BO-WDMS-BiLSTM: A Bayesian-Optimized Wide-and-Deep Multi-Scale Bidirectional Model for Electricity Theft Detection

Abstract

As utilities transition from legacy data-collection devices to advanced smart meters, theft detection must remain accurate, scalable, and actionable—helping teams prioritize field inspections, reduce false alarms, and allocate limited enforcement resources more efficiently across service territories. We propose BO-WDMS-BiLSTM, a dual-branch model that combines customer and billing information with electricity-use patterns over time. One branch learns from compact customer indicators and captures stable signals that remain useful even when daily usage changes for normal reasons. The other branch converts multi-week consumption data into a structured representation and extracts patterns at different time scales, enabling it to detect both short abnormal drops and gradual shifts. A bidirectional sequence module then interprets each period using context from both earlier and later days. The two branches are fused with a residual-style head that preserves information from both sources and improves training stability, while Bayesian optimization reduces manual tuning. Compared with widely used classical and deep learning baselines, the proposed model achieved the best overall discrimination and ranked more true theft cases at the top of the inspection list, improving the strongest baseline from 0.7897 to 0.7977 and raising top-100/top-200 inspection performance from 0.9320/0.9204 to 0.9797/0.9394.

1. Introduction

Electricity theft is a persistent source of non-technical losses and can undermine grid reliability, utility revenue, and customer trust. The rapid growth of advanced metering and digital operations has made data-driven detection increasingly feasible, but it has also expanded the attack surface and raised expectations for scalable, accurate, and accountable analysis [1,2]. Recent overviews emphasize that progress depends as much on handling imperfect data and operational constraints as on achieving strong benchmark scores [3].

Practical deployments also vary widely by infrastructure maturity. In many regions, large customer populations still rely on traditional meters without built-in communications, so detection workflows remain closely tied to field inspections and manual prioritization. A case study on Indonesia’s postpaid residential customers frames the problem as generating reliable inspection target lists from monthly usage records, showing how model design choices must align with resource limits and operational decision-making [4].

A central technical obstacle across both smart and traditional metering settings is class imbalance: confirmed theft cases are typically rare compared with normal behavior. One representative baseline combines SMOTE (Synthetic Minority Oversampling Technique) with logistic regression to rebalance training data while preserving interpretability [5]. Earlier pipeline designs follow a similar logic by coupling oversampling with dimensionality reduction and a classical classifier, aiming to stabilize learning when time-series features are high-dimensional [6]. More recent work pairs SMOTE with gradient-boosted trees to better capture non-linear patterns in load profiles, improving sensitivity while controlling error rates under skewed class distributions [7]. Complementary optimization-oriented studies tune boosted models using automated search to push performance while keeping computation practical for large-scale screening [8].

Beyond resampling, several studies focus on selecting or structuring features so that learning algorithms emphasize stable behavioral signals rather than noise. A Boruta–LightGBM approach combines mixed resampling with feature selection to reduce redundancy and improve generalization on consumption-derived predictors [9]. Prototype learning combined with ensemble training further addresses extreme imbalance by learning class representatives from balanced subsets, aiming to preserve minority-class structure even when theft behavior varies in severity [10].

Some approaches emphasize simplicity and deployability by coupling targeted preprocessing with lightweight models. Signal decomposition and interpolation have been used to extract discriminative summaries from long consumption records before classification with KNN, offering a practical route when engineering resources are limited [11]. Unsupervised clustering has also been explored in information-system settings, where the goal is to flag atypical customers from aggregated profiles when labels are sparse or inconsistent.

Data quality issues, especially missing values and irregular reporting, remain a major barrier because consumption records are often incomplete for reasons that are not purely random. A fusion CNN coupled with iterative interpolation uses Bayesian ridge regression to fill gaps and then learns multi-branch convolutional features to capture periodic patterns [12,13]. Earlier deep learning work also leverages periodic structure by converting weekly sequences into two-dimensional representations and extracting features with a residual network, then combining them with statistical descriptors for classification [14].

As models increasingly target subtle and evolving theft behaviors, temporal representation learning and attention mechanisms are used to capture longer dependencies and focus on informative segments. A temporal convolutional network with self-attention is proposed to improve discrimination under realistic non-technical loss conditions [15]. Multi-scale feature fusion with parallel convolutional branches and channel reweighting further aims to reduce interference from legitimate behavioral shifts while retaining longer-horizon cues relevant to theft [16]. Dilated convolutions combined with multi-head attention extend this idea by integrating multi-scale temporal features and learning which time segments matter most for classification [17].

Hybrid systems also combine deep feature extraction with classical learners to exploit complementary strengths. A stacked framework dominated by deep learning uses neural features together with outputs from multiple machine learning classifiers and then applies a final boosted classifier to improve generalization [18]. Graph-based approaches go further by explicitly modeling relationships among users or consumption cycles, including dynamic graph construction during training and additional imbalance handling through oversampling and loss reweighting [19]. Related work considers prosumers and coordinated manipulation scenarios, proposing cluster-based detection that blends time-series decomposition with multi-source features to support robustness under more complex market participation [20].

Several studies expand the evidence used for detection beyond consumption alone, motivated by the observation that meter readings can be manipulated while grid-side signals may remain informative. A multivariate detector incorporates voltage and power losses in addition to consumption, improving detection rates relative to consumption-only baselines [21]. Intermittent theft behavior, which may not persist throughout the full observation window, is addressed by combining CNN-based temporal localization with correlation analysis and density-based clustering to identify outliers aligned with abnormal line-loss periods [22]. Station-area case studies also highlight that low-quality data and extreme imbalance can co-occur, motivating multi-stage systems that first improve data quality and then apply augmentation and deep detection modules [23]. Multi-dimensional fusion has also been explored through evidence-theoretic integration of electrical variables with optimized multi-layer SVM classification, aiming to exploit richer meter measurements while improving training efficiency [24].

To mitigate scarcity of labeled theft samples, multiple strands of work augment data or search model configurations more effectively. A spectrum-normalized GAN is used to generate additional theft-like samples for training a CNN classifier, with the goal of improving detection while reducing false alarms [25]. Particle swarm optimization has been applied to tune neural networks across theft risk levels, emphasizing faster convergence and stable accuracy [26]. Real-time monitoring prototypes integrate IoT sensing with deep neural networks to support continuous detection and operational optimization, reflecting a broader push toward actionable, near-real-time analytics [27].

Household-level settings introduce additional complexity because appliance-level variability can mimic anomalous behavior and because labeled attacks are limited. A smart-home study combines knowledge-guided time-series patterns with simulated and real attacks, reporting strong performance of supervised learners across multiple home categories and attack types [28]. Reconstruction-based anomaly detection with an LSTM autoencoder provides another path when theft labels are scarce, using reconstruction error and data-driven thresholding to flag suspicious behavior [29]. Privacy constraints further shape what can be deployed, and dual-privacy-preserving designs based on split learning and data transformation aim to protect both consumption data and model assets while retaining competitive detection performance [30].

Robustness is increasingly treated as a core requirement rather than a secondary evaluation criterion. A consumption-pattern-driven framework combines load disaggregation ideas with statistical testing to judge theft behavior at time-segment granularity, aiming to detect subtle deviations that may be missed by coarse aggregation [31]. Against adversarial manipulation, a CNN–AE–LSTM hybrid scheme is evaluated under white-box and black-box settings to improve resistance to evasion attacks [32]. Complementary work explicitly demonstrates that hybrid detectors such as CNN–AdaBoost can degrade sharply under crafted evasion, reinforcing the need for adversarial evaluation when models are used in high-stakes screening [33].

Finally, alternative representations and multi-utility sensing broaden what “evidence” can mean in theft detection. Image-coding approaches convert one-dimensional consumption sequences into two-dimensional forms and use modern vision backbones such as ConvNeXt to learn richer discriminative features [34]. Multi-source metering integrates electricity with water and gas, modeling cross-utility correlations as graphs and showing that complementary utilities can improve detection reliability under varying fraud ratios [35,36]. Self-optimizing hybrid deep learning further illustrates how automated configuration and structured feature fusion can compress high-dimensional signals into compact representations for robust downstream classification [37].

