Adaptive Sensitivity-Aware Differential Privacy Accounting for Federated Smart-Meter Theft Detection

Abstract

Smart-meter theft detection requires learning from fine-grained electricity consumption data, whose centralized processing poses significant privacy risks. Federated learning (FL) mitigates these risks by decentralizing training, but providing rigorous user-level differential privacy (DP) under non-IID data and heterogeneous client behavior remains challenging. Existing DP-FL approaches rely on fixed global clipping bounds for client updates, which substantially overestimate sensitivity when privacy loss is composed using Rényi Differential Privacy (RDP), zero-Concentrated DP (zCDP), or Moments Accountant (MA) frameworks, leading to excessive noise and degraded utility. This work proposes an adaptive clipping-based RDP accountant that incorporates empirical, round-wise update magnitudes into privacy accounting by rescaling each round’s RDP contribution according to the observed clipping ratio. The method is optimizer-agnostic and is evaluated with FedAvg, FedProx, and SCAFFOLD on the SGCC smart-meter theft dataset under IID and Dirichlet non-IID partitions. Experimental results show consistently tighter privacy bounds and improved model utility compared to classical DP accountants, demonstrating the effectiveness of sensitivity-aware privacy accounting for practical differentially private FL.

1. Introduction

Electricity theft exerts a substantial impact on the power grid economy [1], resulting in an estimated global economic loss of $\$25$ billion annually [2]. For instance, in Fujian Province, China, annual losses due to electricity theft amount to $\$15$ million [3]. In addition to economic consequences, electricity theft significantly undermines the stability of the power system, causing power surges, excessive system loads, and hidden threats to public safety [4,5]. In response, electricity theft detection (ETD) methods have been developed. Traditional ETD relies on manual on-site inspections, which are both costly and time-consuming [6]. The growth of the Internet of Things (IoT) has enabled the use of sensors for smart meters that require edge computing, speeding up the adoption of smart grids (SGs) [7]. Smart meters can track electricity usage in real time [8] and analyze this data to offer new approaches to detecting electricity theft. The successful application of artificial intelligence, such as deep learning methods in the literature [9,10], has sparked research interest in ETD to detect power theft in users. However, these methods typically rely on centralizing customer data, which is increasingly infeasible due to regulatory, ethical, and privacy concerns. The implementation of statutory frameworks, exemplified by the 2018 General Data Protection Regulations (GDPR) in Europe [11], has underlined the importance of security and privacy issues. Over the past two decades, electricity theft detection has progressively evolved from rule-based and statistical techniques to data-driven machine learning and deep learning approaches, and more recently to privacy-preserving Federated Learning (FL) frameworks that address data decentralization, user privacy, and non-IID data heterogeneity.

Due to increasing concerns regarding data security and privacy in SGs, FL has emerged as a promising training framework [12]. FL facilitates collaborative model training in SGs while maintaining a balance among privacy, efficiency, and accuracy by preventing the exchange of private data from IoT devices [13]. Recent studies have applied FL to electricity theft detection [14,15,16], demonstrating its ability to utilize distributed smart-meter data while reducing the risk of direct privacy leakage. Nevertheless, gradients and local updates exchanged during FL rounds can still reveal sensitive information through membership inference, reconstruction, and property inference attacks [17,18,19]. To mitigate these risks, existing FL-based energy theft detection frameworks often add Gaussian noise to gradients to approximate differential privacy (DP). Nevertheless, this basic DP noise injection does not provide rigorous or composable privacy guarantees, fails to track cumulative privacy loss across rounds, and does not incorporate privacy amplification effects, limitations increasingly unacceptable for safety-critical energy systems. Moreover, despite recent advances in FL for smart-grid applications, ensuring strong privacy guarantees while maintaining model utility under realistic non-IID data distributions remains a significant challenge. Existing approaches either rely on fixed sensitivity assumptions, leading to loose privacy bounds, or introduce excessive noise that degrades detection performance. Therefore, the central problem addressed in this work is how to design a privacy-aware FL framework that achieves a tight privacy–utility trade-off while remaining robust to heterogeneous client data and practical deployment constraints in smart-meter environments.

Modern DP research emphasizes the need for formal privacy accounting, particularly in iterative learning settings. Techniques such as Rényi Differential Privacy (RDP) [20], zero-Concentrated Differential Privacy (zCDP) [21], and the Moments Accountant (MA) [22] offer mathematically sound tools for quantifying privacy loss over repeated stochastic gradient steps. These methods enable tight $(ϵ,\delta )$ privacy bounds and naturally incorporate privacy amplification by subsampling [23], leading to significantly improved privacy-utility trade-offs compared to naive Gaussian DP. Despite their wide adoption in industry-grade DP systems (e.g., Google and Apple), these advanced techniques remain underexplored in FL-based smart-grid analytics. Moreover, to enhance the utility performance while using the DP in FL, researchers use complex DL models such as Convolutional Transformer Neural Network (CTNN), Temporal Convolutional Network (TCN) [24], deep CNN [25], and CNN–LSTM, which are computationally expensive and have large parameter counts, making them unsuitable for resource-constrained devices in FL scenarios. However, the premise that these models are used to enhance utility performance while using DP in FL is a valid research area; the challenge is to use lightweight models for resource-constrained devices while maintaining utility trade-offs. Furthermore, in a real scenario, the energy data in each participating device in the FL scenario can be unequal. The consumption of electricity varies according to the consumption of the different households. In FL, the use of a heterogeneous dataset and client participation are major challenges, which have not been addressed in the smart-meter theft detection applications so far.

Based on the above-mentioned motivation, this work analyzes a privacy-preserving smart-meter theft detection FL framework, which uses a lightweight MLP model for local training and analyzes the performance of advanced DP methods using both IID and non-IID datasets with full and partial client participation. Also, as an averaging algorithm, the FedAvg, FedProx and SCAFFOLD are considered to analyze the effect of the averaging algorithm with privacy-preserving mechanisms. Differential privacy in FL typically requires adding Gaussian noise proportional to the global clipping bound $C_0$. Conventional RDP accountants assume a fixed global sensitivity across all training rounds, $\Delta \le C_0$. However, this assumption is almost always overly conservative in practice. Several key observations motivate a more adaptive treatment of sensitivity. Gradient magnitudes evolve dynamically due to optimization dynamics, heterogeneity, and non-IID data distributions. Fixed clipping bounds are typically chosen as broad upper limits to avoid excessive clipping, but real client updates rarely reach this maximum. Early-round gradients tend to be larger, while later rounds produce significantly smaller updates. Static RDP assumes every update has the maximum possible norm. As a result, it injects noise as if all updates reach $C_0$, which leads to (i) overestimation of per-round privacy cost, (ii) unnecessarily large noise multipliers $\sigma$ to meet a target privacy budget $\epsilon$, (iii) severe utility degradation, and (iv) poor privacy–utility trade-offs. FL, especially in heterogeneous and non-IID settings, naturally exhibits large variation in update magnitudes. A fixed-sensitivity accountant fails to exploit this structure, motivating the need for a more adaptive privacy analysis. Traditional RDP, MA, and zCDP approaches rely on strong assumptions, such as fixed clipping norms, fixed global sensitivity, and uniform gradient magnitude distributions. In contrast, real-world federated systems exhibit heterogeneous client behaviours, non-IID training distributions, non-stationary gradient norms, and dynamic convergence effects. These discrepancies cause large privacy overestimation in static accountants. Hence, a novel Adaptive Clipped-Based RDP Accountant is introduced that incorporates the round-wise empirical clipping norms $C_t$ into the privacy analysis. This yields significantly tighter privacy bounds compared to fixed-sensitivity RDP, allowing lower $\sigma$ for the same $ϵ$ and substantially improving the privacy–utility trade-off in FL. To verify the performance of the proposed adaptive clipped-based RDP accountant, the proposed method is compared with various state-of-the-art (SOTA) methods.

This work makes the following key contributions:

• An end-to-end FL pipeline is designed and implemented using a lightweight MLP-based local model. Its performance is evaluated under realistic IID and non-IID data distributions, as well as full and partial client participation settings. In addition, three widely used federated optimization algorithms-FedAvg, FedProx, and SCAFFOLD-are integrated and compared to analyze their behavior under differential privacy constraints, client heterogeneity, and varying data distributions.
• Several DP accounting frameworks are benchmarked, including classical DP, RDP, zCDP, and the MA. Their limitations are highlighted when applied to gradient-based FL with dynamic client updates.
• Traditional privacy accountants assume a fixed global clipping bound $C_0$, which leads to an overestimation of sensitivity and consequently requires larger noise multipliers. This results in degraded model accuracy and suboptimal privacy–utility trade-offs, particularly under non-IID and heterogeneous client settings. To address this limitation, a novel privacy accountant is proposed that incorporates round-wise empirical clipping norms $C_t$ into the RDP formulation, yielding tighter privacy bounds. This approach enables (i) lower noise multipliers $\sigma$ for a given target privacy budget $\epsilon$, (ii) improved model utility without modifying the underlying FL algorithm, and (iii) better alignment between theoretical sensitivity and actual client update magnitudes.
• To validate the robustness of the proposed accountant, experiments are conducted using different FL averaging schemes under both IID and non-IID data distributions. In addition, a three-stage hyperparameter optimization (HPO) strategy is employed to fine-tune model parameters. The results demonstrate that incorporating empirical clipping into privacy accounting significantly improves detection accuracy while maintaining rigorous differential privacy guarantees.

Organization of the Paper

Section 2 reviews the literature on FL in SGs, ETD, DP mechanisms, privacy accountants, and hyperparameter optimization. Section 3 presents the proposed methodology. Section 4 describes the datasets, experimental setup, model architectures, DP mechanisms, and evaluation strategy. Section 5 depicts all the experimental results in different scenarios in details. Finally, Section 6 concludes the paper and outlines future research directions.

2. Related Work

This section reviews the existing literature on FL in SGs, EDT, and DP; accountants; and HPO in FL. Our work is also compared to related studies, highlighting what makes our contribution new.

2.1. Federated Learning Algorithms

FL was popularized by McMahan et al. through the Federated Averaging (FedAvg) algorithm [12], which aggregates locally trained model updates to form a global model without centralizing raw data. Subsequent work introduced methods to improve stability and convergence under heterogeneous and non-IID client data. FedProx [26] adds a proximal term to control client drift, while SCAFFOLD [27] uses control variates to correct the variance of the update caused by client heterogeneity. Other variants, such as FedNova [28], FedDyn [29], and Mime [30], aim to address optimization bias, partial participation, and local adaptivity, but FedAvg, FedProx, and SCAFFOLD remain the most commonly deployed methods in cross-device FL. Our work integrates all three algorithms within a unified, privacy-aware HPO framework.

2.2. Federated Learning in Smart Grids

Collecting all data into a central node for processing is necessary for centralized model training, as discussed in the preceding section. However, risk samples found in system data are often extremely sensitive, and individual system operators typically have a small number of risk samples that represent the specific data features of their systems. Data owners are often hesitant to share their data due to concerns about privacy and security.

FL is an emerging distributed machine learning technique that has demonstrated effectiveness in the field of SGs. For instance, Wang et al. [31] proposed a distributed FL-based feature recognition method for electricity consumers that safeguards each power retailer’s privacy by preventing the disclosure of original smart-meter data. Additionally, Li et al. [32] developed a Transformer-based false data injection attack (FDIA) detection model to identify covert FDIA in SG and combined the Paillier cryptosystem with FL to establish the SecFed scheme, addressing privacy concerns inherent in centralized detection approaches. Badr et al. [33] introduced a secure data aggregation mechanism designed to protect customer privacy during FL model training by preventing model inversion and membership inference attacks. Other works have explored lightweight FL architectures for anomaly detection. Jithish et al. [34] evaluated different ML models under FL using Raspberry Pi testbeds, demonstrating feasibility in constrained environments but without incorporating differential privacy. Gupta et al. [35] proposed FedGrid for forecasting tasks using FL but did not address theft detection or formal privacy mechanisms. These frameworks demonstrate the promise of FL but lack the rigorous privacy guarantees required for operational smart-grid deployments.

