Differentially Private Federated Learning for Remaining Useful Life Prediction

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors

This manuscript presents a study on applying Differential Privacy within a Federated Learning framework for Remaining Useful Life prediction, using two distinct datasets and two model architectures. The integration of Differential Privacy is a critical and timely contribution to enhancing privacy in collaborative industrial prognostics. The paper is generally well-structured, clearly articulates its motivation, and details the technical implementation using the Opacus library. However, several aspects require strengthening to meet the standards for publication.

 

1. Structural Issues：

• The content in the "Background" and "Related work" sections overlaps, describing the same issue. The part in the "background" section that describes the motivation of the paper should be moved to the first part of the "methods" section. The "Datasets" module should be described in the experimental section.
• Combing FL and DL for battery RUL estimation is the key point of this paper. The deep learning (DL) technology should be discussed in detail under "related work" or "future work"(such as transfer learning technology). Because the DL technology mentioned in the text is relatively outdated.

2. Clarity and Replicability of Implementation Details:

• The methodology section provides a good overview but lacks sufficient detail to fully understand and replicate the DP implementations.
• The article lacks a complete framework diagram and description of the proposed model.
• The section on adapting Opacus for ConvGRU (5.5) mentions a custom solution for handling heterogeneous gradient tensor dimensions but does not include key implementation details.
• "This preserves the mathematical equivalence of the original approach" requires a brief justification or reference to the privacy guarantee equivalence.

3. Analysis of DP Impact and Privacy-Utility Trade-off:

• The results section presents validation loss and correlation plots under varying epsilon (ε). However, the analysis of the "privacy-utility trade-off" promised in the title and abstract could be deepened.
• For example, providing a complete mathematical proof for DP of the proposed model. To be more convincing, it should also discuss whether DP successfully mitigated privacy risks.

4. Comparison to Baselines and Validation of DP Effectiveness

• The authors should discuss whether the model performance will decrease after adding DP.
• The authors said that “To the best of our knowledge, only two works explicitly combine FL and DL for battery RUL estimation.”. Why are the two mentioned works not compared with the work presented in this paper.

Author Response

1. Structural Issues： 

• The content in the "Background" and "Related work" sections overlaps, describing the same issue. The part in the "background" section that describes the motivation of the paper should be moved to the first part of the "methods" section. The "Datasets" module should be described in the experimental section. 

• Combing FL and DL for battery RUL estimation is the key point of this paper. Deep learning (DL) technology should be discussed in detail under "related work" or "future work" (such as transfer learning technology). Because the DL technology mentioned in the text is relatively outdated. 

Thank you for your comments. We edited Related work and Background sections. 

1. Clarity and Replicability of Implementation Details: 

• The methodology section provides a good overview but lacks sufficient detail to fully understand and replicate the DP implementations. 

•  The section on adapting Opacus for ConvGRU (5.5) mentions a custom solution for handling heterogeneous gradient tensor dimensions but does not include key implementation details.  

•  "This preserves the mathematical equivalence of the original approach" requires a brief justification or reference to the privacy guarantee equivalence. 

Thank you for your comments. In our revisions we have added mathematical steps that describe our changes to the Opacus pipeline. 

• The article lacks a complete framework diagram and description of the proposed model. 

Thank you for this valuable comment. In the revised manuscript, we have added a complete framework diagram that illustrates the overall workflow of the proposed methodology. 

1. Analysis of DP Impact and Privacy-Utility Trade-off: 

• The results section presents validation loss and correlation plots under varying epsilon (ε). However, the analysis of the "privacy-utility trade-off" promised in the title and abstract could be deepened. 

Thank you for this comment. We have strengthened the Discussion section with a more detailed analysis of the privacy–utility trade-off, including extended discussion of how the choice of ε affects validation loss and correlation. 

• For example, providing a complete mathematical proof for DP of the proposed model. To be more convincing, it should also discuss whether DP successfully mitigated privacy risks. 

Thank you for this important comment. The proposed model follows the classical DP formulation, including gradient clipping and noise injection mechanisms consistent with the Gaussian mechanism. Since the theoretical foundations of DP are extensively proven in the literature, a complete re-derivation of the mathematical proof was not included in the manuscript. 

To address your concern, we have now expanded the discussion section to clarify how the applied DP mechanism mitigates privacy risks. 

1. Comparison to Baselines and Validation of DP Effectiveness 

• The authors should discuss whether the model performance will decrease after adding DP. 

Thank you for your comment. We extended discussion section. 

• The authors said that “To the best of our knowledge, only two works explicitly combine FL and DL for battery RUL estimation.”. Why are the two mentioned works not compared with the work presented in this paper. 