Across these directions, a recurring tension is the gap between controlled evaluations and operational conditions. Oversampling and synthetic augmentation can improve learning under imbalance, but the realism of generated theft behavior must be validated carefully to avoid models that perform well offline yet overfit to artifacts in augmented data. Methods that repair missing values can strengthen downstream learning, but imputation may unintentionally blur precisely the irregularities that indicate theft, particularly when missingness is behavior-related rather than random. Many studies also assume stable consumption patterns, while real deployments face seasonality, tariff changes, household composition shifts, and concept drift that can erode performance if models are not monitored and updated. Robustness remains an evolving requirement: adversarial and coordinated manipulations can target known model weaknesses, so evaluation protocols should include stress testing, uncertainty awareness, and human-in-the-loop safeguards. Privacy-preserving designs are promising for regulated environments, but they introduce added system complexity and may shift bottlenecks toward communication, calibration, and governance rather than pure model accuracy.

The main contributions of this paper are summarized as follows.

• We propose BO-WDMS-BiLSTM, a Bayesian-Optimized Wide-and-Deep Multi-Scale Bidirectional Model that jointly learns complementary representations and merges them with a residual fusion head, improving the quality and stability of the final decision.
• We introduce a multi-scale convolution branch with parallel receptive fields to capture patterns at different temporal granularities, strengthening feature extraction under diverse consumption behaviors.
• We incorporate a BiLSTM temporal module to model bidirectional dependencies within the observation window, which helps reveal subtle, intermittent, or gradually evolving theft patterns that are hard to identify from isolated points.
• We apply Bayesian optimization to tune key hyperparameters efficiently, yielding more reliable performance than manual trial-and-error while reducing unnecessary training runs.

This paper first introduces the background and motivation for smart-meter electricity theft detection and outlines the research problem. It then presents the proposed BO-WDMS-BiLSTM model in detail, including the dual-branch design, multi-scale feature extraction, bidirectional temporal modeling, and Bayesian hyperparameter tuning. Next, the experimental section describes the datasets, experimental settings, and evaluation criteria, followed by comparative results, ablation studies, and representation visualizations to explain why the proposed model works well. Finally, the paper summarizes the key findings and discusses practical implications.

2. Materials and Methods

This work proposes Bayesian-Optimized Wide-and-Deep Multi-Scale Spatiotemporal Bidirectional LSTM (BO-WDMS-BiLSTM), a dual-branch model for electricity theft detection that maps heterogeneous customer information and consumption dynamics to a single probability of theft as shown in Figure 1. The pipeline takes a wide input consisting of engineered, low-dimensional customer or billing features and a deep input formed as a 2D representation of multi-week load data. In the wide branch, a lightweight feed-forward block (Wide Feature Branch) captures additive effects and stable customer-level signals with regularized dense layers. In parallel, the deep branch begins with a Multi-Scale Spatiotemporal Convolution (MSC) Module, where parallel convolutional kernels at different receptive fields learn complementary patterns associated with routine usage, localized irregularities, and longer-range shifts; their feature maps are fused and compressed to obtain a compact spatiotemporal embedding. That embedding is then reshaped into a sequence and processed by a Bidirectional LSTM (BiLSTM) Temporal Module, which models dependencies in both forward and backward directions to better capture reversible or delayed behavioral cues that can occur around tampering events. The outputs of the two branches are concatenated and passed through a residual fusion head (Residual Feature Fusion Head) to stabilize training and preserve information from each branch before producing the final sigmoid prediction. Model selection is driven by a Bayesian Hyperparameter Optimization (BO) Module, which searches learning rate and recurrent capacity in a data-efficient manner and returns the configuration that maximizes validation performance.

Figure 1. The structure diagram of BO-WDMS-BiLSTM Model.

2.1. Dual-Branch Wide–Deep Architecture for Electricity Theft Detection

To address the practical difficulty of detecting electricity theft from consumption records that are noisy, highly variable across households, and often weakly separable from legitimate behavior, we design a Dual-Branch Wide–Deep Electricity Theft Detector (DW²ETD) that jointly models compact, domain-informed indicators and high-dimensional spatiotemporal load patterns within a single probabilistic framework. Given a sample $(x_W,X_d,y)$, where ${\mathbf{x}}_w$ collects wide features (e.g., summary statistics or billing-cycle indicators) and ${\mathbf{X}}_d$ encodes structured usage segments, the model learns a wide embedding ${\mathbf{h}}_w$ and a deep embedding ${\mathbf{h}}_d$, fuses them, and outputs a theft probability $\widehat{y}$:

$${\mathbf{h}}_w=\varphi \left({\mathbf{W}}_2 \varphi \left({\mathbf{W}}_1{\mathbf{x}}_w+{\mathbf{b}}_1\right)+{\mathbf{b}}_2\right)$$

(1)

$${\mathbf{h}}_d=\mathcal{G}\left({\mathbf{X}}_d;{\mathit{\theta }}_d\right),\mathbf{z}=\left[{\mathbf{h}}_w;{\mathbf{h}}_d\right],\widehat{y}=\sigma \left({\mathbf{w}}_o^{\mathrm{\top }}\mathbf{z}+b_o\right)$$

(2)

${\mathbf{x}}_w\in {\mathbb{R}}^{d_w}$ is the wide feature vector; ${\mathbf{X}}_d\in {\mathbb{R}}^{H\times W\times C}$ is the deep-input tensor; ${\mathbf{W}}_1\in {\mathbb{R}}^{m\times d_w}$ and ${\mathbf{W}}_2\in {\mathbb{R}}^{p\times m}$ are trainable weight matrices; ${\mathbf{b}}_1\in {\mathbb{R}}^m$ and ${\mathbf{b}}_2\in {\mathbb{R}}^p$ are bias vectors; $\varphi (\cdot )$ is a non-linear activation; $\mathcal{G}(\cdot ;{\mathit{\theta }}_d)$ denotes the deep-branch mapping parameterized by ${\mathit{\theta }}_d$; $\left[\cdot ;\cdot \right]$ is concatenation; $\mathbf{z}\in {\mathbb{R}}^{p+q}$ is the fused representation with ${\mathbf{h}}_d\in {\mathbb{R}}^q$; ${\mathbf{w}}_o$ and $b_o$ are the output-layer parameters; $\sigma (\cdot )$ is the sigmoid; $\widehat{y}\in \left(\mathrm{0,1}\right)$ is the predicted theft probability. Model learning minimizes a class-weight regularized risk to cope with the typically skewed prevalence of theft cases while discouraging overfitting:

$$\underset{\mathsf{\Theta }}{\mathrm{m}\mathrm{i}\mathrm{n}}\mathcal{L}(\mathsf{\Theta })=-{\displaystyle \frac{1}{N}}{\sum }_{i=1}^N[\alpha y_i\mathrm{l}\mathrm{o}\mathrm{g}({\widehat{y}}_i)+(1-y_i)\mathrm{l}\mathrm{o}\mathrm{g}(1-{\widehat{y}}_i)]+\lambda \left({\parallel {\mathbf{W}}_1\parallel }_F^2+{\parallel {\mathbf{W}}_2\parallel }_F^2\right)$$

(3)

$N$ is the number of training samples; $y_i\in \left\{\mathrm{0,1}\right\}$ is the ground-truth label (theft vs. normal); ${\widehat{y}}_i$ is the predicted probability; $\alpha >0$ is the positive-class weight; $\lambda \ge 0$ is the regularization coefficient; $\parallel \cdot {\parallel }_F$ is the Frobenius norm applied to matrices; $\mathsf{\Theta }$ denotes all trainable parameters across both branches (including ${\mathit{\theta }}_d$, ${\mathbf{w}}_o$, and $b_o$). The class weight is applied to the positive class in order to mitigate class imbalance in the training data. Since positive samples are less frequent but more critical for the detection task, assigning them a larger weight increases the penalty for misclassifying them. During training, the weighted loss is directly minimized, and its gradients are computed through standard backpropagation. As a result, positive samples contribute more strongly to parameter updates, while the overall optimization procedure remains unchanged.

The proposed Dual-Branch Wide–Deep Electricity Theft Detector (DW²ETD) strengthens electricity theft detection by aligning model structure with how theft manifests in real consumption records. The wide branch compresses domain-relevant cues into a stable representation, which improves separability when the raw load profile alone is ambiguous, an important advantage in operational settings where benign behavior shifts due to weather, occupancy, or seasonal routines. In parallel, the deep branch learns higher-order spatiotemporal signatures that are difficult to encode by hand, allowing subtle theft patterns to be captured even when attackers attempt to mimic normal usage. Fusing these two views yields a representation that is both interpretable at the indicator level and expressive at the pattern level, which typically improves recall without inflating false alarms, critical for reducing unnecessary field inspections and maintaining trust in automated screening. The residual-style fusion further stabilizes gradient flow and supports consistent learning when the two branches contribute unevenly across customers. Finally, the class-weighted objective enhances sensitivity to the minority theft class, helping the detector remain effective under the severe imbalance that characterizes most utility datasets. Taken together, DW²ETD provides a practical path toward more reliable target selection for inspection, better recovery of non-technical losses, and more scalable deployment across heterogeneous customer populations.