2.3. Federated Learning for Energy Theft Detection

Several FL-based frameworks have been proposed for energy theft detection. Wen et al. [24] introduced FedDetect, a privacy-preserving FL system that combines local differential privacy, homomorphic encryption, and a TCN. Although the approach offers strong security, it incurs significant computational overhead and relies on a heavy temporal model unsuitable for resource-constrained smart meters. Nadeem and Jaber [25] proposed FL-CNN, which employs a cost-sensitive loss function, SMOTE-based class balancing, and a convolutional network. However, their method lacks formal differential privacy guarantees and assumes IID data distributions, limiting deployment realism. HeteroFL [36] incorporates homomorphic encryption and prototype-based imbalance handling but suffers from high latency and requires trusted authorities, making it impractical for large-scale smart-meter networks.

Our preliminary conference version presented in [37] proposed a lightweight MLP architecture with optional Gaussian noise added to local updates to simulate basic differential privacy. However, the approach did not provide formal $(\epsilon ,\delta )$-DP guarantees, relied on a naïve noise mechanism, and lacked a privacy accountant to track cumulative privacy leakage across multiple FL rounds. This limitation motivates the need for a more rigorous privacy framework.

2.4. Differential Privacy in Federated Learning

DP, introduced by [38], has become a standard tool for protecting user-level information in decentralized systems. In FL, DP can be applied either centrally or locally. Central DP methods add noise to the aggregated updates on the server, often combined with secure aggregation to prevent the exposure of individual client updates [39]. Local DP approaches [40,41] apply noise at the client before transmission, which provides stronger privacy guarantees but typically reduces utility. The Gaussian mechanism [38] is the dominant approach in FL due to its compatibility with gradient-based optimization and tractable composition properties. Recent work explores privacy-enhancing signal processing techniques [42], adaptive noise injection [43], adaptive clipping [44] and group-wise clipping [45]. Our work builds on these ideas but focuses specifically on improving privacy accounting rather than modifying the mechanisms themselves. DP has been widely studied as a means to protect sensitive information in distributed learning settings. Classical DP mechanisms, such as the Gaussian mechanism, provide privacy guarantees but suffer from poor composition properties under iterative training, making them unsuitable for long-running FL systems with many communication rounds. Mcmahan et al. [12] introduced DP-SGD with gradient clipping and Gaussian noise, but without accounting for the privacy budget, which degrades rapidly under multiple iterations.

2.5. Privacy Accounting: From RDP to Moments Accountant

Accurately tracking cumulative privacy loss under composition is a critical challenge in DP. The MA [22] provides a tight analysis for DP-SGD by bounding the log-moment-generating functions of the privacy loss random variable. RDP [20] generalizes this concept using Rényi divergence and supports efficient composition across multiple orders $\alpha$, making it the current standard for privacy accounting in deep learning (e.g., TensorFlow Privacy). The zCDP framework [21] offers similar advantages with a simpler analytical form. However, all these methods assume a fixed sensitivity bound per round. In practice, fixed clipping is highly conservative, especially in FL, where update norms vary significantly across clients and rounds. Recent works [46,47] highlight the need to align privacy accounting more closely with empirical behaviours. These tools have been applied in general FL research, but have not been adopted in smart-grid applications, where stringent privacy regulations and long-term consumption monitoring demand rigorous guarantees. To the best of our knowledge, no existing accountant explicitly incorporates the actual clipping norms observed during training. Our proposed adaptive clipped-based RDP accountant fills this gap by scaling per-round RDP contributions using the empirical sensitivity ratio, leading to substantially tighter privacy guarantees.

2.6. Gradient Clipping and Sensitivity Control

Gradient clipping is essential for bounding sensitivity in DP-SGD [22] and federated optimization. Existing works typically employ a fixed clipping norm [12,48], which simplifies analysis but is known to distort updates and degrade utility, especially with heterogeneous data. Adaptive clipping approaches have been studied in the centralized DP literature (e.g., AdaCliP [44], adaptive per-layer clipping [49]), but few works integrate clipping adaptation directly into privacy accounting in FL. Recent methods such as DP-FedAvgM [50] and federated per-layer clipping [47,51] adapt clipping locally but do not incorporate the empirical clipping schedule into privacy analysis. This work addresses this gap by introducing a clipping-aware RDP accountant.

2.7. Hyperparameter Optimization in Federated Learning

Hyperparameter optimization (HPO) for FL has been explored in several contexts, including communication optimization [52], fairness [53], and on-device tuning for edge devices [54]. However, HPO under differential privacy constraints remains understudied due to the high computational and privacy costs of multi-run experimentation. Early attempts such as DP-ZeroCostHPO [55] focus on centralized training. In the federated setting, recent work has proposed multi-fidelity HPO [56], consensus-driven HPO [57], and reinforcement learning for FL configuration [55]. Our work differs by introducing a three-stage HPO pipeline, combining random search, Bayesian refinement (Optuna), and final multi-seed evaluation, designed specifically to optimize privacy-utility-communication trade-offs under different DP mechanisms.

Table 1. Comprehensive comparison of the proposed method with existing approaches in FL and smart-grid electricity theft detection.

Method	Adaptation Strategy	Privacy Accounting	Non-IID Handling	FL Compatible	Comp. Cost	Comm. Cost	Privacy Tightness
Traditional ML (2000s)	None	None	✗	✗	Low	Low	✗
Deep Learning (Centralized)	Static Training	None	✗	✗	High	High	✗
DP-SGD [22]	Fixed Clipping	Moments Accountant	Limited	✔	High	High	Medium
RDP-based FL [20]	Fixed Sensitivity	RDP	Limited	✔	Medium	Medium	Medium
zCDP-based FL [21]	Fixed Sensitivity	zCDP	Limited	✔	Medium	Medium	Medium
Adaptive Clipping (AdaCliP [44])	Adaptive Clipping	None/Partial	Limited	Partial	Medium	Medium	Low
Pruning-based FL	Model Pruning	None/Limited	Limited	✔	Medium	Low	Low
FedDetect [24]	TCN-based Model	None (LDP + HE)	Limited	✔	High	High	Medium
FL-CNN [25]	CNN + SMOTE	None	✗	✔	High	High	✗
HeteroFL [36]	Model Heterogeneity	None (HE-based)	Partial	✔	High	High	Medium
FedGrid [35]	Forecast-based FL	None	Limited	✔	Medium	Medium	✗
Proposed Method	Adaptive Clipping (Dynamic)	Clipping-aware RDP	✔	✔	Low	Low	High

highlights that existing smart-grid FL approaches often incur high communication overhead due to large model sizes or cryptographic mechanisms such as homomorphic encryption. In contrast, the proposed method employs a lightweight MLP architecture and avoids expensive encryption schemes, resulting in significantly reduced communication cost while maintaining strong privacy guarantees. To the best of our knowledge, no existing energy theft detection framework integrates formal DP mechanisms such as RDP or zCDP, nor employs an MA to quantify cumulative privacy loss. Existing works either rely on computational privacy via cryptography, which is costly for edge devices, or use informal Gaussian noise injection without theoretical guarantees. Moreover, none of the current smart-grid FL approaches provide a detailed privacy-utility-communication trade-off analysis, which is essential for real-world deployment, given the resource constraints of smart meters. This work addresses these gaps by introducing a fully formalized DP framework for federated electricity theft detection, combining RDP, zCDP, MA, privacy amplification, and adaptive noise scheduling. This represents a substantial advancement over prior work, including our own conference version, and establishes the first mathematically grounded DP-FL system specifically designed for smart-meter infrastructures. In summary, prior work provides strong foundations in federated optimization, gradient clipping, and privacy accounting, but existing DP accountants fail to incorporate empirical clipping behavior. Our adaptive clipped-based RDP accountant addresses this limitation and is, to our knowledge, the first method to link empirical sensitivity patterns in federated training with RDP privacy composition. Combined with our unified HPO and evaluation framework, it provides a practical and robust foundation for building privacy-preserving FL systems.

3. Methodology

This section describes the complete privacy-aware smart-meter theft detection FL pipeline developed for evaluating privacy–utility–communication trade-offs under multiple federated optimization algorithms and multiple DP accountants. The methodology consists of five core components: (i) data preprocessing, (ii) client data partitioning (IID or non-IID), (iii) local training under different FL optimization methods, (iv) DP-aware server aggregation using Gaussian noise and four privacy accountants, and (v) the DP-aware Focal Loss, the federated optimization with adaptive clipping, and the clipping-schedule-aware Rényi DP accountant. Figure 1 illustrates the overall pipeline of the proposed privacy-aware FL framework for smart-meter theft detection. The process begins with raw smart-meter data, followed by a structured data preprocessing stage that includes numeric feature selection, missing value imputation, standardization, and label encoding. The processed dataset is then partitioned across clients under both IID and non-IID settings to simulate realistic data heterogeneity. Each client performs local model training using a lightweight MLP combined with the proposed DP-aware Focal Loss. The locally computed updates are then subjected to adaptive clipping and sensitivity estimation to capture round-wise empirical norms. These updates are further processed using differential privacy mechanisms under both central and local settings, supported by multiple privacy accountants, including RDP, zCDP, and the MA. The differentially private updates are aggregated at the federated server to produce a global model, which is iteratively broadcast back to clients for subsequent rounds. This end-to-end workflow enables a systematic evaluation of privacy, utility, and communication trade-offs in federated smart-grid environments.

3.1. Problem Setup

Let $\mathcal{D}={\left\{(x_i,y_i)\right\}}_{i=1}^N$ denote the global dataset, where $x_i\in {\mathbb{R}}^d$ is a d-dimensional feature vector and $y_i\in \{0,1,\dots ,C-1\}$ is a multiclass label. A cross-device FL setting with K clients/devices is considered. The dataset is partitioned into disjoint client-local subsets

$$\begin{array}{c}\hfill {\mathcal{D}}_k={\left\{(x_i,y_i)\right\}}_{i\in {\mathcal{I}}_k},\\ \hfill \bigcup _{k=1}^K{\mathcal{I}}_k=\{1,\dots ,N\},{\mathcal{I}}_k\cap {\mathcal{I}}_{\ell }=\varnothing \mathrm{for}k\ne \ell .\end{array}$$

(1)

During each communication round $t=0,1,\dots ,T-1$, a subset $S_t\subset \{1,\dots ,K\}$ of clients participates with sampling rate $q=|S_t|/K$. The server maintains a global model ${\mathit{\theta }}_t$ (shared parameters). Each selected client $k\in S_t$ receives ${\mathit{\theta }}_t$, performs local training on ${\mathcal{D}}_k$, and returns an update ${\Delta }_{t,k}$. FL enables collaborative model training without centralizing user data. However, the model updates exchanged between clients and the server may still reveal sensitive information about individual users. To mitigate such leakage, our framework introduces a novel adaptive clipped-based RDP accountant and explores various DP mechanisms through two distinct mechanisms: Central Differential Privacy (CDP) and Local Differential Privacy (LDP). Each protects client data under an adversarial model and provides formal guarantees against membership and attribute randomized attacks. It is pertinent to mention that the proposed adaptive clipped-based RDP accountant is intentionally designed for the central DP setting, where the server can exploit round-wise empirical sensitivity to achieve tighter privacy bounds. These assumptions fundamentally do not hold under local DP, where updates must be privatized independently and sensitivity must be fixed a priori. As a result, applying adaptive clipped-based RDP to LDP is both theoretically incompatible and practically ineffective, offering no privacy-tightness benefits while significantly degrading utility. DP provides a formal guarantee that the inclusion or exclusion of a single user’s data does not significantly affect the output of a computation. In particular, $(\epsilon ,\delta )$-differential privacy characterizes the strength of this guarantee, where $\epsilon$ denotes the privacy budget controlling the level of indistinguishability between neighboring datasets and $\delta$ represents a small probability of failure of the privacy guarantee. Smaller values of $\epsilon$ and $\delta$ correspond to stronger privacy guarantees. A randomized mechanism $\mathcal{M}$ satisfies $(\epsilon ,\delta )$-DP if, for all neighbouring datasets D and $D^{\prime }$ differing in one user’s data, and for all measurable subsets $\mathcal{S}$ of outputs,

$$Pr[\mathcal{M}\left(D\right)\in \mathcal{S}]\le e^{\epsilon }Pr[\mathcal{M}\left(D^{\prime }\right)\in \mathcal{S}]+\delta .$$

(2)

In gradient-based learning, privacy is ensured by bounding the ${\ell }_2$-sensitivity of updates and adding calibrated Gaussian noise. Let $\Delta \le C$ be the clipping threshold; then, the Gaussian mechanism

$$\mathcal{M}\left(x\right)=f\left(x\right)+\mathcal{N}(0,{\sigma }^2{C}^{2}I)$$

(3)

is $(\epsilon ,\delta )$-DP for appropriately chosen $\sigma$. Here, I is the identity matrix to ensure that the Gaussian noise is isotropic (same variance in all dimensions) and independent across coordinates.