We appreciate your insightful suggestion. Although the general idea is related, the approaches differ from ours. In our work, differential privacy is applied in a standard client-level formulation, whereas in the above-mentioned studies it is not implemented in this form. For example, Wang et al. tailor the privacy strength specifically to degradation-related parameters rather than applying differential privacy uniformly across the entire local model, as done in our approach. Zhu et al. primarily concentrate on dynamic weighting and attention mechanisms for collaborative RUL prediction, where differential privacy is not the central methodological component. As demonstrated in our results, model structural and dataset-related factors also can lead to significant performance variations. Therefore, our approach should be regarded as complementary rather than directly comparable to these studies. 

Reviewer 2 Report

Comments and Suggestions for Authors

The paper proposes a framework that combines federated learning with differential privacy via DP-SGD (implemented using Opacus) for remaining useful life (RUL) prediction.

Strengths:

- The topic is interesting, practical and highly useful. It fits the topics of the journal.

Weaknesses:

- The privacy problem is not clearly formulated. What data is protected and why?
- What is the adversarial model? Without defining the adversarial model, there is no way to validate the approach. Simply applying DP does not guaranty the privacy protection.
- Using correlation with “already lived life” as a privacy measure is not valid. DP protects the presence/absence of individual records, not “whether a feature is influential” or “feature inferability” in general. 
- For MOSFET, the paper augments data and suggests that larger dataset size improves DP behavior and then applies Opacus DP on the augmented set. But DP guarantees depend on the number of independent records in the dataset. Augmented samples produced from original records are not independent new records. 
- Experimental reproducibility is limited due to missing details about the federated setup and training configuration.

Major issues to be addressed:
- State the threat model.
- Specify whether the guarantee is record-level or client-level. Who is the adversary (server? other clients?), and what is protected.
- Replace (or provide stronger arguments) the correlation with “already lived life” as a privacy measure. Instead, use standard privacy attacks/metrics aligned with your threat model.
- For MOSFET, provide more analysis regarding the effect of the augmented data to the DP-based training. There should be a clear distinction between the original data and the generated one.
- Add a single table per dataset: clients, local epochs, rounds, batch size, optimizer, etc.

Minor issues to be addressed:

- In line 126, "The most common approach is adding noise to the gradients used for model updates during training" it is an overstatement. "One common approach ..." would be more accurate.
- In line 127, "This approach typically offers the best privacy–utility trade-off and was therefore selected for applying DP to the machine learning models in this work" is also an overstatement. Naming an approach "the best" without citing state-of-the-art reviews may be misleading. Consider toning down.
- In line 206, the name of the sensors should be present (if available).
- In line 208, there should be no comma.
- “Data Availability Statement: No new data were created…” conflicts with the MOSFET augmentation approach that clearly creates synthetic/augmented data.

Author Response

Weaknesses: 

• The privacy problem is not clearly formulated. What data is protected and why? 

Thank you for your comments. We added a paragraph about possible privacy leaks and gains for the possible attacker (end of section 2.2).    

•  What is the adversarial model? Without defining the adversarial model, there is no way to validate the approach. Simply applying DP does not guaranty the privacy protection. 

Thank you for this important remark. The adversarial model is discussed and elaborated in the Introduction section, where we specify the assumed threat model and the role of differential privacy in mitigating information leakage under this setting. 

Using correlation with “already lived life” as a privacy measure is not valid. DP protects the presence/absence of individual records, not “whether a feature is influential” or “feature inferability” in general. 

We agree that differential privacy formally protects the presence or absence of individual records rather than specific features. However, in industrial federated learning settings, privacy risks extend beyond strict membership inference. In our case, the feature “already lived life” represents accumulated operational usage and may contain sensitive information about equipment lifecycle and production patterns. If the predicted RUL shows a strong correlation with this feature, it becomes possible to approximate or reconstruct operational status from model outputs. Therefore, analyzing the relationship between model predictions and “already lived life” serves as a practical proxy to assess potential feature inference risks, which are relevant in collaborative industrial environments. We argue that DP noise reduces functional dependence between input and output, which reduce attribute inference risk. 

•  For MOSFET, the paper augments data and suggests that larger dataset size improves DP behavior and then applies Opacus DP on the augmented set. But DP guarantees depend on the number of independent records in the dataset. Augmented samples produced from original records are not independent new records. 

Thank you for this important remark. In our study, data augmentation was not used to strengthen the formal differential privacy guarantees. The privacy accounting is computed with respect to the original number of engine trajectories. 

The augmentation multiplier was introduced to improve model optimization under DP-SGD. Empirically, we observed that larger augmentation factors lead to faster convergence and lower training loss under the same privacy budget. The privacy parameters remain unchanged, as they are defined with respect to the original independent records. 

•  Experimental reproducibility is limited due to missing details about the federated setup and training configuration. 