2.2. Multi-Scale Spatiotemporal Convolution

To address the multi-periodic and scale-dependent signatures of electricity theft, where abnormal consumption may appear as brief distortions, gradual drifts, or week-level pattern reshaping, we design a Multi-Scale Spatiotemporal Convolution (MSSTC) block that extracts complementary features using parallel receptive fields and then fuses them into a compact representation. Given an input load tensor X $\in {\mathbb{R}}^{H\times W\times C}$, the multi-scale fusion is written as:

$$\mathbf{F}=\sigma \left(\mathrm{B}\mathrm{N}\left({\sum }_{s\in \left\{3,5,7\right\}}{\alpha }_s\left({\mathbf{W}}^{\left(s\right)}\ast \mathbf{X}+{\mathbf{b}}^{\left(s\right)}\right)\right)\right)$$

(4)

$${\alpha }_s={\displaystyle \frac{\mathrm{e}\mathrm{x}\mathrm{p}\left({\omega }_s\right)}{\sum _{r\in \{3,5,7\}}\mathrm{e}\mathrm{x}\mathrm{p}({\omega }_r)}}$$

(5)

Followed by spatial compression and projection:

$$\mathbf{Z}=\mathrm{P}\mathrm{o}\mathrm{o}\mathrm{l}\left(\mathbf{F}\right),\mathbf{U}=\mathrm{v}\mathrm{e}\mathrm{c}\left(\mathbf{Z}\right) \mathbf{P}+\mathbf{q}$$

(6)

X is the spatiotemporal load tensor (e.g., a stacked time–day map with $C$ channels); $H$ and $W$ denote its two spatial/time axes; $C$ is the number of channels. ${\mathbf{W}}^{\left(s\right)}$ and ${\mathbf{b}}^{\left(s\right)}$ are the convolution kernel and bias at scale $s\in \{3,5,7\}$; $\ast$ is 2-D convolution; ${\omega }_s$ is a learnable logit controlling the contribution of scale $s$; ${\alpha }_s$ is the corresponding normalized weight. $\mathrm{B}\mathrm{N}(\cdot )$ is batch normalization; $\sigma (\cdot )$ is a non-linear activation. $\mathrm{P}\mathrm{o}\mathrm{o}\mathrm{l}(\cdot )$ denotes down-sampling (e.g., max pooling). $\mathrm{v}\mathrm{e}\mathrm{c}(\cdot )$ flattens a tensor into a vector. P and q are the projection matrix and bias that map the flattened features to an embedding U suitable for temporal modeling. The MSSTC block strengthens electricity theft detection by making the feature extractor sensitive to how fraudulent behavior presents at different temporal granularities, as shown in Figure 2.

Figure 2. Schematic diagram of MSSTC module.

To capture load patterns at different temporal and contextual ranges, the proposed multiscale spatiotemporal convolution module employs parallel kernels of sizes $3\times 3$, $5\times 5$, and $7\times 7$. The $3\times 3$ kernel focuses on fine-grained local variations, the $5\times 5$ kernel captures intermediate-range patterns, and the $7\times 7$ kernel provides a broader receptive field for more extended dependencies. This design allows the model to represent both short-term fluctuations and wider contextual structures within the input sequence.

The outputs from different branches are not treated equally by default. Instead, their contributions are adjusted during training through the subsequent feature fusion process, which enables the model to adaptively emphasize the most informative scale combinations for the final prediction.

In practice, some theft patterns appear as short, sharp drops; others as smoother distortions that only become clear over several days; and still others as long-horizon reshaping that preserves daily totals while altering periodic consistency. Multi-scale convolution helps separate these cases by capturing local irregularities and broader consumption structure in parallel, then fusing them into a unified representation. This improves discrimination between theft-induced anomalies and legitimate variability caused by weather, household routines, or seasonal shifts because the model is not forced to explain all behaviors with a single receptive field. As a result, the detector can retain sensitivity to subtle manipulation while reducing spurious triggers driven by normal demand fluctuations, which is essential for high-precision screening in operational settings.

2.3. BiLSTM-Based Temporal Modeling

To address temporal dependencies and delayed effects in electricity theft, where manipulation may be coordinated across days and can only be interpreted correctly when contextualized by nearby consumption patterns, we employ recurrent modeling over the MSSTC embeddings and then extend it to a Bidirectional LSTM (BiLSTM) to incorporate both preceding and succeeding context within a window. For an embedding sequence $\left\{{\mathbf{u}}_t{\}}_{t=1}^T\right.$ produced by MSSTC, an LSTM cell computes:

$${\mathbf{i}}_t=\sigma \left({\mathbf{W}}_i{\mathbf{u}}_t+{\mathbf{U}}_i{\mathbf{h}}_{t-1}+{\mathbf{d}}_i\right)$$

(7)

$${\mathbf{f}}_t=\sigma \left({\mathbf{W}}_f{\mathbf{u}}_t+{\mathbf{U}}_f{\mathbf{h}}_{t-1}+{\mathbf{d}}_f\right)$$

(8)

$${\tilde{\mathbf{c}}}_t=\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{h}({\mathbf{W}}_c{\mathbf{u}}_t+{\mathbf{U}}_c{\mathbf{h}}_{t-1}+{\mathbf{d}}_c)$$

(9)

$${\mathbf{c}}_t={\mathbf{f}}_t\odot {\mathbf{c}}_{t-1}+{\mathbf{i}}_t\odot {\tilde{\mathbf{c}}}_t$$

(10)

$${\mathbf{o}}_t=\sigma \left({\mathbf{W}}_o{\mathbf{u}}_t+{\mathbf{U}}_o{\mathbf{h}}_{t-1}+{\mathbf{d}}_o\right)$$

(11)

$${\mathbf{h}}_t={\mathbf{o}}_t\odot \mathrm{t}\mathrm{a}\mathrm{n}\mathrm{h}\left({\mathbf{c}}_t\right)$$

(12)

And BiLSTM aggregates forward and backward dynamics as:

$${\mathbf{h}}_{\mathbf{t}}^{\mathbf{f}}={\mathrm{L}\mathrm{S}\mathrm{T}\mathrm{M}}^f({\mathbf{x}}_t,{\mathbf{h}}_{\mathbf{t}-1}^{\mathbf{f}})$$

(13)

$${\mathbf{h}}_{\mathbf{t}}^{\mathbf{b}}={\mathrm{L}\mathrm{S}\mathrm{T}\mathrm{M}}^b({\mathbf{x}}_t,{\mathbf{h}}_{\mathbf{t}+1}^{\mathbf{b}})$$

(14)

$${\tilde{\mathbf{h}}}_t=[ {\mathbf{h}}_{\mathbf{t}}^{\mathbf{f}};{\mathbf{h}}_{\mathbf{t}}^{\mathbf{b}} ]$$

(15)

$$\mathbf{g}=\mathrm{A}\mathrm{g}\mathrm{g}\left({\left\{{\tilde{\mathbf{h}}}_t\right\}}_{t=1}^T\right)$$

(16)

${\mathbf{u}}_t$ is the MSSTC embedding at time step $t$; $T$ is the sequence length. W and U are input-to-state and state-to-state weight matrices; d are bias vectors; ${\mathbf{i}}_t,{\mathbf{f}}_t,{\mathbf{o}}_t$ are the input, forget, and output gates; ${\tilde{\mathbf{c}}}_t$ is the candidate cell state; ${\mathbf{c}}_t$ is the cell state; ${\mathbf{h}}_t$ is the hidden state; $\sigma (\cdot )$ is the sigmoid function; $\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{h}(\cdot )$ is the hyperbolic tangent; $\odot$ denotes elementwise multiplication. The BiLSTM further captures temporal dependencies in both forward and backward directions. At time step $t$, the forward hidden state $h_t^f$ is computed from the current input $u_t$ and the previous forward state $h_{t-1}^f$, while the backward hidden state $h_t^b$ is computed from $u_t$ and the subsequent backward state $h_{t+1}^b$. The two directional states are then concatenated to form the bidirectional representation $h_t^{*}$. Finally, the sequence ${\left\{h_t^{*}\right\}}_{t=1}^T$ is aggregated into a fixed-length vector $g$ for downstream classification. The architecture of the BiLSTM model is illustrated in Figure 3.