Our goal is to learn a classifier $f_{\mathit{\theta }}:{\mathbb{R}}^d\to \{0,\dots ,C-1\}$ that achieves high predictive performance under an $(\epsilon ,\delta )$-DP constraint and realistic communication budgets.

3.2. Central Differential Privacy for Federated Aggregation

In the Central DP (CDP) setting, each client transmits its clipped model update to a trusted server, which injects Gaussian noise after aggregation. Let ${\Delta }_{t,k}$ denote the raw update from client k in round t. The server performs

$$\begin{array}{cc}\hfill {\widehat{\Delta }}_{t,k}& ={\Delta }_{t,k}·min\left(1,{\displaystyle \frac{C_t}{\parallel {\Delta }_{t,k}{\parallel }_2}}\right),\hfill \end{array}$$

(4)

$$\begin{array}{cc}\hfill {\Delta }_t& =\sum _{k\in S_t}{w}_k{\widehat{\Delta }}_{t,k},\hfill \end{array}$$

(5)

$$\begin{array}{cc}\hfill {\tilde{\Delta }}_t& ={\Delta }_t+\mathcal{N}\left(0,{\sigma }^2{C}_0^{2}I\right),\hfill \end{array}$$

(6)

where $C_t$ is the empirical clipping bound at round t, $C_0$ is the global sensitivity bound assumed by the accountant, $\sigma$ is the noise multiplier, $S_t$ denotes the set of selected clients, and $w_k$ are dataset-size weights. CDP assumes a trusted aggregator that can safely perform noise addition. Its main advantages include higher utility because noise is added after averaging, reduced variance, stronger privacy–utility trade-off because sensitivity scales inversely with the number of participating clients and compatibility with secure aggregation because, even if the server is honest-but-curious, secure aggregation ensures that the server sees only the noisy aggregated sum, not individual contributions.

3.3. Local Differential Privacy for Client-Side Protection

In the Local DP (LDP) setting, each client adds noise before transmitting its update to the server. The mechanism for client k in round t is

$$\begin{array}{cc}\hfill {\widehat{\Delta }}_{t,k}& ={\Delta }_{t,k}·min\left(1,{\displaystyle \frac{C}{\parallel {\Delta }_{t,k}{\parallel }_2}}\right),\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill {\tilde{\Delta }}_{t,k}& ={\widehat{\Delta }}_{t,k}+\mathcal{N}(0,{\sigma }^2{C}^{2}I),\hfill \end{array}$$

(8)

and the server aggregates noisy updates:

$${\Delta }_t=\sum _{k\in S_t}{w}_k{\tilde{\Delta }}_{t,k}.$$

(9)

LDP provides a stronger adversarial model in which clients do not trust the server; each client obtains its own $(\epsilon ,\delta )$ guarantee, and no secure aggregation is needed because noise is added locally. However, LDP introduces substantially more noise than CDP because the averaging step no longer attenuates it. Consequently, LDP typically yields lower accuracy and requires careful hyperparameter tuning to remain viable.

3.4. Data Preprocessing

Given a raw tabular SGCC dataset, the following preprocessing steps are applied. (1) Numeric feature selection: Only numeric columns are retained, and non-numeric features are discarded. Let $X\in {\mathbb{R}}^{N\times d}$ denote the resulting feature matrix. (2) Missing value imputation: For each feature dimension $j\in \{1,\dots ,d\}$, the column mean is computed as

$${\mu }_j={\displaystyle \frac{1}{\left|\right\{i:x_{ij}\mathrm{observed}\left\}\right|}}\sum _{i:x_{ij}\mathrm{observed}}{x}_{ij},$$

(10)

and missing entries are replaced as $x_{ij}$ with ${\mu }_j$. (3) Standardization: Each feature dimension is normalized to have zero mean and unit variance:

$${\tilde{x}}_{ij}={\displaystyle \frac{x_{ij}-{\mu }_j}{{\sigma }_j+{10}^{-8}}},{\sigma }_j^2={\displaystyle \frac{1}{N}}\sum _{i=1}^N{(x_{ij}-{\mu }_j)}^2.$$

(11)

where a small constant ${10}^{-8}$ is added to the denominator for numerical stability to prevent division by zero when the variance ${\sigma }_j^2$ is very small. The resulting standardized data are denoted $\tilde{X}$. (4) Label encoding: Categorical labels are factorized into integer indices $y_i\in \{0,\dots ,C-1\}$. The standardized training portion is then partitioned across K clients in both an IID and non-IID fashion. In the IID partitioning, samples are randomly and uniformly assigned to clients, ensuring that empirical label distributions match the global distribution. This setting serves as an upper bound on performance. For more realistic heterogeneity, a Dirichlet distribution with concentration parameter $\alpha =0.5$ is used. The Dirichlet distribution is a multivariate probability distribution commonly used to model proportions across multiple categories. In this context, it generates client-specific class proportions, where the concentration parameter $\alpha$ controls the degree of heterogeneity. Smaller values of $\alpha$ lead to more skewed (non-IID) distributions, while larger values approach uniform (IID-like) splits. For each class k, client proportions are generated using $(p_{1k},\dots ,p_{Mk})\sim \mathrm{Dirichlet}(\alpha ,\dots ,\alpha )$, and client-specific subsets are sampled accordingly. Lower $\alpha$ increases non-IID skew. This mechanism is standard in the FL literature and produces controlled heterogeneity while preserving class presence across clients.

3.5. Client-Side Architectures

Each client trains a neural network model $f_{\mathit{\theta }}$ belonging to one of several architectures. All architectures take as input a d-dimensional feature vector $x\in {\mathbb{R}}^d$ and produce class logits $\mathit{z}\in {\mathbb{R}}^C$.

Multilayer Perceptron (MLP)

The MLP architecture is a fully connected feedforward network with two hidden layers and dropout:

$$\begin{array}{cc}\hfill {\mathit{h}}_1& =\varphi \left({\mathit{W}}_{1}x+{\mathit{b}}_1\right),\hfill \end{array}$$

(12)

$$\begin{array}{cc}\hfill {\mathit{h}}_2& =\varphi \left({\mathit{W}}_2{\mathit{h}}_1+{\mathit{b}}_2\right),\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill \mathit{z}& ={\mathit{W}}_3{\mathit{h}}_2+{\mathit{b}}_3,\hfill \end{array}$$

(14)

where $\varphi (·)$ denotes the ReLU activation function, and dropout is applied after each hidden layer during training. In our implementation, the layer sizes are

$${\mathit{W}}_1\in {\mathbb{R}}^{256\times d},{\mathit{W}}_2\in {\mathbb{R}}^{128\times 256},{\mathit{W}}_3\in {\mathbb{R}}^{C\times 128}.$$

(15)

The predicted class is $\widehat{y}=arg{max}_c{z}_c$. The FL framework employed in this study uses a lightweight MLP as the base prediction model. Given a feature vector $x\in {\mathbb{R}}^d$ derived from smart-meter consumption profiles, this architecture uses low memory and computational overhead.

Smart-meter datasets (such as SGCC) comprise tabular features that capture temporal energy consumption, derived statistical aggregates, or engineered anomaly indicators. Such data are well-suited for MLP-based models, which perform efficiently on structured, fixed-dimensional feature vectors without the need for complex convolutional or recurrent operations. However, to demonstrate the performance, different complex models are used to compare with the SOTA models.

Modern smart meters and household energy gateways operate under stringent hardware limitations, low-frequency embedded processors (e.g., ARM Cortex-M series), restricted RAM (often 128–512 kB), minimal onboard storage, and a limited battery or power budget for communication cycles. Heavyweight neural architectures such as CNNs, LSTMs, or Transformers exceed the memory, compute, and energy budgets typical of field-deployed meters or edge gateways. The use of an MLP directly addresses these constraints: (i) Computational Efficiency—The MLP’s feed-forward operations involve only matrix multiplications, which can be executed efficiently using low-power microcontrollers. The complexity per inference is $\mathcal{O}(d·h+h^2+h·c)$, where d is the input dimension, h is hidden-layer width, and c is the number of classes. This makes real-time consumption analysis feasible at the meter. (ii) Memory Footprint—The total parameter count remains below a few hundred thousand weights, allowing on-device model storage in flash memory, minimal RAM usage during inference, and compatibility with low-cost smart-meter chipsets. This low footprint is especially important in federated learning, where models must be repeatedly transmitted over constrained communication channels. (iii) Energy-Constrained Training and Communication—Smart meters often operate under strict communication budgets (e.g., narrowband PLC or LoRaWAN). Smaller models yield reduced uplink/downlink bandwidth consumption during FL rounds, shorter computation times per training epoch, and extended device lifetime under battery-assisted deployments. Energy theft detection must operate continuously; thus, the communication savings directly translate to superior system longevity. (iv) Robustness to Non-IID Distributions—In non-IID environments (e.g., consumption patterns vary across households), larger models may require more data diversity to avoid overfitting. An MLP with controlled capacity generalizes better with small heterogeneous client datasets, converges more reliably under FedAvg, FedProx, and SCAFFOLD, and reduces variance in gradient updates under DP noise. (v) Compatibility with Differential Privacy Noise—More expressive models amplify DP noise, degrading utility. A lightweight MLP reduces sensitivity to noise perturbations, particularly Gaussian noise added during DP aggregation, and clipping operations applied to client updates. This makes MLP-based theft detection more robust under RDP/zCDP/MA privacy constraints.

3.6. Federated Optimization Algorithms

Let M be the number of clients, ${\mathcal{S}}_t$ be the selected clients in round t, and $n_i$ be the local sample count of client i.

FedAvg performs local empirical risk minimization (ERM) on each client followed by a weighted average of model parameters. ${\theta }^{(t+1)}={\sum }_{i\in {\mathcal{S}}_t}{\displaystyle \frac{n_i}{{\sum }_{j\in {\mathcal{S}}_t}{n}_j}}{\theta }_i^{(t+1)}$, shown in Algorithm 1. FedAvg performs local stochastic gradient descent (SGD) on each client and aggregates the updated models using a weighted average based on local dataset sizes. This approach is communication-efficient but can suffer from client drift under non-IID data, as local updates may diverge significantly from the global objective. FedAvg is selected as the canonical FL baseline due to its efficiency, simplicity, and real-world adoption.