We appreciate this comment. The federated learning setup and detailed training configurations are described in our previous work, which is referenced at the beginning of the methods section. 

Major issues to be addressed: 

•  State the threat model. 

We assume an honest-but-curious central server in the federated learning setting. The server follows the prescribed training protocol correctly but may attempt to infer sensitive information from the received client updates or from the aggregated global model. 

This threat model is described and elaborated at the end of the Introduction section. 

•  Specify whether the guarantee is record-level or client-level. Who is the adversary (server? other clients?), and what is protected. 

The privacy guarantee provided in this work is at the record level. The adversary is the central honest-but-curious server, as defined above. The applied differential privacy mechanism limits the influence of any single training record on the transmitted updates and the resulting global model. 

The protected elements are the input data features contained in the local client datasets, including all sensor measurements and operational parameters used for model training. 

• Replace (or provide stronger arguments) the correlation with “already lived life” as a privacy measure. Instead, use standard privacy attacks/metrics aligned with your threat model. 
• For MOSFET, provide more analysis regarding the effect of the augmented data to the DP-based training. There should be a clear distinction between the original data and the generated one. 

Thank you for this important remark. We agree that correlation between the predicted RUL and the “already lived life” feature does not constitute a formal privacy metric under differential privacy. In the revised manuscript, we position this correlation analysis as an auxiliary empirical observation that illustrates how DP noise affects the functional dependence between a highly informative input feature and the model output. 

•  Add a single table per dataset: clients, local epochs, rounds, batch size, optimizer, etc. 

Thank you for this suggestion. In the revised manuscript, we have added a table summarizing training parameters for both the C-MAPSS and SiC MOSFET datasets. 

Minor issues to be addressed: 

•  In line 126, "The most common approach is adding noise to the gradients used for model updates during training" it is an overstatement. "One common approach ..." would be more accurate.
•  In line 127, "This approach typically offers the best privacy–utility trade-off and was therefore selected for applying DP to the machine learning models in this work" is also an overstatement. Naming an approach "the best" without citing state-of-the-art reviews may be misleading. Consider toning down. 

We appreciate this comments. The statement has been revised to use more neutral wording and to avoid overgeneralization. 

•  In line 206, the name of the sensors should be present (if available). 

We thank you for this suggestion. In the revised manuscript, we have clarified the description of the C-MAPSS dataset by specifying the types of sensor measurements included. The dataset contains 21 sensor signals, including total temperature measurements at multiple compressor and turbine stages, pressure measurements, fan and core rotational speeds, fuel flow, and bleed enthalpy. The manuscript has been updated accordingly. 

•  In line 208, there should be no comma. 

Thank you. We corrected grammatical mistake. 

•  “Data Availability Statement: No new data were created…” conflicts with the MOSFET augmentation approach that clearly creates synthetic/augmented data. 

Thank you for this comment. We have revised the Data Availability Statement so that it explicitly mentions the creation of synthetic/augmented MOSFET data 

Reviewer 3 Report

Comments and Suggestions for Authors

The reviewed article considers the solution of the current problem of assessing the residual life of various products in use, in particular batteries and engines. The challenge of this assessment is to ensure the confidentiality of training data samples provided by clients for a number of reasons. The authors define differential confidentiality according to the source [11].
The authors criticize the well-known method of providing differential privacy, based on the introduction of random noise into training samples, as this noise significantly degrades machine learning parameters. Further, the authors make a number of proposals to improve the quality of the solution of the problem under consideration.

Remarks:
1. The authors touch upon the problem of ensuring data confidentiality and this problem is one of the central ones in the article. Authors should more fully and accurately characterize the object of information security -- that is, what data is confidential and why.
2. It is necessary to accurately describe - who is the violator (attacker) in this situation? What opportunities and resources do they have to achieve their data privacy goals?
3. Disclose in detail the mechanism of privacy violation. What causes this leak? This will further make it possible to make a logical justification for the need for measures taken to ensure confidentiality and maintain the necessary quality of machine learning.

4. The authors need to check again carefully the correctness of some mathematical calculations, in particular in formula (3) -- it is necessary to check the rigidity of "if x> = 0" and "if x <= 0" -- is it correct that in both cases the strict equality "x = 0" is allowed?

Author Response

Remarks: 

1. The authors touch upon the problem of ensuring data confidentialityand this problem is one of the central ones in the article. Authors should more fully and accurately characterize the object of information security -- that is, what data is confidential and why. 
2. It is necessary to accurately describe - who is the violator (attacker) in this situation? What opportunities and resources do they have to achieve their data privacy goals?

Thank you for your comments. We added a paragraph about possible privacy leaks and gains for the possible attacker (end of section 2.2).   

3. Disclose in detail the mechanism of privacy violation. What causes this leak? This will further make it possible to make a logical justification for the need for measures taken to ensure confidentiality and maintain the necessary quality of machine learning. 