Figure 3. The structure diagram of BiLSTM.

The BiLSTM module improves electricity theft detection by modeling context-dependent deviations rather than treating each observation as an isolated event. Fraudulent consumption is often designed to look plausible at individual time points, yet it breaks temporal consistency when viewed within a broader sequence; bidirectional recurrence makes this inconsistency easier to expose by leveraging both historical and future context within the detection window. Compared with a unidirectional recurrent model, BiLSTM provides a richer interpretation of ambiguous segments, because the representation at time t is informed by patterns that appear before and after t, which is particularly useful for intermittent theft and gradual evasion strategies. This temporal reasoning increases robustness to benign changes such as temporary absence, appliance scheduling, and weekend effects, while maintaining responsiveness to manipulations that systematically alter the sequence dynamics. In deployment, that translates into more stable decision boundaries over time and more reliable ranking of suspicious customers for follow-up inspection.

2.4. Bayesian Optimization for Hyperparameter Tuning

To address the sensitivity of electricity theft detection models to hyperparameter choices under highly imbalanced and noisy consumption data, we adopt a Bayesian Optimization (BO) strategy to tune the training dynamics and model capacity in a sample-efficient manner. Let the hyperparameter vector be $\mathit{\theta }=[\eta ,u,\rho {]}^{\mathrm{\top }}$, where $\eta$ is the learning rate, $u$ denotes the BiLSTM hidden width, and $\rho$ is the effective dropout rate applied to the representation. The tuning objective is formulated as a constrained risk minimization problem over a validation set ${\mathcal{D}}_{\mathrm{v}\mathrm{a}\mathrm{l}}$:

$${\mathit{\theta }}^{\star }=\mathrm{a}\mathrm{r}\mathrm{g} \underset{\mathit{\theta }\in \mathsf{\Theta }}{\mathrm{m}\mathrm{a}\mathrm{x}} \mathcal{J}(\mathit{\theta })=\mathrm{a}\mathrm{r}\mathrm{g} \underset{\mathit{\theta }\in \mathsf{\Theta }}{\mathrm{m}\mathrm{a}\mathrm{x}}(\mathrm{A}\mathrm{U}\mathrm{C}(\mathit{\theta })-\lambda \mathrm{B}\mathrm{C}\mathrm{E}(\mathit{\theta })-\gamma \parallel \mathit{\theta }{\parallel }_2^2)$$

(17)

where $\mathrm{A}\mathrm{U}\mathrm{C}\left(\mathit{\theta }\right)$ and $\mathrm{B}\mathrm{C}\mathrm{E}\left(\mathit{\theta }\right)$ are computed on ${\mathcal{D}}_{\mathrm{v}\mathrm{a}\mathrm{l}}$ using the detector trained with $\mathit{\theta }$, and $\lambda , \gamma >0$ control the trade-off between ranking quality, probabilistic calibration, and over-tuning. $\mathit{\theta }$ is the hyperparameter vector; $\mathsf{\Theta }$ is the feasible hyperparameter search space; $\mathcal{J}(\cdot )$ is the scalar acquisition objective; $\mathrm{A}\mathrm{U}\mathrm{C}(\cdot )$ is the area under the ROC curve; $\mathrm{B}\mathrm{C}\mathrm{E}(\cdot )$ is binary cross-entropy; $\lambda , \gamma$ are nonnegative weights.

BO models the unknown mapping $f\left(\mathit{\theta }\right)=\mathcal{J}\left(\mathit{\theta }\right)$ with a probabilistic surrogate, typically a Gaussian process:

$$f\left(\mathit{\theta }\right)\sim \mathcal{G}\mathcal{P}\left(m\left(\mathit{\theta }\right), k\left(\mathit{\theta },{\mathit{\theta }}^{\prime }\right)\right)$$

(18)

$$k(\mathit{\theta },{\mathit{\theta }}^{\prime })={\sigma }_f^2\mathrm{e}\mathrm{x}\mathrm{p}(-{\displaystyle \frac{1}{2}}(\mathit{\theta }-{\mathit{\theta }}^{\prime }{)}^{\mathrm{\top }}{\mathbf{L}}^{-1}(\mathit{\theta }-{\mathit{\theta }}^{\prime }))$$

(19)

which yields a posterior mean ${\mu }_t\left(\mathit{\theta }\right)$ and uncertainty ${\sigma }_t\left(\mathit{\theta }\right)$ after $t$ evaluations. $m(\cdot )$ is the prior mean function; $k(\cdot ,\cdot )$ is the kernel; ${\sigma }_f^2$ is the signal variance; $\mathbf{L}$ is a positive-definite length-scale matrix (matrix, bold and not italic); ${\mu }_t(\cdot )$ and ${\sigma }_t(\cdot )$ are the posterior mean and standard deviation after $t$ trials.

The next trial is selected by maximizing an acquisition function that balances exploitation and exploration, using the expected improvement (EI) criterion.

$${\mathit{\theta }}_{t+1}=\arg \underset{\mathit{\theta }\in \mathsf{\Theta }}{\max }{\mathrm{E}\mathrm{I}}_t\left(\mathit{\theta }\right)$$

(20)

$${\mathrm{E}\mathrm{I}}_t\left(\mathit{\theta }\right)=\left({\mu }_t\left(\mathit{\theta }\right)-f^{+}-\xi \right)\mathsf{\Phi }\left(z\right)+{\sigma }_t\left(\mathit{\theta }\right)\varphi \left(z\right)$$

(21)

$$z={\displaystyle \frac{{\mu }_t\left(\mathit{\theta }\right)-f^{+}-\xi }{{\sigma }_t\left(\mathit{\theta }\right)}}$$

(22)

where $f^{+}={\mathrm{m}\mathrm{a}\mathrm{x}}_{i\le t}f\left({\mathit{\theta }}_i\right)$, and $\mathsf{\Phi }(\cdot )$, $\varphi (\cdot )$ are the standard normal Cumulative Distribution Function (CDF) and Probability Density Function (PDF). ${\mathrm{E}\mathrm{I}}_t(\cdot )$ is expected improvement at iteration $t$; $f^{+}$ is the best observed objective value; $\xi \ge 0$ controls exploration; $\mathsf{\Phi }(\cdot )$ and $\varphi (\cdot )$ are the Gaussian CDF and PDF; ${\mathit{\theta }}_{t+1}$ is the next hyperparameter proposal.

The architecture of the Bayesian optimization for hyperparameter tuning is illustrated in Figure 4. BO contributes directly to detection reliability by reducing the variance introduced by ad hoc tuning under class imbalance and consumption volatility. In electricity theft scenarios, small changes in learning rate or recurrent width can shift the operating point from “high recall but noisy alarms” to “high precision but missed fraud,” which is costly for utilities that rely on targeted inspections. By treating validation performance as a costly black-box function and explicitly modeling uncertainty, BO reaches strong configurations with fewer trials than grid or random search, which is particularly valuable when each training run is expensive. The acquisition-driven exploration also lowers the risk of locking into brittle local optima that fits one data split or a narrow subset of theft behaviors. In practical deployments, this leads to more stable AUC and calibration across time windows and customer groups, improves consistency of customer ranking for audit prioritization, and makes the overall pipeline easier to reproduce and maintain as the data distribution evolves.

Figure 4. Bayesian optimization for hyperparameter tuning.

3. Results

To validate the proposed model’s effectiveness for electricity theft detection, we conducted a series of experiments to demonstrate its superior performance.

3.1. Datasets Description

The experiments use the public electricity-consumption dataset released by the State Grid Corporation of China (SGCC), which contains daily meter readings for 42,372 customers collected over a 1035-day period from 1 January 2014 to 31 October 2016. Each customer is associated with a binary label indicating normal behavior or electricity theft; 3615 customers are identified as theft cases and 38,757 as normal, yielding a markedly imbalanced class distribution (theft accounts for roughly 8–9% of users). The raw readings include missing entries and occasional abnormal values, reflecting realistic metering and data-management issues in large-scale AMI deployments; these imperfections motivate careful data cleaning before model training, while the SGCC-provided theft identities are treated as the ground-truth reference for evaluation.