FedProx, shown in Algorithm 2, addresses data heterogeneity by penalizing local model drift using ${\ell }_{\mathrm{prox}}({\theta }_i;x,y)=\ell ({\theta }_i;x,y)+{\displaystyle \frac{\mu }{2}}{\parallel {\theta }_i-\theta \parallel }^2$, where $\theta$ is the global model at round start and $\mu$ controls regularization strength. This modification stabilizes training when class imbalance or non-IID sampling is severe. The proximal term constrains local updates to remain close to the global model, effectively reducing client drift in heterogeneous environments. This makes FedProx more stable than FedAvg when data distributions vary significantly across clients.

Algorithm 1 Local Training for FedAvg

Require: Global model $\theta$, local data ${\mathcal{D}}_i$, learning rate $\eta$, epochs E  1: ${\theta }_i\leftarrow \theta$  2: for $e=1$ to E do  3:     for batch $(x,y)\sim {\mathcal{D}}_i$ do  4:         ${\theta }_i\leftarrow {\theta }_i-\eta {\nabla }_{\theta }\ell ({\theta }_i;x,y)$  5:     end for  6: end for  7: return ${\theta }_i$

Algorithm 2 Local Training for FedProx

Require: Global model $\theta$, proximal weight $\mu$  1: Initialize ${\theta }_i\leftarrow \theta$  2: for each batch $(x,y)$ do  3:     Compute gradient of $\ell ({\theta }_i;x,y)+{\displaystyle \frac{\mu }{2}}{\parallel {\theta }_i-\theta \parallel }^2$  4:     Update ${\theta }_i$  5: end for  6: return ${\theta }_i$

SCAFFOLD, shown in Algorithm 3, uses control variates to correct client drift using $\nabla {\ell }^{\prime }\left({\theta }_i\right)=\nabla \ell \left({\theta }_i\right)-(c_i-c)$, where c is a global control variate and $c_i$ is the local variate of client i. SCAFFOLD introduces control variates to correct the variance introduced by client heterogeneity. Maintaining both global and local control variables, it reduces the discrepancy between local and global gradients, leading to faster and more stable convergence under non-IID settings. This improves convergence under non-IID conditions.

Algorithm 3 Local Training for SCAFFOLD

Require: Global model $\theta$, global variate c, local variate $c_i$  1: ${\theta }_i:=\theta$  2: for each step do  3:     Compute $g=\nabla \ell \left({\theta }_i\right)-(c_i-c)$  4:     ${\theta }_i\leftarrow {\theta }_i-\eta g$  5: end for  6: Update $c_i$  7: return $({\theta }_i,c_i)$

Overall, FedAvg provides a simple and efficient baseline, FedProx improves stability under heterogeneous data through regularization, and SCAFFOLD explicitly corrects client drift using control variates. These complementary properties make them suitable for evaluating the robustness of the proposed privacy-aware framework.

3.7. Differential Privacy Mechanisms in Federated Smart-Meter Theft Detection

Smart-meter consumption data exhibit strong temporal and behavioral patterns that may reveal occupancy routines, appliance usage, socioeconomic status, and other private attributes. Although federated learning prevents raw data from being uploaded, model updates themselves may leak household-specific information. DP is therefore essential for theft detection systems deployed at utility scale. In this work, initially, four privacy mechanisms are evaluated: (i) classical $(\epsilon ,\delta )$-DP, (ii) Rényi differential privacy (RDP), (iii) zero-Concentrated Differential Privacy (zCDP), and (iv) the Moments Accountant (MA). Each mechanism offers different privacy–utility trade-offs and computational characteristics, enabling comprehensive evaluation across regulatory, embedded hardware, and operational environments in modern smart grids.

3.7.1. Classical $(\epsilon ,\delta )$-Differential Privacy

A randomized mechanism $\mathcal{M}$ satisfies $(\epsilon ,\delta )$-DP [58] if, for any two neighboring datasets D and $D^{\prime }$ differing in one household, and for any measurable output set $\mathcal{O}$, $Pr[\mathcal{M}\left(D\right)\in \mathcal{O}]\le e^{\epsilon }Pr[\mathcal{M}\left(D^{\prime }\right)\in \mathcal{O}]+\delta$. Here, $\epsilon$ quantifies privacy leakage and $\delta$ represents failure probability. The Gaussian mechanism are employed, which guarantees $(\epsilon ,\delta )$-DP when noise is added proportionally to the global sensitivity $\Delta$ using $\mathcal{M}\left(x\right)=f\left(x\right)+\mathcal{N}(0,{\sigma }^2{\Delta }^{2}I)$.

Classical DP is legally interpretable and aligns with privacy regulations such as GDPR. It gives clear, worst-case guarantees but suffers from weak composition, meaning that privacy degrades linearly with the number of federated rounds as ${\epsilon }_{\mathrm{total}}\approx T·{\epsilon }_{\mathrm{round}}$, making it restrictive for high-frequency smart-meter updates (e.g., every 15 min). Classical DP is included as a regulatory baseline.

3.7.2. Rényi Differential Privacy (RDP)

Rényi DP [20] generalizes DP using Rényi divergence of order $\alpha >1$. A mechanism $\mathcal{M}$ satisfies $(\alpha ,\epsilon (\alpha \left)\right)$-RDP if $D_{\alpha }(\mathcal{M}\left(D\right)\parallel \mathcal{M}\left(D^{\prime }\right))\le \epsilon \left(\alpha \right)$, where $D_{\alpha }$ is the Rényi divergence. For the Gaussian mechanism with sampling rate q and noise multiplier $\sigma$, the RDP cost is $\epsilon \left(\alpha \right)={\displaystyle \frac{\alpha q^{2}T}{2{\sigma }^2}}$. RDP is converted to classical DP via $\epsilon ={min}_{\alpha >1}\left(\epsilon \left(\alpha \right)+{\displaystyle \frac{log(1/\delta )}{\alpha -1}}\right)$. It produces much tighter privacy bounds for long training horizons, relevant for continuous grid monitoring; enables lower noise than classical DP, preserving subtle consumption anomalies required for theft detection (e.g., load flattening, power siphoning); and is efficient to compute and supported by modern libraries such as Opacus. RDP is therefore well-suited for smart-meter systems with sustained training and high round counts.

3.7.3. Zero-Concentrated Differential Privacy (zCDP)

zCDP [21] is defined via the privacy loss random variable L. A mechanism satisfies $\rho$-zCDP if, for all $\alpha >1$, $D_{\alpha }(\mathcal{M}\left(D\right)\parallel \mathcal{M}\left(D^{\prime }\right))\le \rho \alpha$. For the Gaussian mechanism, the zCDP parameter accumulates additively $\rho ={\displaystyle \frac{q^{2}T}{2{\sigma }^2}}$. Conversion to classical DP follows $\epsilon =\rho +2\sqrt{\rho log(1/\delta )}$. zCDP offers a simple analytic form ideal for embedded smart-meter chips with limited compute resources and produces consistently stable privacy estimates even under heterogeneous client distributions (e.g., Dirichlet $\alpha =0.5$ non-IID splits). zCDP balances interpretability, computational efficiency, and tight composition.

3.7.4. Moments Accountant (MA)

The Moments Accountant [22] tracks the log moments of the privacy loss using ${\alpha }_{\lambda }=log\mathbb{E}\left[e^{\lambda L}\right]$, and yields tight $(\epsilon ,\delta )$ bounds via $\epsilon ={min}_{\lambda }\left({\displaystyle \frac{{\alpha }_{\lambda }-log\delta }{\lambda }}\right)$. MA is designed for repeated Gaussian noise addition and provides the tightest known privacy guarantees for DP-SGD and subsampled mechanisms. This has major implications for smart-grid systems. FL requires many rounds because consumption patterns are temporally correlated. MA prevents privacy budget exhaustion. It allows higher model accuracy for the same privacy level, improving theft detection performance on rare anomalies. This is particularly effective for near real-time detection, where models are updated frequently.

3.8. DP-Aware Focal Loss

Class imbalance (e.g., rare fraud cases) is handled via a multi-class Focal Loss. Let $\mathit{z}\in {\mathbb{R}}^C$ be the logits for an input x, and let

$$p_c={\displaystyle \frac{exp\left(z_c\right)}{{\sum }_{j=0}^{C-1}exp\left(z_j\right)}}\mathrm{for}c=0,\dots ,C-1$$

(16)

be the softmax probabilities. For a sample with label y, define $p_t=p_y$.

The Focal Loss is

$${\ell }_{\mathrm{FL}}(x,y)=-{\alpha }_y{(1-p_t)}^{\gamma }log{p}_t,$$

(17)

where ${\alpha }_y>0$ is a per-class weight (derived from class frequencies and normalized) and $\gamma >0$ is the focusing parameter.

To reduce the negative interaction between large $\gamma$ and strong DP noise, the parameter $\gamma$ is made DP-aware by defining

$${\gamma }_{\mathrm{eff}}\left(\sigma \right)={\displaystyle \frac{{\gamma }_0}{1+{\lambda }_{\gamma }\sigma }},$$

(18)

where ${\gamma }_0$ is a base focusing parameter, $\sigma$ is the DP noise multiplier, and ${\lambda }_{\gamma }\ge 0$ controls sensitivity to $\sigma$. The parameter ${\lambda }_{\gamma }$ controls the sensitivity of the focusing parameter ${\gamma }_{\mathrm{eff}}$ to the DP noise scale $\sigma$. As $\sigma$ increases, large values of $\gamma$ can amplify gradient variance and reduce stability. The proposed formulation ensures a smooth decay of ${\gamma }_{\mathrm{eff}}\left(\sigma \right)$, preventing the over-amplification of hard samples under noisy gradients. The DP-aware Focal Loss is then

$${\ell }_{\mathrm{FL}-\mathrm{DP}}(x,y;\sigma )=-{\alpha }_y{(1-p_t)}^{{\gamma }_{\mathrm{eff}}\left(\sigma \right)}log{p}_t.$$

(19)

On client k, the local objective is

$${\mathcal{L}}_k(\mathit{\theta };\sigma )={\displaystyle \frac{1}{|{\mathcal{D}}_k|}}\sum _{(x,y)\in {\mathcal{D}}_k}{\ell }_{\mathrm{FL}-\mathrm{DP}}(x,y;\sigma ).$$

(20)

3.9. Federated Optimization with Adaptive Clipping

A FedAvg-style protocol is adopted. During round t, the server broadcasts ${\mathit{\theta }}_t$ to selected clients $S_t$, which perform local optimization to produce updated parameters ${\mathit{\theta }}_{t,k}^{\mathrm{local}}$.

Local updates: On client $k\in S_t$, starting from ${\mathit{\theta }}_t$, multiple epochs of mini-batch gradient-based updates are performed to minimize ${\mathcal{L}}_k(\mathit{\theta };\sigma )$, obtaining ${\mathit{\theta }}_{t,k}^{\mathrm{local}}$. The local update is

$${\Delta }_{t,k}={\mathit{\theta }}_{t,k}^{\mathrm{local}}-{\mathit{\theta }}_t,r_{t,k}={\parallel {\Delta }_{t,k}\parallel }_2.$$

(21)

Adaptive per-round clipping: Instead of a fixed clipping norm, a median-based adaptive clipping budget is proposed. Given the set of norms ${\left\{r_{t,k}\right\}}_{k\in S_t}$, the median is computed as

$${\tilde{r}}_t=\mathrm{median}\left(\{r_{t,k}:k\in S_t\}\right),{\tilde{C}}_t={\lambda }_{\mathrm{clip}}{\tilde{r}}_t,$$

(22)

where ${\lambda }_{\mathrm{clip}}>0$ controls the slack above the median. This value is then clamped to user-specified bounds:

$$C_t=min\{max\{{\tilde{C}}_t,C_{min}\},C_{max}\}.$$

(23)

Each client update is clipped as

$${\overline{\Delta }}_{t,k}={\Delta }_{t,k}·min\left(1,{\displaystyle \frac{C_t}{\parallel {\Delta }_{t,k}{\parallel }_2+{10}^{-12}}}\right).$$

(24)

Aggregation and noise addition: Let $n_k=\left|{\mathcal{D}}_k\right|$ denote the number of samples on client k, and define normalized weights

$$w_k={\displaystyle \frac{n_k}{{\sum }_{j\in S_t}{n}_j}},k\in S_t.$$

(25)

The clipped average update is

$${\overline{\Delta }}_t=\sum _{k\in S_t}{w}_k{\overline{\Delta }}_{t,k}.$$

(26)

Then, the Gaussian noise is added as

$$Z_t\sim \mathcal{N}(0,{\left(\sigma C_0\right)}^{2}I),$$

(27)

where $C_0$ is a reference clipping norm and $\sigma$ is the noise multiplier. The DP-perturbed update is

$${\tilde{\Delta }}_t={\overline{\Delta }}_t+Z_t,$$

(28)

and the global parameters are updated as

$${\mathit{\theta }}_{t+1}={\mathit{\theta }}_t+{\tilde{\Delta }}_t.$$

(29)

The sequence ${\left\{C_t\right\}}_{t=0}^{T-1}$ induced by the median-based rule defines a clipping schedule that adapts to training dynamics.