Thank you for your comment. In a federated learning (FL) setting, raw data are not directly shared between clients and the central server. However, privacy leakage occur through the transmission of model updates (gradients or weight differences). These updates are computed from local training data and therefore encode structured information about input features and target values. Overfitting further amplifies this risk, as highly fitted models may memorize client-specific behaviors, increasing the sensitivity of updates to individual data records. We have clarified this leakage mechanism and its mitigation strategy in the revised manuscript. 

4. The authors need to check again carefully the correctness of some mathematical calculations, in particular in formula (3) -- it is necessary to check the rigidity of "if x> = 0" and "if x <= 0" -- is it correct that in both cases the strict equality "x = 0" is allowed?

Thank you for your comment. We have corrected the inequality in formula 3. All other formulas are correct. 

Round 2

Reviewer 1 Report

Comments and Suggestions for Authors

The authors have made some revisions to address the comments, but they do not address all the issues. In particular, the response is overly simplistic. 

Several important aspects require strengthening to meet the standards for publication.

1. lThe authors didn’t correctly edit Related work and Background sections. The content in the "Background" and "Related work" sections overlaps, describing the same issue. The part in the "background" section that describes the motivation of the paper should be moved to the first part of the "methods" section. The "Datasets" module should be described in the experimental section.
2. I think the article lacks a complete framework diagram and description of the proposed model. The model structure should reflect the innovativeness of the proposed method and its distinctiveness from other models. Figure 5 is more like a workflow, rather than the proposed model architecture. Figures 2 and 3 are both existing models.

Author Response

1. The authors didn’t correctly edit Related work and Background sections. The content in the "Background" and "Related work" sections overlaps, describing the same issue. The part in the "background" section that describes the motivation of the paper should be moved to the first part of the "methods" section. The "Datasets" module should be described in the experimental section.

Thank you for this constructive comment.

Regarding the Datasets section, we intentionally present the datasets in a separate section to provide a clear and self-contained description of their characteristics, without mixing them with methodological or experimental procedures. At this stage, we describe the properties and structure of the datasets rather than how they are processed. We believe this improves clarity and readability.

Regarding the Background and Related Work sections, their purposes are distinct in our manuscript. The Background section introduces the fundamental concepts of Federated Learning and Differential Privacy required to understand the proposed approach. In contrast, the Related Work section discusses prior studies, particularly works combining FL and DP, and positions our contribution within the existing literature.

After carefully revising the manuscript, we did not identify substantive redundancy between these sections. From our perspective, the conceptual introduction and the literature discussion address different purposes. If the reviewer could indicate specific parts that are considered redundant, we would be pleased to conduct an additional revision to address those points more precisely. We appreciate the opportunity to further improve the manuscript if needed. We moved one paragraph to the Methods section, as it was more appropriately placed there.

1. I think the article lacks a complete framework diagram and description of the proposed model. The model structure should reflect the innovativeness of the proposed method and its distinctiveness from other models. Figure 5 is more like a workflow, rather than the proposed model architecture. Figures 2 and 3 are both existing models.

Thank you for this comment.

The main contributions of this work are methodological

Specifically, the two major novelties of the proposed framework are:
(1) the optimization of the accumulative clipping mechanism, expressed with mathematical formula nr. 4, and
(2) the statistical correlation analysis between already lived life and RUL, which is demonstrated in Figure 7. This is simple between output RUL value and input already lived life value.

Furthermore, we implement and evaluate Differential Privacy within a Federated Learning framework specifically tailored to the C-MAPSS and SiC MOSFET datasets.

The core model architectures themselves are as well as FL framework are from our prior work referred in the Methods section.

We believe that the methodological contributions are more clearly conveyed through formal mathematical definitions and empirical result figures than through an additional technical diagram.

Reviewer 2 Report

Comments and Suggestions for Authors

Thank you for the revision. The authors have substantially improved the paper, particularly clarifying the threat model and enhancing the reproducibility of the experiments. Additionally, the explanations clarify the authors’ contributions and motivations.

Author Response

We sincerely thank the reviewer for the positive evaluation of our work and for the encouraging feedback. We greatly appreciate the time and effort invested in reviewing the manuscript.

Reviewer 3 Report

Comments and Suggestions for Authors

The authors made the necessary changes and corrections to the text of the document and some mathematical expressions. As a result, the authors of the article turned out to be at a good level, since they quantified the concept of differential confidentiality. The authors have established an effective compromise between privacy and predictive performance. Differential confidentiality, constraints together prevent the dominance of any single parameter in prediction correlation. 

Author Response

We sincerely thank the reviewer for the positive evaluation of our work and for the encouraging feedback. We greatly appreciate the time and effort invested in reviewing the manuscript.