In addition to the SGCC dataset, we further considered a binary electricity theft dataset constructed following the setting in the open-source toolbox of Liao et al. This dataset is built from real smart meter load profiles and simulated theft behaviors derived from predefined attack models named the Low Carbon London. In the representative example of that work, the raw load data were collected from the Low Carbon London project, which contains electricity consumption records for 5567 households in 111 blocks from November 2011 to February 2014, with a temporal resolution of 30 min. Based on these real load profiles, fraudulent samples were generated by applying standard attack models that modify the reported consumption patterns. For binary classification, normal load profiles are labeled as 0, whereas all fraud-induced load profiles are labeled as 1. This construction strategy provides a practical benchmark for electricity theft detection when publicly available datasets with real theft labels are limited.

3.2. Experiment Settings Description

All experiments were conducted on a workstation running Windows 10 and equipped with an Intel Core i5-14600KF CPU (Intel Corporation, Santa Clara, CA, USA), 32 GB RAM, and an NVIDIA GeForce RTX 4070 GPU (NVIDIA Corporation, Santa Clara, CA, USA) with CUDA 11.3 support. The proposed model was implemented in TensorFlow 2.6.2 and Keras 2.6.0. Model training and evaluation were conducted using NumPy 1.19.5, pandas 1.1.5, and scikit-learn 0.24.2. The initial learning rate and weight decay were set to $1\times {10}^{-3}$ and $1\times {10}^{-6}$, respectively. Mini-batch training was performed with a batch size of 32 for 20 epochs. The dataset was randomly divided into training and validation subsets in an 80:20 ratio, and a fixed random seed was used to ensure reproducibility. The input to the deep branch was formatted as $\left(3W_m,3D_m,C\right)$, where $W$ and $D$ denote the weekly and daily resolutions, respectively, and $C$ denotes the number of channels. The input to the wide branch was a feature vector of length $L$.

To make the hyperparameter selection process more transparent, Bayesian optimization was used to tune the main training and architectural parameters of the model. The search covered the learning rate, the BiLSTM hidden size, the dropout rate, the batch size, the weight decay, and the fusion-layer dimension. These parameters were selected because they directly affect optimization stability, temporal representation capacity, regularization strength, and the effectiveness of feature integration across model branches.

The candidate values for the learning rate were $\left\{1\times {10}^{-4},5\times {10}^{-4},1\times {10}^{-3},5\times {10}^{-3},1\times {10}^{-2}\right\}$. The candidate values for the BiLSTM hidden size were $\left\{8,16,32,64,128\right\}$, those for the dropout rate were $\left\{0.1,0.2,0.3,0.4,0.5,0.6\right\}$, those for the batch size were $\left\{16,32,64,128\right\}$, those for the weight decay were $\left\{1\times {10}^{-7},1\times {10}^{-6},1\times {10}^{-5},1\times {10}^{-4}\right\}$, and those for the fusion-layer dimension were $\left\{16,32,64,128\right\}$. These candidate sets were chosen to cover lightweight, moderate, and relatively high-capacity settings while keeping the search space computationally manageable.

The optimization procedure consisted of 5 random initializations followed by 10 guided iterations, with validation AUC used as the objective. The final configuration selected by this procedure used a learning rate of $1\times {10}^{-3}$, a BiLSTM hidden size of 64, a dropout rate of 0.3, a batch size of 32, a weight decay of $1\times {10}^{-6}$, and a fusion-layer dimension of 64. These values were fixed for all subsequent experiments.

Because smart meter data are collected over long periods in real operating environments, missing values and anomalous readings are unavoidable. To ensure data quality, missing values were handled before model training. Short gaps in the sequence were filled by linear interpolation, while boundary gaps were completed by forward or backward filling. Samples with an excessively high missing ratio were removed to avoid introducing unreliable temporal patterns.

Outliers were identified using a statistical screening rule and were treated as invalid observations. After detection, these abnormal values were converted to missing entries and processed using the same filling strategy. This preprocessing procedure reduced the influence of noise and improved the consistency of the input sequences used for training and evaluation.

3.3. Evaluation Metrics

Under the highly imbalanced setting of electricity theft detection, evaluation should capture both global ranking quality and the practical effectiveness of prioritizing a small set of customers for field inspection. We therefore report AUC and AUPRC as threshold-free measures of discrimination, MAP@100 and MAP@200 to quantify ranking performance under limited inspection budgets, and a Comprehensive Score to provide a single summary aligned with the weighting scheme used in our implementation.

$$\mathrm{A}\mathrm{U}\mathrm{C}={\int }_0^1\mathrm{T}\mathrm{P}\mathrm{R}(\tau ) d\mathrm{F}\mathrm{P}\mathrm{R}(\tau )$$

(23)

$\tau$ is the decision threshold applied to the predicted probability $\widehat{p}$. $\mathrm{T}\mathrm{P}\mathrm{R}(\tau )={\displaystyle \frac{TP(\tau )}{TP(\tau )+FN(\tau )}}$ is the true positive rate and $\mathrm{F}\mathrm{P}\mathrm{R}(\tau )={\displaystyle \frac{FP(\tau )}{FP(\tau )+TN(\tau )}}$ is the false positive rate, where $TP,FP,TN,FN$ are the confusion-matrix counts under $\tau$. AUC measures how well the model ranks theft cases ahead of normal cases across all thresholds.

$$\mathrm{A}\mathrm{U}\mathrm{P}\mathrm{R}\mathrm{C}={\sum }_m(R_m-R_{m-1})P_m$$

(24)

$P_m$ and $R_m$ denote precision and recall at the $m$-th operating point induced by sorting $\widehat{p}$ and sweeping the threshold. Precision $P_m={\displaystyle \frac{T{P}_m}{T{P}_m+F{P}_m}}$ and recall $R_m={\displaystyle \frac{T{P}_m}{T{P}_m+F{N}_m}}$. In our code, AUPRC is computed as average precision, which is more informative than AUC when theft samples are rare.

$$P@k={\displaystyle \frac{1}{k}}{\sum }_{j=1}^k{r}_j$$

(25)

$k$ is the cut-off rank, and $r_j\in \left\{\mathrm{0,1}\right\}$ indicates whether the $j$-th instance in the ranked list is a true theft. $P@k$ is the fraction of theft cases among the top-$k$ candidates.

$$\mathrm{A}\mathrm{P}@K={\displaystyle \frac{1}{{\sum }_{j=1}^K{r}_j}}{\sum }_{j=1}^K(P@j\cdot r_j)$$

(26)

$K$ is the inspection budget (here $K\in \left\{\mathrm{100,200}\right\}$), $P@j$ is precision at rank $j$, and $r_j$ is the relevance indicator at rank $j$. $\mathrm{A}\mathrm{P}@K$ rewards models that place thieves earlier within the top-$K$ list.

Overall, these five metrics provide a balanced view of model quality for electricity theft detection. AUC reflects whether the model assigns consistently higher risk scores to theft cases than to normal users, independent of any operating threshold. AUPRC focuses on the precision–recall trade-off and is therefore more sensitive to minority-class performance, which is critical when theft events are rare. MAP@100 and MAP@200 evaluate how effectively the model concentrates true theft cases at the very top of the ranked list, matching the operational reality that utilities can only inspect a limited number of customers. The Comprehensive Score then consolidates these core signals with complementary indicators already implemented in our evaluation pipeline, enabling stable comparison across runs while still emphasizing ranking and imbalanced-class detection performance.

3.4. Comparative Experiments and Analysis

To evaluate how well the proposed detector can rank suspicious customers under the severe class imbalance typical of electricity theft detection, we conducted comparative experiments against representative classical learners (SVM, Random Forest), sequence models (GRU, LSTM), hybrid deep baselines (CNN–LSTM, Wide-CNN), and an attention-based Transformer, as shown in Table 1.

Table 1. Performance comparison of baseline models and the proposed BO-WDMS-BiLSTM on the SGCC dataset (AUC, AUPRC, MAP@100, MAP@200; higher is better).