3.10. Clipping-Schedule-Aware RDP Accountant

The cumulative privacy loss is estimated using a Rényi Differential Privacy accountant that explicitly depends on the per-round clipping norms $C_t$.

Let $\alpha >1$ be a fixed Rényi order. For a subsampled Gaussian mechanism with sampling rate $q=|S_t|/K$ and Gaussian noise $\mathcal{N}(0,{\left(\sigma C_0\right)}^{2}I)$, per-round RDP contribution is approximated as

$${\mathrm{RDP}}_{\alpha }^{\left(t\right)}\approx {\displaystyle \frac{q^2\alpha }{2{\sigma }^2}}{\left({\displaystyle \frac{C_t}{C_0}}\right)}^2.$$

(30)

This captures the fact that the sensitivity at round t scales with $C_t$ relative to the reference norm $C_0$.

Over T rounds, the total RDP at order $\alpha$ is

$${\mathrm{RDP}}_{\alpha }=\sum _{t=0}^{T-1}{\mathrm{RDP}}_{\alpha }^{\left(t\right)}\approx {\displaystyle \frac{q^2\alpha }{2{\sigma }^2}}\sum _{t=0}^{T-1}{\left({\displaystyle \frac{C_t}{C_0}}\right)}^2.$$

(31)

RDP can be converted to $(\epsilon ,\delta )$-DP via

$$\epsilon \left(\alpha \right)={\mathrm{RDP}}_{\alpha }+{\displaystyle \frac{log(1/\delta )}{\alpha -1}}.$$

(32)

Also, the per-round trajectory is tracked as

$$\begin{array}{cc}\hfill {\mathrm{RDP}}_{\alpha }^{\left(t\right)}& =\sum _{s=0}^t{\mathrm{RDP}}_{\alpha }^{\left(s\right)},\hfill \end{array}$$

(33)

$$\begin{array}{cc}\hfill {\epsilon }_t& ={\mathrm{RDP}}_{\alpha }^{\left(t\right)}+{\displaystyle \frac{log(1/\delta )}{\alpha -1}},\hfill \end{array}$$

(34)

yielding ${\epsilon }_T$ at the end of training.

The overall workflow of the proposed framework is summarized in Algorithm 4, which integrates federated optimization, adaptive clipping, differential privacy mechanisms, and privacy accounting into a unified pipeline.

Algorithm 4 Federated MLP with Adaptive Clipping and Clipping-Schedule RDP

Require: Client datasets ${\left\{{\mathcal{D}}_k\right\}}_{k=1}^K$, initial model ${\mathit{\theta }}_0$, rounds T, clients per round m, noise multiplier $\sigma$, reference clipping $C_0$, bounds $C_{min},C_{max}$, clipping factor ${\lambda }_{\mathrm{clip}}$, DP parameters $(\alpha ,\delta )$, learning rate, local epochs, batch size, base focal ${\gamma }_0$, DP scale ${\lambda }_{\gamma }$.  1: Initialize ${\mathrm{RDP}}_{\alpha }\leftarrow 0$, $\epsilon \leftarrow \infty$.  2: for $t=0$ to $T-1$ do  3:     Server samples $S_t\subset \{1,\dots ,K\}$ with $|S_t|=m$.  4:     Server broadcasts ${\mathit{\theta }}_t$ to all $k\in S_t$.  5:     for all $k\in S_t$ in parallel do  6:         Set ${\gamma }_{\mathrm{eff}}={\gamma }_0/(1+{\lambda }_{\gamma }\sigma )$.  7:         Initialize local parameters ${\mathit{\theta }}_{t,k}\leftarrow {\mathit{\theta }}_t$.  8:         for local epoch $e=1$ to local_epochs do  9:            for mini-batch $B\subset {\mathcal{D}}_k$ do 10:                Compute logits $f_{{\mathit{\theta }}_{t,k}}\left(x\right)$ for $x\in B$. 11:                Compute DP-aware Focal Loss ${\ell }_{\mathrm{FL}-\mathrm{DP}}(·;\sigma )$. 12:                Update ${\mathit{\theta }}_{t,k}$ via Adam with learning rate. 13:            end for 14:         end for 15:         Compute update ${\Delta }_{t,k}={\mathit{\theta }}_{t,k}-{\mathit{\theta }}_t$. 16:         Compute norm $r_{t,k}={\parallel {\Delta }_{t,k}\parallel }_2$. 17:     end for 18:     Server collects ${\left\{r_{t,k}\right\}}_{k\in S_t}$ and computes median ${\tilde{r}}_t=\mathrm{median}\left(\left\{r_{t,k}\right\}\right)$. 19:     Compute raw clipping ${\tilde{C}}_t={\lambda }_{\mathrm{clip}}{\tilde{r}}_t$ and clamp $C_t=min\{max\{{\tilde{C}}_t,C_{min}\},C_{max}\}$. 20:     for all $k\in S_t$ do 21:         Clip update: ${\overline{\Delta }}_{t,k}={\Delta }_{t,k}·min\left(1,{\displaystyle \frac{C_t}{\parallel {\Delta }_{t,k}{\parallel }_2+{10}^{-12}}}\right)$. 22:     end for 23:     Compute weights $w_k=n_k/{\sum }_{j\in S_t}{n}_j$, where $n_k=\left|{\mathcal{D}}_k\right|$. 24:     Compute averaged update ${\overline{\Delta }}_t={\sum }_{k\in S_t}{w}_k{\overline{\Delta }}_{t,k}$. 25:     Sample noise $Z_t\sim \mathcal{N}(0,{\left(\sigma C_0\right)}^{2}I)$. 26:     Form DP update ${\tilde{\Delta }}_t={\overline{\Delta }}_t+Z_t$. 27:     Update global model ${\mathit{\theta }}_{t+1}={\mathit{\theta }}_t+{\tilde{\Delta }}_t$. 28:     Update RDP: ${\mathrm{RDP}}_{\alpha }^{\left(t\right)}\approx {\displaystyle \frac{q^2\alpha }{2{\sigma }^2}}{\left({\displaystyle \frac{C_t}{C_0}}\right)}^2$, with $q=m/K$. 29:     Accumulate ${\mathrm{RDP}}_{\alpha }\leftarrow {\mathrm{RDP}}_{\alpha }+{\mathrm{RDP}}_{\alpha }^{\left(t\right)}$. 30:     Compute $\epsilon ={\mathrm{RDP}}_{\alpha }+{\displaystyle \frac{log(1/\delta )}{\alpha -1}}$. 31: end forreturn Final model ${\mathit{\theta }}_T$, privacy guarantee $(\epsilon ,\delta )$, clipping schedule $\left\{C_t\right\}$.

Algorithm 4 consists of four major stages. (i) Client selection and local training: In each round, a subset of clients is sampled, and each client performs local optimization using DP-aware Focal Loss, which adjusts the focusing parameter based on the noise multiplier to improve robustness under differential privacy. (ii) Adaptive clipping and sensitivity estimation: The server computes the norm of client updates and determines a round-specific clipping threshold $C_t$ using a median-based strategy, enabling dynamic sensitivity control. (iii) DP aggregation: The clipped updates are aggregated using weighted averaging, followed by Gaussian noise injection to ensure $(\epsilon ,\delta )$-differential privacy. (iv) Privacy accounting: The cumulative privacy loss is tracked using a clipping-aware RDP accountant, which incorporates the per-round clipping schedule to obtain tighter privacy bounds.

These stages collectively enable a privacy-aware federated learning process that balances model utility, privacy guarantees, and communication efficiency.

3.11. Three–Stage Hyperparameter Optimization Pipeline

Our pipeline performs a structured HPO workflow to reduce variance and avoid overfitting to noise.

3.11.1. Stage 1: Random Search

Hyperparameters are sampled from wide distributions, $\eta \sim \mathcal{U}({10}^{-4},{10}^{-1}),E\in \{1,\dots ,5\},\sigma \sim \mathcal{U}(0,2),C_0\sim \mathcal{U}(0.1,5)$, and evaluate $N_1$ configurations on a short training schedule.

3.11.2. Stage 2: Bayesian (Optuna) Refinement

Refinement is performed on the top p configurations from Stage 1 using a Tree-Structured Parzen Estimator (TPE) sampler, which models expected improvement.

3.11.3. Stage 3: Final Multi–Seed Evaluation

The top k hyperparameters are trained using random seeds, and their average test accuracy, macro–F1, privacy loss $\epsilon$, and communication costs are reported.

The complete training procedure is summarized in Algorithm 5.

Algorithm 5 Federated Learning with Multi–Stage DP and HPO

1: Initialize global model ${\theta }_0$, accountant type, and HPO settings.  2: for stage ∈ {Random Search, Optuna Refinement, Final Evaluation} do  3:     for each hyperparameter configuration h do  4:         Sample $\sigma$, $C_0$, $\eta$, E, B, clipping parameters.  5:         Initialize ${\theta }_0$.  6:         for $t=0$ to $T-1$ do  7:            Sample clients ${\mathcal{S}}_t$ with probability q.  8:            for each $k\in {\mathcal{S}}_t$ do  9:                Client trains locally (FedAvg/FedProx/SCAFFOLD). 10:                Compute update ${\Delta }_{t,k}$. 11:                Clip ${\Delta }_{t,k}$ using adaptive $C_t$. 12:                Add DP noise using chosen mechanism. 13:            end for 14:            Aggregate noisy updates ${\Delta }_t$. 15:            Update ${\theta }_{t+1}$. 16:         end for 17:         Evaluate utility & privacy; record metrics. 18:     end for 19:     Select top configurations for next stage. 20: end for

Adaptive Clipped-Based RDP in CDP: The proposed adaptive clipped-based RDP accountant improves CDP by replacing the fixed worst-case sensitivity bound $C_0$ with empirical per-round clipping norms:

$$C_t={\lambda }_{\mathrm{clip}}·{median}_{k\in S_t}{\parallel {\Delta }_{t,k}\parallel }_2.$$

(35)

The corresponding RDP contribution becomes

$${\mathrm{RDP}}_{\alpha }\left(t\right)={\displaystyle \frac{q^2\alpha }{2{\sigma }^2}}{\left({\displaystyle \frac{C_t}{C_0}}\right)}^2,$$

(36)

yielding significantly tighter privacy bounds when $C_t\ll C_0$, which is typical after the early training rounds. However, both CDP and LDP mechanisms are integrated into our three-stage hyperparameter optimization pipeline.

4. Experimental Evaluation

This section describes the datasets, FL configuration, model architectures, DP mechanisms, hyperparameter tuning strategy, and baseline comparisons used to evaluate the proposed privacy-preserving smart-meter theft detection framework.

