compute $\parallel g^{\left(i\right)}{\parallel }_2$ without ever forming the full vector $g^{\left(i\right)}$.

After adapting Opacus to our model, we observed that a significantly larger amount of noise is required compared to the MLP-LSTM-MLP model to achieve differential privacy. Even with $\epsilon =50$, the model converges slowly. This behavior can be attributed to the limited size of the training dataset.

Specifically, data are available from four clients. The first client covers six devices, of which only three are used for training. Each of the remaining three clients covers ten devices, with six devices per client used for training. As a result, the effective training set is small. This directly affects the target $\delta$ parameter, which has to be smaller than $1/n$, where n denotes the number of training samples. In our case, n = 21. To mitigate the data scarcity issue, we augmented the dataset using synthetic data generated via simple noise-based augmentation techniques. After analyzing the dataset parameters—namely voltage, resistance, and temperature measurements—we observed that rapid variations in the signals predominantly occur toward the end of the device lifetime. This behavior can be seen in Figure 4, which shows an example of the temperature parameter of the original and augmented time-series data.

We augmented MOSFET device data using four noise mechanisms applied sequentially. First, cycle noise optionally modifies dataset size by averaging groups of adjacent cycles, with a random size change between −20% and +20% per augmented copy. This preserves temporal relationships by recalculating consumed_life based on the new cycle numbers. Second, Gaussian noise is added to measurement columns (temperature, voltage, resistance) at 20% of each column’s standard deviation. Third, Gaussian noise is applied to derived/cleaned columns at 10% of each column’s standard deviation. Fourth, displacement noise shifts the last valid value of each column by a single random value (drawn from a normal distribution with standard deviation equal to 2× the average column standard deviation) and proportionally adjusts intermediate values to maintain the trajectory shape, keeping the first value unchanged. The same displacement value is applied across all columns to preserve inter-feature relationships. Identifier columns (cycle, device_number) are excluded from noise addition, and consumed_life is recalculated to maintain monotonicity and validity constraints. This approach increases dataset diversity while preserving the underlying degradation patterns, enabling training on larger datasets without manual data collection.

The dataset was augmented using the factors of 1, 5, 8, 10, 12. Based on these experiments, Opacus-based differential privacy was applied to the dataset augmented by a factor of 12, and the corresponding privacy budgets (epsilon) were evaluated.

5.6. Training and Evaluation

All models were trained for 1 local epoch for each client across 1000 rounds. To enhance model privacy, differential privacy introduces noise to the gradients during training. While this noise injection improves privacy, it simultaneously reduces training effectiveness, as reflected in higher final training loss values. For our experiments, we measured this effect after a fixed training period of 1000 epochs—where a higher final training loss indicates less effective training.

It is important to note that less effective training does not automatically guarantee improved privacy. The primary objective of implementing DP remains to increase the model’s privacy, not merely to affect training efficiency.

To evaluate the training progress of our MLP-LSTM-MLP models using different epsilon values, we monitored the changes in the validation curve across epochs. We selected epoch 1000 as the stopping point for training. For the purposes of DP implementation, the target delta is set to $1/2n$ to control the influence of individual gradients during training, where n is the size of the dataset. To study the impact of varying privacy levels on model performance, we experimented with multiple epsilon values. By systematically adjusting the epsilon parameter, which governs the trade-off between privacy and utility, we were able to observe how different levels of DP affect the training dynamics and model accuracy.

Figure 5 shows the overall schematic representation of all experiments and results. Red arrows represent the training process, green arrows indicate the results, and black arrows denote the overall connections between the blocks. The configuration options for training are given in

Table 3. Training setup and options for both datasets.

Option	C-MAPSS	SiC MOSFET
No. of FL clients	4	4
Local epochs	1	1
Rounds	1000	1000
Gradient clip threshold	0.1	0.5
$\delta$	$1/2n$	$1/2n$
Loss	MSE	MSE + Linf
Model	MLP-LSTM-MLP	ConvGRU
Trainable parameters	108,929	8,582,785
Optimizer	AdamW	AdamW

.

6. Results

6.1. DP for C-MAPSS Dataset

We performed several model trainings with different epsilon values to find the bounds of optimal privacy budget values. After training the MLP-LSTM-MLP model, we conducted a systematic evaluation across different privacy levels. In Figure 6b we can observe that smaller epsilon values provide stronger privacy guarantees. The utility is measured as validation loss (MSE). The baseline without differential privacy is included for reference. We see that for $\epsilon$ values of 0.2 and above, final validation loss values are reasonably low, and the model maintains reasonable predictions. To assess how the loss values translate to the achieved RUL prediction accuracy, we take the square root of the MSE. Since the RUL values for this dataset are scaled to the range 0.1, where 0 represents the start of the measurement and 1 the breaking point, the obtained RMSE value gives the prediction error of the RUL. For example, for $\epsilon =0.2$ we obtain a 7% average RUL error, while the non-DP baseline achieves 5.5% for this $\epsilon$.