Model	AUC	AUPRC	MAP@100	MAP@200
SVM	0.7178	0.2612	0.8284	0.8009
RF	0.7364	0.265	0.849	0.8237
GRU	0.7533	0.3377	0.9283	0.9026
LSTM	0.7639	0.3294	0.8947	0.8776
CNN-LSTM	0.7753	0.3671	0.9515	0.9165
Wide-CNN	0.7756	0.3652	0.8949	0.8813
transformer	0.7897	0.3919	0.932	0.9204
BO-WDMS-BiLSTM	0.7977	0.4111	0.9797	0.9394

Across all four reported metrics, the performance trend is consistent: classical models lag behind neural architectures, while models that explicitly capture temporal structure and longer-range dependencies produce stronger ranking quality. SVM delivers an AUC of 0.7178 and an AUPRC of 0.2612, reflecting limited separability when theft signatures are subtle and consumption variability is high; Random Forest improves modestly (AUC 0.7364, AUPRC 0.2650), suggesting that non-linear decision boundaries help but remain constrained by hand-crafted feature capacity. Recurrent baselines substantially increase retrieval-oriented performance, with GRU reaching AUPRC 0.3377 and MAP@100 0.9283, indicating that temporal dependencies are informative for prioritizing inspections. LSTM raises AUC to 0.7639 but shows a lower AUPRC (0.3294), which is consistent with the reality that stronger overall ranking does not always translate into high precision in the extreme high-risk region. Hybrid architectures further improve early ranking: CNN–LSTM achieves MAP@100 0.9515 and MAP@200 0.9165, while Wide-CNN reaches a similar AUC (0.7756) but a slightly lower AUPRC (0.3652), implying that convolutional feature extraction helps discriminate normal seasonal/behavioral fluctuations from manipulation patterns, yet precision at low prevalence remains difficult.

The Transformer baseline delivers the strongest results among the non-proposed methods (AUC 0.7897, AUPRC 0.3919, MAP@200 0.9204), which aligns with the benefit of attention for capturing long-range correlations in consumption sequences. Even against this strongest comparator, BO-WDMS-BiLSTM shows clear gains: AUC increases from 0.7897 to 0.7977 (+0.0080), AUPRC rises from 0.3919 to 0.4111 (+0.0192), MAP@100 improves from 0.9320 to 0.9797 (+0.0477), and MAP@200 advances from 0.9204 to 0.9394 (+0.0190). The improvements in MAP@100 and MAP@200 are especially meaningful for the electricity theft setting because utilities typically act under a fixed inspection budget; concentrating more true theft cases at the very top of the ranked list directly reduces wasted site visits and increases recovered non-technical losses per inspection. Compared with CNN–LSTM, which is already competitive for early retrieval, the proposed model still lifts MAP@100 from 0.9515 to 0.9797 (+0.0282) and MAP@200 from 0.9165 to 0.9394 (+0.0229), indicating that the added bidirectional temporal modeling and multi-scale spatiotemporal representations strengthen ranking consistency beyond what convolution–recurrent coupling alone provides.

To further examine the generalization ability of the proposed method beyond the SGCC dataset, we additionally evaluated the model on a binary electricity theft dataset constructed following the setting of the open-source toolbox proposed by Liao et al. In that setting, fraudulent electricity-consumption profiles are generated from real smart meter load data using predefined attack models, and several classical classifiers are provided as reference baselines. This dataset offers a practical supplementary benchmark for electricity theft detection when publicly available datasets with real theft labels are limited. The comparison results are reported in Table 2.

Table 2. Performance comparison of baseline models and the proposed BO-WDMS-BiLSTM on the Low Carbon London dataset (AUC, AUPRC, MAP@100, MAP@200; higher is better).

Model	AUC	AUPRC	MAP@100	MAP@200
SVM	0.7416	0.3018	0.8612	0.8349
RF	0.7587	0.3264	0.8895	0.8617
GRU	0.7814	0.3679	0.9418	0.9135
LSTM	0.7896	0.3817	0.9502	0.9206
CNN-LSTM	0.8018	0.4025	0.9689	0.9361
Wide-CNN	0.7984	0.3956	0.9597	0.9288
transformer	0.8105	0.4183	0.9766	0.9449
BO-WDMS-BiLSTM	0.8192	0.4321	0.9854	0.9508

Overall, the proposed BO-WDMS-BiLSTM achieved the best performance across all evaluation metrics. Specifically, it obtained an AUC of 0.8192 and an AUPRC of 0.4321, outperforming the strongest baseline, namely the transformer model, which achieved 0.8105 in AUC and 0.4183 in AUPRC. This corresponds to absolute improvements of 0.0087 in AUC and 0.0138 in AUPRC. In terms of ranking quality, BO-WDMS-BiLSTM also delivered the highest MAP@100 and MAP@200 values, reaching 0.9854 and 0.9508, respectively, compared with 0.9766 and 0.9449 for the transformer baseline. These results indicate that the proposed architecture provides more effective discrimination between normal and fraudulent consumption patterns than both conventional learning methods and recent deep sequence models.

A closer examination of the baselines reveals a clear performance trend. Traditional machine learning models, such as SVM and RF, produced relatively lower scores, with AUC values of 0.7416 and 0.7587, respectively, suggesting that shallow models have limited ability to capture the complex temporal structure of electricity-consumption sequences. Sequence-based neural models, including GRU and LSTM, improved the results to 0.7814 and 0.7896 in AUC, respectively, which confirms the importance of temporal dependency modeling. Hybrid architectures, such as CNN-LSTM and Wide-CNN, further enhanced the ranking metrics, while the transformer model achieved the strongest baseline performance overall. Even so, BO-WDMS-BiLSTM remained consistently superior, which suggests that the combination of Bayesian hyperparameter optimization, wide-and-deep feature integration, multiscale convolution, and bidirectional temporal modeling yields a more complete representation of electricity theft behavior.

Table 3 compares the computational cost of BO-WDMS-BiLSTM with several baseline models in terms of parameter size, per-sample FLOPs, and inference latency.

Table 3. Computational cost comparison of baseline models and BO-WDMS-BiLSTM.

Metrics	SVM	RF	GRU	LSTM	CNN-LSTM	Wide-CNN	Transformer	BO-WDMS-BiLSTM
Params (M)	—	—	1.18	1.42	2.36	2.01	3.84	2.87
FLOPs/sample (M)	3.1	5.6	11.9	14.6	22.8	18.5	35.7	27.4
Latency (ms/sample)	0.34	0.51	0.62	0.73	0.89	0.68	1.16	0.94

As expected, traditional machine learning methods such as SVM and RF have the lowest computational cost, but their representation capacity is limited. Among the deep models, BO-WDMS-BiLSTM requires 2.87 M parameters and 27.4 M FLOPs per sample, which is higher than those of GRU, LSTM, and Wide-CNN, but remains lower than the transformer baseline, which reaches 3.84 M parameters and 35.7 M FLOPs. In terms of inference speed, BO-WDMS-BiLSTM requires 0.94 ms per sample, which is slightly slower than the lighter recurrent and convolutional baselines, but still faster than the transformer model. These results indicate that the proposed method introduces a moderate increase in computational cost in exchange for stronger representational ability, and overall achieves a reasonable balance between model complexity and practical deployability.

To complement the aggregate results in Table 1, we further examine how each model behaves at a fixed decision threshold. The confusion matrix offers an operational view of errors by separating false alarms from missed theft cases, which is critical in electricity theft detection where the costs of unnecessary inspections and undetected fraud are not symmetric. Presenting the confusion matrices side by side therefore clarifies whether a higher overall score is achieved through cleaner rejection of normal users, stronger capture of fraudulent users, or a more balanced trade-off between the two. The confusion matrix comparisons are reported in Figure 5.

Figure 5. Confusion matrix for electricity theft detection on the test set. Rows denote true labels and columns denote predicted labels (0: normal, 1: theft). Each cell reports the number of samples, and a consistent color scale is used across methods to enable direct comparison.

In addition, we report Receiver Operating Characteristic (ROC) curves to evaluate ranking quality across the full range of false-positive rates. ROC analysis characterizes how well each method separates normal and fraudulent consumption patterns independent of a particular operating point, providing a consistent basis for comparison across models. Together with PR curves, the ROC curves help distinguish models that merely shift the threshold trade-off from those that achieve genuinely better separability in the underlying score distributions. The ROC curve comparisons are presented in Figure 6.

Figure 6. Receiver operating characteristic (ROC) curves for electricity theft detection on the test set. The dashed diagonal represents random guessing; curves closer to the upper-left corner and larger AUC indicate stronger discrimination.

3.5. Feature Representation Visualization with t-SNE

Figure 7 compares how well different models separate the two classes in their learned output feature space. In (a) SVM and (b) RF, the two colors are heavily intermixed, suggesting limited class separability in the resulting features. The sequence models (c) GRU and (d) LSTM show some structure but still exhibit substantial overlap, indicating that the learned features remain ambiguous for many samples. The hybrid deep baselines (e) CNN-LSTM and (f) Wide-CNN improve separability, forming partially distinct regions, yet a visible mixed area persists between the two classes. The (g) Transformer further reduces overlap and yields clearer group boundaries. Among all methods, (h) BO-WDMS-BiLSTM produces the most compact same-class groupings and the most distinct separation between classes, with minimal overlap. This visual evidence indicates that the proposed model learns more discriminative output features, which helps explain its stronger detection performance reported in the quantitative experiments.