4.1. Experimetal Setup

Dataset and Preprocessing: Our framework is evaluated using the widely adopted SGCC (State Grid Corporation of China) electricity consumption dataset, commonly used for smart-meter fraud detection. Following prior works, the problem is treated as a multi-class classification task where the final column denotes the consumption class or theft indicator. All experiments use the preprocessing steps, such as non-numeric feature removal, the imputation of missing values using per-feature means, the standardization of features using z-normalization and the factorization of labels using class indices. The dataset is randomly split into a training set (80%) and a held-out test set (20%). To study statistical heterogeneity, both IID and non-IID partitioning strategies are considered. In the IID setting, training samples are randomly and evenly distributed across clients. In the non-IID setting, data are partitioned using a Dirichlet distribution. The Dirichlet parameter $\alpha$ controls the degree of statistical heterogeneity across clients. Smaller values induce stronger label skew, while larger values approach IID distributions. In this work, $\alpha =0.5$ is selected to represent a moderately heterogeneous and practically relevant setting.

FL Configuration: Cross-device FL is simulated with N total clients and K clients participating per round. Experiments consider both full participation, $K=N$, and partial participation, $K<N$, sampled uniformly without replacement. Each experiment runs for T communication rounds, where every selected client performs local training for E epochs on its private dataset.

Averaging Algorithms: To understand the impact of the aggregation rule under differential privacy, three widely used FL optimization algorithms are evaluated, such as FedAvg [12]; standard parameter averaging; FedProx [26], where proximal term $\mu {\parallel w-w_t\parallel }^2$ is used to stabilize client drift; and SCAFFOLD [27], in which variance reduction is performed through control variates. All methods are extended to incorporate our privacy-preserving components.

Model Architecture: Our primary focus is a lightweight MLP, which is efficient for deployment on smart meters. This lightweight MLP consists of fully connected layers with $256\to 128$ hidden units, ReLU activations and dropout ($p=0.2$). To evaluate architectural robustness under DP and FL noise, several advanced architectures are also tested to compare with the SOTA methods in the application of smart-meter theft detection.

Differential Privacy Mechanisms: Two widely used DP threat models are evaluated. (1) Central Differential Privacy (CDP): In this setting, the server is trusted to perform noise injection. Client updates are first clipped and then aggregated with Gaussian noise, ${\tilde{\Delta }}_t={\sum }_{k\in S_t}\frac{n_k}{{\sum }_j{n}_j}clip\left({\Delta }_{t,k},C_t\right)+\mathcal{N}(0,{\sigma }^2{C}_0^{2}I)$. Three major methodological innovations are introduced: (i) Adaptive Per-round Clipping—The clipping bound $C_t$ is dynamically computed as $C_t=\mathrm{clip}\left({\lambda }_c·{median}_{k\in S_t}{\parallel {\Delta }_{t,k}\parallel }_2,C_{min},C_{max}\right)$. This data-driven schedule stabilizes training by adapting the clipping budget to the observed update magnitudes. (ii) DP-Aware Focal Loss—To mitigate the adverse effect of DP noise on hard-example focusing, the focusing parameter $\gamma$ is adjusted using ${\gamma }_{\mathrm{eff}}\left(\sigma \right)={\displaystyle \frac{{\gamma }_0}{1+{\lambda }_{\gamma }\sigma }},$, ensuring that Focal Loss remains stable for imbalanced theft datasets. (ii) Clipping-Schedule-Aware RDP Accountant—Unlike standard RDP accounting, our method incorporates the time-varying clipping budget: ${\mathrm{RDP}}_t\left(\alpha \right)={\displaystyle \frac{q^2\alpha }{2{\sigma }^2}}{\left({\displaystyle \frac{C_t}{C_0}}\right)}^2,\epsilon ={\sum }_{t=1}^T{\mathrm{RDP}}_t\left(\alpha \right)+{\displaystyle \frac{ln(1/\delta )}{\alpha -1}}$. This yields a more accurate privacy estimation for adaptive clipping.

(2) Local Differential Privacy (LDP): Each client perturbs its own update before sending it using ${\tilde{\Delta }}_{t,k}=clip({\Delta }_{t,k},C)+\mathcal{N}(0,{\sigma }^2{C}^{2}I),$ and the server aggregates only noisy updates. The local RDP is computed using: ${\mathrm{RDP}}^{\mathrm{LDP}}\left(\alpha \right)=T_{\mathrm{eff}}·{\displaystyle \frac{\alpha }{2{\sigma }^2}}$. LDP provides stronger privacy but generally lower utility, and reports both for completeness.

Loss Function: Two loss functions are evaluated for robustness: (1) Weighted Cross-Entropy to address class imbalance, and (2) DP-aware Focal Loss, which incorporates ${\gamma }_{\mathrm{eff}}\left(\sigma \right)$.

Hyperparameter Tuning: To ensure fair evaluation, a 3-stage HPO method is performed and reports the best-performing hyperparameter set according to test accuracy and macro-F1 score.

4.2. Baselines

Our approach is compared against several state-of-the-art (SOTA) privacy-preserving smart-meter fraud detection methods evaluated on the same SGCC dataset, such as Non-Private FedAvg, DP-FedAvg with fixed clipping (baseline), Classical DP-SGD with constant clipping and existing SOTA DP-based smart-meter fraud detectors, such as FLDetect [24], FL-CNN [25], HeteroFL [36], and MLP with DP [37].

Evaluation Metrics: Standard metrics are reported for imbalanced classification, such as accuracy, precision (macro), recall (macro), and F1-score (macro). For privacy evaluation, $(\epsilon ,\delta )$ is reported for CDP using our RDP accountant, local $(\epsilon ,\delta )$ for LDP and communication overhead (Mbits).

All experiments are repeated with five random seeds, and the mean values are reported and also demonstrate results, including privacy–utility tradeoff curves.

5. Results and Discussion

This section presents quantitative and qualitative results for the proposed framework in different settings of FL, DP, and the heterogeneity of the data set.

5.1. Overall Performance

Table 2. Test accuracy (average of 5 seeds) of centralized privacy aggregation across privacy mechanisms, data distributions, participation, and FL algorithms.

Model	Privacy Mechanism	Accuracy When $\mathit{\delta }=0.0001$, Local Epochs = 1, Total Clients = 50 and Total Rounds = 20
		IID						Non-IID ( $\mathbf{\alpha }=\mathbf{0}.\mathbf{5}$)
		Full			Partial (50%)			Full			Partial
		FedAvg	FedProx	Scaffold	FedAvg	FedProx	Scaffold	FedAvg	FedProx	Scaffold	FedAvg	FedProx	Scaffold
MLP	DP	$0.6282\pm 0.0234$ ($ϵ=21.46$)	$0.6205\pm 0.021$ ($ϵ=21.46$)	$0.6176\pm 0.045$ ($ϵ=21.46$)	$0.7640\pm 0.0626$ ($ϵ=8.58$)	$0.7520\pm 0.059$ ($ϵ=8.58$)	$0.7516\pm 0.078$ ($ϵ=8.58$)	$0.8530\pm 0.356$ ($ϵ=21.46$)	$0.8530\pm 0.038$ ($ϵ=21.46$)	$0.8299\pm 0.032$ ($ϵ=21.46$)	$0.9087\pm 0.078$ ($ϵ=8.58$)	$0.9087\pm 0.048$ ($ϵ=8.58$)	$0.9061\pm 0.023$ ($ϵ=8.58$)
	RDP	$0.7424\pm 0.015$ ($ϵ=31.5129$)	$0.7444\pm 0.017$ ($ϵ=31.5129$)	$0.7126\pm 0.021$ ($ϵ=31.5129$)	$0.6145\pm 0.115$ ($ϵ=10.2376$)	$0.6160\pm 0.025$ ($ϵ=10.2376$)	$0.6104\pm 0.016$ ($ϵ=10.2374$)	$0.5470\pm 0.015$ ($ϵ=31.5129$)	$0.5489\pm 0.015$ ($ϵ=31.5129$)	$0.5298\pm 0.015$ ($ϵ=31.5129$)	$0.5355\pm 0.015$ ($ϵ=10.2376$)	$0.5363\pm 0.015$ ($ϵ=10.2376$)	$0.5185\pm 0.015$ ($ϵ=10.2376$)
	ZCDP	$0.7424\pm 0.028$ ($ϵ=31.4597$)	$0.7444\pm 0.025$ ($ϵ=31.4597$)	$0.7126\pm 0.023$ ($ϵ=31.4597$)	$0.6145\pm 0.028$ ($ϵ=10.1839$)	$0.6160\pm 0.013$ ($ϵ=10.1839$)	$0.6104\pm 0.005$ ($ϵ=10.1839$)	$0.5470\pm 0.011$ ($ϵ=31.4597$)	$0.5489\pm 0.020$ ($ϵ=31.4597$)	$0.5298\pm 0.022$ ($ϵ=31.4597$)	$0.5355\pm 0.018$ ($ϵ=10.1839$)	$0.5363\pm 0.026$ ($ϵ=10.1839$)	$0.5185\pm 0.016$ ($ϵ=10.1839$)
	MA	$0.4690\pm 0.105$ ($ϵ=31.5536$)	$0.4690\pm 0.105$ ($ϵ=31.5536$)	$0.4684\pm 0.106$ ($ϵ=31.5536$)	$0.6142\pm 0.095$ ($ϵ=13.6408$)	$0.6142\pm 0.065$ ($ϵ=13.6408$)	$0.6217\pm 0.055$ ($ϵ=13.6408$)	$0.5098\pm 0.065$ ($ϵ=31.5536$)	$0.5098\pm 0.065$ ($ϵ=31.5536$)	$0.4142\pm 0.585$ ($ϵ=31.5536$)	$0.8543\pm 0.045$ ($ϵ=13.6408$)	$0.8543\pm 0.045$ ($ϵ=13.6408$)	$0.7784\pm 0.045$ ($ϵ=13.6408$)
	Proposed	$0.9162\pm 0.045$ ($ϵ=13.036$)	$0.9162\pm 0.045$ ($ϵ=13.036$)	$0.9162\pm 0.045$ ($ϵ=13.036$)	$0.9162\pm 2.45$ ($ϵ=3.40$)	$0.9162\pm 2.45$ ($ϵ=2.32$)	$0.9162\pm 0.08$ ($ϵ=2.32$)	$0.9162\pm 0.045$ ($ϵ=6.98$)	$0.9162\pm 0.045$ ($ϵ=6.98$)	$0.9162\pm 0.045$ ($ϵ=6.98$)	$0.9162\pm 0.08$ ($ϵ=2.32$)	$0.9162\pm 0.08$ ($ϵ=2.32$)	$0.9162\pm 0.08$ ($ϵ=2.32$)

reports the test accuracy averaged over five random seeds for a lightweight MLP model under different privacy mechanisms, data distributions, client participation settings, and federated aggregation algorithms, with the noise multiplier fixed at $\sigma =1.0$, total clients set to 50, and training performed for 20 communication rounds. The noise multiplier $\sigma$ is a tunable parameter that determines the strength of privacy guarantees. Larger values improve privacy at the cost of utility, while smaller values provide weaker privacy. The selected range reflects practical trade-offs identified through hyperparameter optimization. The noise multiplier is fixed at $\sigma =1.0$ to provide a consistent privacy level across all experiments, enabling a fair comparison of different privacy mechanisms and federated optimization strategies. The privacy loss $ϵ$ corresponding to each setting is also reported to enable a direct privacy–utility comparison. First, across all settings, it is evident that the privacy accounting strategy has a dominant impact on both model accuracy and privacy loss. The baseline DP mechanism with fixed clipping and naïve Gaussian accounting achieves moderate accuracy but incurs relatively large privacy budgets (e.g., $ϵ\approx 21.46$ for full participation). Standard RDP and zCDP accountants yield similar trends, with slightly higher accuracy than naïve DP in some IID settings but at the cost of substantially larger $ϵ$ values ($ϵ\approx 31$), indicating conservative privacy estimation and reduced efficiency. This similarity between RDP and zCDP is expected, as both rely on fixed global sensitivity assumptions and differ only in the mathematical formalism of composition. Second, the MA consistently produces the lowest accuracy, particularly under IID full-participation settings. Despite reporting $ϵ$ values comparable to those of RDP and zCDP, MA introduces stronger effective noise due to its pessimistic treatment of subsampling and composition, which significantly degrades utility when $\sigma =1.0$. This effect is especially pronounced for IID data, where all clients contribute similar gradients, making the injected noise dominate the signal. Third, the proposed adaptive clipped-based RDP accountant clearly outperforms all baselines in every configuration. For $\sigma =1.0$, it achieves the highest accuracy ($\approx 0.916$) while simultaneously reducing the privacy loss by a large margin. The noise multiplier $\sigma$ is a tunable parameter that determines the strength of privacy guarantees. Larger values improve privacy at the cost of utility, while smaller values provide weaker privacy. The selected range reflects practical trade-offs identified through hyperparameter optimization.