We assessed how the system’s already lived life correlates with the predicted RUL, using this correlation as a measure of the model’s privacy level. Figure 7a shows the correlation between the engine life already lived and the final predicted RUL value, where the correlation decreases as the epsilon value decreases. Figure 7b illustrates an example of this relationship for the model without differential privacy, showing the correlation between the already lived life and the predicted RUL value. The red dashed line represents the linear regression that summarizes the overall trend of the relationship across all data points. We see that the anti-correlation becomes significant at an epsilon value of 1 or lower, confirming good model performance for such $\epsilon$.

6.2. DP for MOSFET Dataset

We conducted similar training for the ConvGRU model on the MOSFET dataset to conclude differences from MLP-LSTM-MLP model training. During the experimental process, we observed that even with a privacy budget of 50, training without dataset augmentation, resulting in a dataset size of 21, conversance is insufficient for utilizing model for RUL prediction. To address this issue, the dataset was enlarged, which resulted in improved training dynamics, as illustrated in Figure 8. Figure 8a illustrates the decrease in validation loss across training epochs, while Figure 8b presents the final validation loss achieved for each augmented dataset size variants.

Therefore, we selected the dataset augmented by a factor of 12 for training the ConvGRU model. For this model, the maximum gradient norm was set to 1. We evaluated multiple privacy budget values to analyze the impact of different privacy levels on training dynamics and overall ConvGRU model performance as seen in Figure 9. Figure 9a illustrates the decrease in validation loss across training epochs, while Figure 9b presents the final validation loss achieved for each privacy budget value.

7. Discussion

The purpose of this paper is to examine how differential privacy can further strengthen the protection of models already trained within a federated learning framework. Through the use of the Opacus library, we successfully integrated DP into both our MLP-LSTM-MLP and ConvGRU models. To the best of our knowledge, this study is the first to implement differential privacy within a federated learning framework for RUL prediction on the C-MAPSS and SiC MOSFET datasets. While the MLP-LSTM-MLP model benefited from the streamlined make_private_with_epsilon function, the ConvGRU model required a more customized approach using core Opacus functionalities. The need for a manual approach to implement DP for our ConvGRU model stems from the unique structure of the data and the model it processes.

The MLP–LSTM–MLP experiments demonstrate that the functional dependence between the predicted RUL and the “already lived life” input parameter decreases under stronger differential privacy constraints. Although the MLP-LSTM-MLP model achieved reasonable privacy of one input parameter with privacy budget values ranging from 0.01 to 5, the ConvGRU model required higher epsilon values to reach comparable utility. This discrepancy can be attributed to several factors: ConvGRU architecture has more trainable parameters compared to MLP-LSTM-MLP, higher gradient magnitudes, and relatively small dataset size for DP implantation. Together, these characteristics increase the model’s sensitivity to noise injection.

For an epsilon value less than 0.2, the final validation loss is significantly higher, suggesting insufficient model convergence. Consequently, during inference, the model’s predictions are likely to be unreliable. Based on the validation loss and the correlation analyses presented in this study, an acceptable epsilon range lies between 0.2 and 1.0. Within this interval, the models maintain acceptable validation performance while reducing the functional dependence between the predicted RUL and the already lived life input parameter.

Although federated learning provides a baseline level of privacy, certain parameters—such as the already lived life—remain highly informative and therefore vulnerable, as they naturally serve as strong predictors in remaining useful life estimation. As a result, these models still require additional monitoring of sensitive parameters and stronger privacy mechanisms to prevent unintended information leakage. By progressively decreasing the privacy budget $\epsilon$, we imposed stronger privacy guarantees and reassessed the parameter’s influence under increasing noise. This analysis indicates that $\epsilon$ values in the range of 0.2 to 1 provide the most effective trade-off between privacy preservation and predictive performance. Differential privacy, clipping, accounting, and noise jointly prevent any single parameter from dominating the prediction correlation. This ensures that no individual feature disproportionately influences the model’s output.

8. Conclusions

This work demonstrates that federated learning models require and can effectively benefit from privacy enhancement through DP mechanisms. The results on the C-MAPSS dataset indicate that epsilon values in the range of 0.2 to 1.0 achieve a favorable trade-off between privacy guarantees and model performance. The results indicate that the effectiveness of differential privacy mechanisms improves as the dataset size increases, as shown on the SiC MOSFET dataset in Figure 8—by augmenting the base dataset, improved model performance was achieved under the same privacy guarantees.

Furthermore, correlation analysis results indicate that DP can successfully reduce the influence of individual input parameters on model output while preserving the overall predictive capability of the models. In a broader scope, our results provide a reliable way for manufacturers to cooperate with their data and obtain reliable RUL predictions without compromising privacy.