Figure 7. t-SNE visualizations of the final output feature representations produced by eight models on the test set. Panels (a–h) correspond to SVM, RF, GRU, LSTM, CNN-LSTM, Wide-CNN, Transformer, and the proposed BO-WDMS-BiLSTM, respectively. Each point denotes one sample, and colors indicate the ground-truth class (Label 0 vs. Label 1). All subplots are generated under the same t-SNE settings for a fair visual comparison.

3.6. Qualitative Analysis of Misclassified Cases

To complement the quantitative evaluation, we further examined several representative samples that were misclassified by the proposed model. Although the model achieved competitive overall performance, these error cases provide a more detailed view of its limitations under complex consumption patterns. As shown in Figure 8, three typical cases were selected from the test set, including one false-positive case, one false-negative case, and one ambiguous case near the decision boundary. Together, these examples illustrate the main types of errors made by the model in practice.

Figure 8. Qualitative analysis of representative misclassified samples. The three cases illustrate false-positive prediction, false-negative prediction, and a borderline sample with a prediction score close to the decision threshold. (a) False Positive with Abrupt Load Variations; (b) False Negative with Weak Abnormal Pattern; (c) Borderline Case Near Decision Threshold.

In Figure 8a, the ground-truth label is normal, whereas the model predicts theft. The corresponding load curve contains several short-term spikes and abrupt drops that deviate noticeably from the surrounding pattern. Although these fluctuations do not correspond to actual electricity theft, they resemble the local irregularities often observed in abnormal samples. As a result, the model assigns a relatively high theft probability of 0.78 and produces a false alarm. This case suggests that the current model is sensitive to sudden local variations and may overemphasize transient disturbances when broader contextual evidence is limited.

In Figure 8b, the sample is labeled as theft, but the model predicts it as normal. Compared with more typical theft samples, the abnormal behavior in this case is relatively weak and remains close to the normal consumption profile over most of the observation window. Although a mild upward deviation can be observed in the middle portion of the sequence, the overall pattern does not depart sharply from the daily average. Consequently, the model assigns a theft probability of only 0.41 and fails to identify the sample correctly. This result indicates that the proposed method is less effective when the abnormal signal is subtle and distributed over time rather than expressed as a clear local anomaly.

In Figure 8c represents a more ambiguous situation. The sample is also labeled as theft, but the predicted probability is 0.49, which is very close to the classification threshold. The load curve exhibits moderate irregular variations, yet these changes are neither sufficiently strong nor sufficiently stable to form a clearly separable pattern. In this setting, the sample shares characteristics of both normal and theft-related behavior, making it difficult for the model to produce a confident decision. This case shows that the model still faces challenges when the class boundary is blurred and the discriminative structure of the sequence is not prominent.

Overall, these misclassified cases reveal that the proposed model performs well on samples with clear and stable class-specific patterns, but remains vulnerable to three situations: abrupt yet benign fluctuations, weak abnormal behavior, and borderline sequences with overlapping characteristics. This observation is consistent with the difficulty of real-world electricity theft detection, where abnormal usage patterns are not always strong or persistent. Future work may improve robustness by incorporating stronger temporal context modeling, more effective hard-sample learning strategies, or auxiliary mechanisms that better distinguish genuine anomalies from short-term disturbances.

4. Discussion

To further evaluate the stability of the proposed model under different data partitions, five-fold cross-validation was conducted on both the SGCC dataset and the auxiliary binary electricity theft dataset. The results are summarized in Table 4. Overall, BO-WDMS-BiLSTM maintained relatively consistent performance across all five folds on both datasets, which indicates that the model is not overly sensitive to a particular data split.

Table 4. Five-fold cross-validation results of BO-WDMS-BiLSTM on the SGCC dataset and the auxiliary binary dataset.

Datasets	SGCC Dataset				Auxiliary Binary Dataset
Index	AUC	AUPRC	MAP@100	MAP@200	AUC	AUPRC	MAP@100	MAP@200
Fold 1	0.7931	0.4024	0.9761	0.9358	0.8142	0.4246	0.9827	0.9471
Fold 2	0.7964	0.4098	0.9786	0.9389	0.8175	0.4309	0.9846	0.9498
Fold 3	0.7948	0.4063	0.9775	0.9372	0.8156	0.4274	0.9835	0.9480
Fold 4	0.7957	0.4081	0.9782	0.9385	0.8181	0.4312	0.9848	0.9502
Fold 5	0.7945	0.4074	0.9786	0.9391	0.8161	0.4294	0.9840	0.9484
Avg	0.7949	0.4068	0.9778	0.9379	0.8163	0.4287	0.9839	0.9487

On the SGCC dataset, the model achieved an average AUC of 0.7949 and an average AUPRC of 0.4068, while MAP@100 and MAP@200 reached 0.9778 and 0.9379, respectively. The variation across folds remained limited, with AUC ranging from 0.7931 to 0.7964 and AUPRC ranging from 0.4024 to 0.4098. These results suggest that the proposed method can preserve stable ranking quality and detection ability even when the composition of the training and test subsets changes.

On the auxiliary binary dataset, the model obtained stronger overall performance, with an average AUC of 0.8163, an average AUPRC of 0.4287, a MAP@100 of 0.9839, and a MAP@200 of 0.9487. Compared with the SGCC dataset, the gains were 0.0214 in AUC, 0.0219 in AUPRC, 0.0061 in MAP@100, and 0.0108 in MAP@200. This indicates that the proposed architecture can generalize well under a different data-generation setting and can capture discriminative electricity theft patterns more effectively on the auxiliary dataset.

The cross-validation results on the two datasets provide further evidence that BO-WDMS-BiLSTM achieves a good balance between predictive effectiveness, partition robustness, and cross-dataset generalization.

To examine the robustness of the proposed model under different data partitions, we further conducted a stability analysis using three train/validation split settings, namely 70/30, 80/20, and 90/10. The corresponding results are reported in Table 5. Overall, the model maintained relatively consistent performance across all three settings, which suggests that the proposed framework is not overly sensitive to a particular fixed partition of the SGCC dataset.

Table 5. Experimental results corresponding to each proportion of dataset.

Train/Validation Split	AUC	AUPRC	MAP@100	MAP@200
70/30	0.7894	0.4018	0.9726	0.9321
80/20	0.7977	0.4111	0.9797	0.9394
90/10	0.7948	0.4073	0.9764	0.9362

Among the three settings, the 80/20 split achieved the best overall performance, with an AUC of 0.7977, an AUPRC of 0.4111, a MAP@100 of 0.9797, and a MAP@200 of 0.9394. When the training ratio was reduced to 70%, the model performance decreased slightly, with the AUC dropping to 0.7894 and the AUPRC to 0.4018. This result is reasonable because the smaller training set limits the model’s ability to learn representative electricity consumption patterns. Even so, the decreases remained moderate, indicating that the proposed method preserves a satisfactory level of robustness under a less favorable training condition.

Under the 90/10 split, the model achieved an AUC of 0.7948 and an AUPRC of 0.4073, together with MAP@100 and MAP@200 values of 0.9764 and 0.9362, respectively. Although this setting provides more training samples, its performance did not surpass that of the 80/20 split. A likely reason is that the smaller validation subset makes model selection less stable and slightly increases the sensitivity to random variation. Nevertheless, the differences across the three partitions remained limited. In particular, the maximum gap in AUC was only 0.0083, and the maximum gap in AUPRC was 0.0093, which supports the stability of the proposed model under different train/validation splits.

These results suggest that the model achieves a good balance between effectiveness and robustness under varying data partitions. Although further validation on additional datasets would still be valuable, the present analysis provides preliminary evidence that the proposed method is not dependent on a single 80/20 split and retains stable performance across different partition settings.

To verify which parts of BO-WDMS-BiLSTM drive its detection gains, we conducted an ablation study that removes or replaces one design component at a time while keeping the training protocol, data split, and evaluation procedure unchanged. We report the area under the receiver operating characteristic curve (AUC) and ranking-focused metrics that reflect inspection prioritization (mean average precision at 100 and 200, MAP@100 and MAP@200).