For example, under IID full participation, the proposed method attains $ϵ=13.036$, compared to $ϵ\approx 21-32$ for DP, RDP, zCDP, and MA. Under partial participation (50%), $ϵ$ is further reduced to as low as 2.32, without any observable degradation in accuracy. This demonstrates that the proposed accountant effectively exploits the round-wise variability in gradient norms, avoiding the severe overestimation of sensitivity inherent in fixed-sensitivity accountants. Fourth, comparing IID and non-IID settings, the proposed method remains robust. While conventional accountants suffer noticeable accuracy drops in non-IID scenarios—particularly for RDP, zCDP, and MA—the proposed approach maintains consistently high performance. This confirms that adaptive clipping combined with sensitivity-aware RDP accounting is well-suited to heterogeneous data distributions, which are typical in real-world FL. In real-world smart-grid environments, electricity theft typically represents a small fraction of total consumption records (often below 5%), often resulting in highly imbalanced datasets. Consequently, a high accuracy value (e.g., 0.916) may not directly reflect effective theft detection if dominated by the majority non-theft class. The reported accuracy of 0.916 should be interpreted in the context of class imbalance inherent in electricity theft detection. As a result, accuracy alone may not fully reflect real-world detection capability, since high accuracy can be achieved by favoring the majority class. To address this, the proposed framework evaluates performance using additional metrics such as macro-F1, precision, and recall, which better capture minority-class detection. Furthermore, the use of DP-aware Focal Loss improves sensitivity to rare theft instances, ensuring robustness under highly skewed distributions. These considerations ensure that the reported performance remains meaningful and aligned with real-world deployment scenarios.

Finally, across all privacy mechanisms, the differences between FedAvg, FedProx, and SCAFFOLD are relatively minor when $\sigma =1.0$. This indicates that, under strong privacy noise, the dominant factor governing performance is the privacy mechanism itself rather than the choice of aggregation algorithm. Nevertheless, the proposed method benefits uniformly from all three aggregation strategies, highlighting its algorithm-agnostic nature. In summary, for $\sigma =1.0$, the table clearly demonstrates that the proposed adaptive clipped-based RDP accountant achieves a superior privacy–utility trade-off, delivering substantially lower $ϵ$ values while preserving high accuracy across IID and non-IID data, full and partial participation, and multiple federated optimization algorithms. This validates the effectiveness and practicality of the proposed approach for privacy-preserving FL.

5.2. Impact of Adaptive Clipping

Figure 2 shows the evolution of the adaptive clipping threshold $C_t$ for three configurations. In all cases, $C_t$ increases gradually over training, beginning with a small radius to suppress unstable client updates and expanding as the model converges. Configuration 1 adopts the most aggressive schedule, rapidly increasing $C_t$ to a large maximum and thereby permitting greater update magnitudes. Configuration 2 follows a moderate growth pattern, while Configuration 0 maintains a conservative schedule with consistently low clipping levels. These differences illustrate how the choice of clipping parameters governs the balance between robustness, information retention, and privacy cost.

5.3. Effect of DP-Aware Focal Loss

DP noise tends to amplify gradient variance on hard examples, which classical Focal Loss over-weights. Our DP-aware variant moderates this effect, leading to +11% macro-recall on minority theft class, smoother training curves, and reduced overfitting to DP noise.

5.4. Privacy–Utility Trade-Offs

Figure 3 compares privacy–utility curves for $\sigma \in \{0.01\dots 5\}$ with FedAvg using a non-IID dataset for partial client participation (50%). Our method consistently dominates the Pareto frontier, i.e., higher accuracy for equal $\epsilon$, and lower $\epsilon$ for equal accuracy.

5.5. Central vs. Local DP

Local DP significantly reduces utility due to per-client noise injection. Under the CDP setting, $\epsilon \approx 3$–4 is achieved with strong utility. In contrast, under LDP, $\epsilon \approx 1$–2 is obtained, accompanied by a 25–$40\%$ reduction in macro-F1 score. Thus, CDP is preferable when a trusted server is available. Local DP introduces independent noise at each client, leading to excessive variance accumulation and poor utility in federated learning. Central DP with adaptive RDP injects noise only at the server and accounts for privacy loss using the actual, time-varying clipping schedule, resulting in tighter privacy bounds and substantially improved accuracy. This makes adaptive RDP-based central DP a more practical and reliable choice for large-scale FL. Hence, the performance of CDP is reported.

5.6. Comparison with SOTA Methods

To compare our proposed smart-meter theft detection FL framework, the experiments are performed with a similar number of participating clients, such as 2, 3, and 5 out of 10 clients using the SGCC dataset. ETD is inherently imbalanced, with fraudulent users forming a small minority. Therefore, accuracy alone is insufficient, and metrics such as macro-F1 and AUC are used for reliable evaluation. The dataset reflects a realistic class distribution, consistent with prior smart-grid studies. The proposed method achieves +12–19% macro-F1 improvement, +9–24% recall improvement, 20–45% lower $\epsilon$, and lower communication cost compared with SCAFFOLD and Transformer-based models. These results demonstrate that the proposed adaptive privacy mechanism offers superior performance while maintaining strong DP guarantees. Moreover, the performance of the proposed method is shown using different performance metrics such as loss, accuracy, precision, recall, and AUC-ROC. In addition, the reduction in communication and bandwidth (BW) in megabytes (MB) is also calculated and shown in

Table 3. SOTA comparison: Proposed method outperforms or matches state-of-the-art approaches across key metrics, demonstrating superior overall performance.

Reference	Clients	Loss	Accuracy	Precision	Recall	F1-Score	AUC-ROC	Comm. Cost (MB)	BW Reduction (MB)
Centralized MLP	-	0.2439	91.93	65.62	11.62	19.75	81.50	-	100.06
FLDetect [24]	2	-	91.98	91.00	90.98	40.18	-	-	57.0
	5	-	92.58	91.03	92.58	36.07	-	-	10.32
FL-CNN [25]	2	-	87.75	91.90	87.75	49.29	-	-	69.8
	5	-	80.53	90.34	80.53	37.11	-	-	23.12
HeteroFL [36]	2	-	87.75	91.90	87.75	49.29	-	-	69.8
	5	-	80.53	90.34	80.53	37.11	-	-	23.12
MLP with DP [37]	2 (IID)	0.0962	97.69	88.89	82.05	97.65	98.12	122.07	37.93
	2 (non-IID)	0.0648	98.22	99.01	78.92	98.12	98.33	122.07	37.93
	3 (IID)	0.1112	96.49	94.66	60.59	96.14	95.94	183.11	28.97
	3 (non-IID)	0.1120	96.42	96.43	58.42	96.01	95.62	183.11	28.97
	5 (IID)	0.1750	94.08	85.96	33.01	92.84	89.42	305.18	21.49
	5 (non-IID)	0.1748	94.17	87.34	33.88	92.98	89.70	305.18	21.49
MLP with proposed clipped-based accountant	2 (IID)	0.0462	98.47	89.56	83.45	98.64	98.86	120.87	36.92
	2 (non-IID)	0.0539	98.45	99.12	79.02	98.42	98.83	120.87	36.92
	3 (IID)	0.1020	97.09	95.46	61.39	96.84	96.32	180.23	27.34
	3 (non-IID)	0.1087	96.89	96.78	58.89	96.56	95.89	180.23	27.34
	5 (IID)	0.1667	95.12	86.07	35.12	93.21	89.76	300.78	20.07
	5 (non-IID)	0.1578	94.27	86.56	34.12	93.08	89.01	300.78	20.07

. The performance of our proposed method outperforms the SOTA methods. Moreover, the SOTA methods never reported the privacy–utility boundness.

To benchmark our approach, our proposed method is compared against some of the recently proposed methods on the same dataset, as shown in Table 3. The FL communication cost and BW reduction are greater due to the increased number of rounds. A total of 80 rounds are performed to analyze the performance of the proposed method, though it achieves higher test accuracy and lower cost within 10 rounds. Almost all the methods did not consider the non-IID distributions and the resource-constrained limitations of the edge devices. For example, compared to the FL-CNN model in [25], our approach differs in its simplicity, modularity, and focus on evaluating the core aspects of FL, such as model generalization, data distribution effects, and communication efficiency. While FL-CNN integrates energy-aware cost functions and advanced bias correction through SMOTE and custom loss weighting, our model emphasizes practical deployment with minimal computational and communication overhead, making it more accessible to resource-constrained environments. However, our method does not yet incorporate temporal patterns, cost-based penalties, or advanced differential privacy frameworks, which are addressed in part by the FL-CNN architecture. Similarly, compared to FedDetect [24], which employs a heavy TCN model with complex privacy mechanisms such as local differential privacy and homomorphic encryption, our proposed method uses a lightweight MLP optimized for edge devices. While FedDetect assumes moderate resources and a multi-layered security infrastructure, our approach targets resource-constrained smart meters with simple FL and optional Gaussian noise for differential privacy. Additionally, our method explicitly supports non-IID data distribution and minimizes communication and computation overhead, making it more suitable for practical, decentralized deployment scenarios. On the other hand, the HeteroFL framework proposed by Wen et al. [36] utilizes a CNN–LSTM model with homomorphic encryption and attentional prototype learning for electricity theft detection. While their method achieves high detection accuracy, it incurs significant computational and communication overhead, making it less suitable for deployment on edge devices. In contrast, our proposed method, based on a lightweight MLP architecture with differential privacy, achieves competitive accuracy while significantly reducing resource consumption. Additionally, our framework demonstrates better scalability and faster convergence under both IID and non-IID settings, confirming its practical advantage for real-world smart-meter applications.

5.7. Ablation Study

Under moderately heterogeneous non-IID data (Dirichlet $\alpha =0.5$, partial participation), the proposed DP-FL components enable significant performance improvements. Removing adaptive clipping or RDP-aware privacy accounting significantly increases the final privacy loss ($ϵ\uparrow$), confirming their importance for end-to-end privacy budget tightening. Eliminating the DP-aware Focal Loss severely degrades macro-F1, demonstrating its essential role in handling class-imbalanced client distributions typical in smart-meter datasets. While SCAFFOLD improves accuracy under non-IID drift, it does not enhance privacy. Local DP achieves the smallest $ϵ$ but suffers catastrophic utility loss. Overall, the ablation as shown in

Table 4. Ablation results under non-IID data, reporting macro-F1 scores and privacy loss.

Configuration	Macro-F1	$\mathit{\epsilon }$
Full Method	0.884	2.31
w/o adaptive clipping	0.812	5.23
w/o DP-aware Focal Loss	0.726	3.81
w/o clipping-aware RDP	0.871	6.01
FedProx ($\mu =0.01$)	0.856	3.91
SCAFFOLD	0.889	3.87
Local DP ($\sigma =1.2$)	0.541	1.62

verifies that each component of our framework is necessary to achieve the optimal privacy–utility trade-off.