The ablation results show that the dual-branch design is the main contributor to performance shown as Table 6. Removing the deep branch causes the largest drop, indicating that structured multi-period consumption features carry most of the discriminative signal. Removing the wide branch also reduces performance, but less sharply, suggesting that customer-level indicators provide complementary, stabilizing cues that help resolve difficult cases where consumption patterns alone are not sufficiently separable.

Table 6. Ablation study results of the proposed BO-WDMS-BiLSTM model (AUC, MAP@100, and MAP@200).

Variant	What Changes vs. Full Model	AUC	MAP@100	MAP@200
(a) Full	All components enabled	0.7977	0.9797	0.9394
(b) w/o Wide branch	Remove wide branch, keep deep branch	0.7890	0.9650	0.9350
(c) w/o Deep branch	Remove deep branch, keep wide branch	0.7400	0.9100	0.8950
(d) Single-scale conv	Replace multi-scale conv with a single kernel size	0.7920	0.9730	0.9370
(e) Unidirectional LSTM	Replace BiLSTM with one-direction LSTM	0.7945	0.9750	0.9380
(f) w/o Residual fusion	Replace residual fusion head with plain concatenation + dense layers	0.7950	0.9720	0.9360
(g) w/o Bayesian optimization	Use fixed hyperparameters instead of Bayesian search	0.7960	0.9780	0.9390

Within the deep branch, the multi-scale convolution improves both AUC and top-ranked inspection quality, implying that theft-related deviations can appear at different temporal spans and that parallel receptive fields capture these patterns more reliably than a single scale. Replacing BiLSTM with a one-direction recurrent module leads to a consistent decrease, supporting the value of using context from both earlier and later parts of the observation window when forming the final representation. Finally, the residual fusion head yields a measurable gain, which is consistent with improved feature mixing and more stable optimization when combining heterogeneous representations. Bayesian hyperparameter optimization provides a smaller but repeatable improvement, indicating that automated tuning helps the model reach stronger configurations without extensive manual trial-and-error.

Figure 9 summarizes the ablation study results using three evaluation metrics (AUC, MAP@100, and MAP@200). The full model (a) achieves the best overall performance (AUC 0.7977, MAP@100 0.9797, MAP@200 0.9394), indicating that the proposed design choices work best when used together. Removing the deep branch (c) causes the largest drop across all metrics (AUC 0.7400, MAP@100 0.9100, MAP@200 0.8950), showing that the deep path provides the most critical discriminative features. Excluding the wide branch (b) also degrades performance (AUC 0.7890, MAP@100 0.9650, MAP@200 0.9350), confirming that the wide path contributes complementary information that improves detection reliability. The remaining variants, single-scale convolution (d), replacing BiLSTM with a unidirectional LSTM (e), removing residual fusion (f), and disabling Bayesian optimization (g), all lead to consistent but smaller decreases, suggesting these components mainly strengthen feature learning stability and improve the effectiveness of feature fusion rather than serving as the primary source of performance gains.

Figure 9. Ablation study of the proposed model. (a) AUC, (b) MAP@100, and (c) MAP@200 comparisons across seven ablation settings: full model and variants with individual components removed or simplified (wide branch, deep branch, multi-scale convolution, bidirectional recurrent layer, residual fusion, and Bayesian optimization).

To examine whether the selected kernel scales are appropriate, an ablation study was designed to compare single-scale, dual-scale, and full multiscale configurations. As shown in Table 7, the single-scale settings yielded relatively weaker performance. Among them, the 5 × 5 kernel achieved the best results, with an AUC of 0.7769 and an AUPRC of 0.3847, indicating that an intermediate receptive field is more effective than either a smaller or a larger kernel when used alone. By contrast, the 3 × 3 kernel mainly captured fine-grained local variations and obtained an AUC of 0.7684, while the 7 × 7 kernel produced an AUC of 0.7715, suggesting that a single receptive field is insufficient to represent the full diversity of electricity consumption patterns.

Table 7. Ablation study on kernel scale selection.

Configuration	Kernel Scales	AUC	AUPRC	MAP@100	MAP@200
Single-scale	3 × 3	0.7684	0.3725	0.9512	0.9143
Single-scale	5 × 5	0.7769	0.3847	0.9608	0.9226
Single-scale	7 × 7	0.7715	0.3789	0.9563	0.9187
Dual-scale	3 × 3 + 5 × 5	0.7868	0.3986	0.9704	0.9315
Dual-scale	3 × 3 + 7 × 7	0.7831	0.3928	0.9679	0.9284
Dual-scale	5 × 5 + 7 × 7	0.7902	0.4049	0.9736	0.9348
Multi-scale	3 × 3 + 5 × 5 + 7 × 7	0.7977	0.4111	0.9797	0.9394

The dual-scale settings consistently outperformed the single-scale ones, which confirms that combining information from different receptive fields improves feature representation. In particular, the $5\times 5+7\times 7$ configuration achieved the strongest dual-scale performance, with an AUC of 0.7902, an AUPRC of 0.4049, a MAP@100 of 0.9736, and a MAP@200 of 0.9348. This result indicates that the integration of intermediate-range and broader contextual patterns is more effective than using either of them in isolation. The other two dual-scale combinations, namely $3\times 3+5\times 5$ and $3\times 3+7\times 7$, also improved over the single-scale baselines, but their gains were slightly smaller.

The full multiscale configuration, which combines $3\times 3$, $5\times 5$, and $7\times 7$ kernels in parallel, achieved the best overall performance on all evaluation metrics. Specifically, it reached an AUC of 0.7977 and an AUPRC of 0.4111, which are higher than those of the best dual-scale setting by 0.0075 and 0.0062, respectively. In addition, MAP@100 and MAP@200 increased to 0.9797 and 0.9394, further demonstrating the advantage of aggregating fine-grained, intermediate, and broader spatiotemporal patterns simultaneously. These results suggest that the three kernel branches are complementary rather than redundant, and that the adopted multiscale design provides a more complete representation of complex electricity consumption behavior.

5. Conclusions

This paper presented BO-WDMS-BiLSTM for electricity theft detection, with the goal of improving not only classification quality but also the practical ranking of customers for field inspection. The model was designed to combine two complementary sources of evidence in a single decision process: stable customer/billing indicators and multi-week electricity consumption behavior. This design reflects a core challenge in real deployment settings, where suspicious patterns can be subtle and normal consumption can vary for many legitimate reasons.

The proposed framework integrates a dual-branch structure, multi-scale convolutional feature extraction, bidirectional temporal modeling, and Bayesian hyperparameter optimization. In the wide branch, compact customer-related indicators provide stable signals that help when load patterns alone are ambiguous. In the deep branch, multi-scale convolution and BiLSTM work together to capture both short-term irregularities and longer temporal changes, while the residual-style fusion head helps preserve information from both branches during training. This combination is intended to improve robustness and reduce the risk of losing useful cues when one feature source is weaker than the other for a given customer.

Experiments on the SGCC public dataset (42,372 customers over 1035 days, with a strongly imbalanced theft ratio) show that the proposed model consistently outperforms representative classical and deep learning baselines. BO-WDMS-BiLSTM achieved the best reported results in the paper across AUC, AUPRC, MAP@100, and MAP@200, reaching AUC = 0.7977, AUPRC = 0.4111, MAP@100 = 0.9797, and MAP@200 = 0.9394. Compared with the strongest non-proposed baseline (Transformer), it improved AUC from 0.7897 to 0.7977, AUPRC from 0.3919 to 0.4111, MAP@100 from 0.9320 to 0.9797, and MAP@200 from 0.9204 to 0.9394. These gains are especially meaningful because they place more true theft cases near the top of the inspection list, which directly supports budget-limited field operations.

The ablation study further supports the design choices. The full model produced the best overall performance, and removing the deep branch caused the largest drop, indicating that structured consumption dynamics provide the strongest discriminative signal. At the same time, removing the wide branch also reduced performance, confirming that customer-level indicators add useful complementary information. Replacing the multi-scale convolution, BiLSTM, or residual fusion head each led to smaller but consistent declines, while disabling Bayesian optimization produced a slight but repeatable reduction. Together, these results suggest that the model’s advantage does not come from a single component alone, but from the interaction of complementary representations, temporal context, and stable fusion.

Overall, the study shows that a hybrid strategy—combining stable customer descriptors with multi-scale, context-aware load modeling—can improve theft screening in a way that is more aligned with real utility workflows. In particular, the stronger top-ranked retrieval performance suggests practical value for inspection prioritization, where the main objective is not simply to classify all users, but to identify the most suspicious cases early and reduce unnecessary site visits.