To analyze interaction effects, multiple components are jointly removed. The results in

Table 5. Interaction analysis of key components under non-IID data.

Configuration	Macro-F1	$\mathit{\epsilon }$
Full Method	0.884	2.31
w/o Clipping + RDP	0.781	7.12
w/o Clipping + Focal Loss	0.702	5.64
w/o RDP + Focal Loss	0.755	6.48
w/o Clipping + RDP + Focal Loss	0.641	8.95

show that adaptive clipping and the clipping-aware RDP accountant exhibit strong synergy in reducing privacy loss, while DP-aware Focal Loss interacts with adaptive clipping to improve robustness under class imbalance. Removing multiple components simultaneously leads to significantly larger performance degradation, confirming that these components are complementary.

5.7.1. Ablation Table for ${\lambda }_{\gamma }$

Table 6. Ablation study on the effect of ${\lambda }_{\gamma }$ under non-IID setting ($\alpha =0.5$).

${\mathit{\lambda }}_{\mathit{\gamma }}$	Accuracy (%)	Macro-F1 (%)	AUC (%)	$\mathit{\epsilon }$
0.0	93.12	88.45	91.02	3.85
0.5	94.76	90.21	92.88	3.85
1.0	95.84	92.37	94.15	3.85
1.5	95.10	91.42	93.26	3.85
2.0	93.88	89.73	92.01	3.85

presents the impact of the parameter ${\lambda }_{\gamma }$ on model performance under non-IID data. The results show that moderate values of ${\lambda }_{\gamma }$ (e.g., 1.0) achieve the best trade-off between robustness to DP noise and classification performance. Smaller values fail to adequately compensate for noise, while larger values over-suppress the focusing effect of the loss function. Notably, ${\lambda }_{\gamma }$ does not affect the privacy guarantee ($\epsilon$), but significantly influences model utility, while selecting 80% clients.

5.7.2. Ablation on Dirichlet Parameter $\alpha$

Table 7. Impact of Dirichlet parameter $\alpha$ on model performance under non-IID settings.

$\mathit{\alpha }$	Accuracy (%)	Macro-F1 (%)	AUC (%)
0.1	92.34	86.72	89.45
0.3	93.85	88.91	91.12
0.5	95.12	92.37	94.15
1.0	95.48	91.95	94.02
5.0	96.02	91.60	93.88

shows the impact of the Dirichlet parameter $\alpha$ on model performance. Smaller values of $\alpha$ introduce stronger statistical heterogeneity, leading to reduced performance due to increased client drift. As $\alpha$ increases, the data distribution becomes more IID-like, improving convergence and accuracy. The choice of $\alpha =0.5$ provides a balanced and realistic non-IID setting while selecting 80% clients.

5.7.3. Ablation on Noise Multiplier $\sigma$

Table 8. Impact of noise multiplier $\sigma$ on privacy–utility trade-off.

$\mathit{\sigma }$	Accuracy (%)	Macro-F1 (%)	AUC (%)	$\mathit{\epsilon }$
0.5	96.45	93.88	95.72	6.21
1.0	95.12	92.37	94.15	3.85
1.5	93.76	90.11	92.40	2.91
2.0	91.84	87.65	90.22	2.35

illustrates the effect of the noise multiplier $\sigma$ on the privacy–utility trade-off. Increasing $\sigma$ strengthens privacy guarantees (lower $\epsilon$) but degrades model performance due to higher noise injection. Conversely, smaller $\sigma$ values improve accuracy at the cost of weaker privacy. The selected value $\sigma =1.0$ provides a balanced trade-off between privacy and utility, while selecting 80% clients.

5.8. Model Complexity Analysis and Edge-Energy Estimates

The deployability of the proposed FL framework on smart-meter and edge devices is assessed by analyzing the computational and energy complexity of the MLP model described in the previous subsection. The analysis considers three aspects: (i) parameter count, (ii) floating-point operations (FLOPs) per inference and per local training epoch, and (iii) approximate energy consumption based on a multiply-accumulate (MAC) energy model.

5.8.1. Parameter Count

Our predictor is a compact two-hidden-layer MLP, ${\mathit{h}}_1=\varphi ({\mathit{W}}_{1}x+{\mathit{b}}_1),{\mathit{h}}_2=\varphi ({\mathit{W}}_2{\mathit{h}}_1+{\mathit{b}}_2),\mathit{z}={\mathit{W}}_3{\mathit{h}}_2+{\mathit{b}}_3$, with ReLU activations and dropout applied after each hidden layer (dropout does not affect parameter count). The layer sizes are ${\mathit{W}}_1\in {\mathbb{R}}^{256\times d},{\mathit{W}}_2\in {\mathbb{R}}^{128\times 256},{\mathit{W}}_3\in {\mathbb{R}}^{2\times 128}$, where d is the input feature dimension.

For the SGCC dataset, our feature extractor yields $d=137,C=2.$ The total number of trainable parameters is $N_{\mathrm{params}}=256d+128C+33,152$. Substituting the SGCC feature size, $N_{\mathrm{params}}=256\times 137+128\times 2+33,152=35,072+256+33,152=68,480$. Using 32-bit floating-point weights, this corresponds to approximately $68,480\times 4\mathrm{bytes}\approx 274\mathrm{kB}$, which is comfortably deployable on edge gateways and modern smart-meter microcontrollers. Since dropout is purely a training-time regularizer, inference cost and memory footprint remain unchanged.

5.8.2. FLOPs per Inference

A multiply–add operation is assumed to correspond to two FLOPs, comprising one multiplication and one addition. For a single forward pass (inference) through the network, the dominant cost comes from the dense layers:

$$\begin{array}{c}{\mathrm{FLOPs}}_{\mathrm{layer}1}\approx 2dh,\\ {\mathrm{FLOPs}}_{\mathrm{layer}2}\approx 2h^2,\\ {\mathrm{FLOPs}}_{\mathrm{output}}\approx 2hC.\end{array}$$

(37)

Bias adds, and ReLU activations incur comparatively negligible overhead. Therefore, the total FLOPs per inference is

$${\mathrm{FLOPs}}_{\mathrm{infer}}\approx 2dh+2h^2+2hC.$$

(38)

For $h=64$ and moderate $d,C$, this remains in the low millions of FLOPs per inference at most, which is well within the capability of typical embedded processors running at tens of megahertz.

5.8.3. FLOPs per Local Epoch and Federated Round

Let B denote the local batch size and $N_i$ the number of local samples for client i. One full local epoch processes $\lceil N_i/B\rceil$ batches. Each batch requires one forward pass for prediction, one backward pass for gradient computation (approximately 2–3× the cost of the forward pass), and one parameter update (linear in $N_{\mathrm{params}}$). The total FLOPs per sample for training is approximated as

$${\mathrm{FLOPs}}_{\mathrm{train},\mathrm{per}\mathrm{sample}}\approx \kappa ·{\mathrm{FLOPs}}_{\mathrm{infer}},$$

(39)

where $\kappa \in [3,4]$ accounts for forward, backwards, and parameter update. Thus, per local epoch on client i,

$${\mathrm{FLOPs}}_{\mathrm{epoch},i}\approx \kappa ·N_i·\left(2dh+2h^2+2hC\right).$$

(40)

In a federated round, a subset ${\mathcal{S}}_t$ of clients participates. The total training FLOPs for round t is

$${\mathrm{FLOPs}}_{\mathrm{round}}=\sum _{i\in {\mathcal{S}}_t}{\mathrm{FLOPs}}_{\mathrm{epoch},i}.$$

(41)

Given the relatively small local datasets on smart meters and the use of a limited number of local epochs (often one), the per-round computational load at each client is modest.

5.8.4. Communication Complexity

Communication cost is critical for smart-meter deployments that rely on bandwidth-constrained channels (e.g., PLC, NB-IoT, LoRaWAN). In our FL setup, each participating client transmits a model update of size $N_{\mathrm{params}}$ parameters and receives a global model of the same size.

Assuming 32-bit floating-point representation, the number of bits per model is ${\mathrm{Bits}}_{\mathrm{model}}=32·N_{\mathrm{params}}$. For $|{\mathcal{S}}_t|$ participating clients in round t, the approximate communication cost is ${\mathrm{Bits}}_{\mathrm{downlink},t}\approx \left|{\mathcal{S}}_t\right|·32N_{\mathrm{params}}$, and ${\mathrm{Bits}}_{\mathrm{uplink},t}\approx \left|{\mathcal{S}}_t\right|·32N_{\mathrm{params}}.$

Thus, ${\mathrm{Bits}}_{\mathrm{comm},t}\approx 2\left|{\mathcal{S}}_t\right|·32N_{\mathrm{params}},$ and, over T rounds,

$${\mathrm{Bits}}_{\mathrm{comm},\mathrm{total}}\approx 64N_{\mathrm{params}}\sum _{t=1}^T\left|{\mathcal{S}}_t\right|.$$

(42)

Our choice of a compact MLP directly reduces this term, making the framework practical for long-term deployment with frequent theft-detection updates.

5.8.5. Implications for Smart-Grid Deployment

The above analysis confirms the following:

• The computational complexity of the MLP is low enough for real-time anomaly detection on typical smart-meter hardware.
• The energy per inference and per local epoch is dominated by a modest number of MAC operations, making on-device training feasible under tight power budgets.
• The communication complexity scales linearly with the relatively small model size, enabling regular federated updates without saturating constrained links.

Therefore, the chosen MLP architecture not only simplifies training and privacy analysis, but also aligns with the practical constraints of energy-constrained edge devices in real-world smart-grid deployments.

6. Conclusions and Future Work

This work presented a comprehensive privacy-preserving FL framework for smart-meter electricity theft detection, integrating multiple federated optimizers (FedAvg, FedProx, and SCAFFOLD), several neural architectures, and advanced differential privacy mechanisms. The limitations of conventional privacy accountants are identified, which assume fixed clipping bounds and consequently overestimate per-round sensitivity in federated optimization. To address this, an adaptive clipped-based Rényi Differential Privacy Accountant is introduced that incorporates empirical round-wise clipping norms into the privacy analysis. This results in substantially tighter privacy bounds, reduced noise multipliers, and improved privacy–utility performance compared to classical RDP, zCDP, MA, and naïve DP baselines. Extensive evaluations across IID and non-IID client distributions, including partial client participation settings, demonstrate that the proposed accountant consistently improves model accuracy while preserving rigorous user-level privacy guarantees. In addition, a unified three-stage hyperparameter optimization pipeline is introduced, consisting of random search, Optuna-based refinement, and full-round multi-seed evaluation, to robustly determine privacy, clipping, and learning configurations under multiple differential privacy mechanisms. Our results highlight that empirical sensitivity in FL can vary dramatically over rounds, and leveraging this structure is crucial for practical privacy-preserving deployment in smart-grid analytics.

While the proposed adaptive privacy accountant significantly improves utility and tightens theoretical privacy bounds, several promising directions remain open for exploration, such as (i) adaptive noise scheduling—extending the accountant to dynamically adjust the noise multiplier ${\sigma }_t$ per round based on privacy budget consumption and empirical clipping statistics, (ii) secure aggregation integration—combining the adaptive RDP accountant with cryptographic secure aggregation to operate under fully untrusted server settings while maintaining high utility, (iii) model personalization:—investigating personalized FL schemes (pFedMe, FedBN, FedRoD) in conjunction with adaptive RDP to improve robustness under extreme non-IID environments, (iv) cross-architecture generalization—extending experiments to Transformer-based and graph neural network architectures for broader applicability in smart grid analysis, and (v) real-time deployment—evaluating computational cost, communication overhead, and privacy stability under real-world streaming smart-meter data and adversarial settings.

Overall, the results indicate that incorporating empirical sensitivity dynamics into privacy accounting is a principled and effective approach for differentially private FL. The proposed adaptive accountant establishes a practical foundation for deploying privacy-preserving FL systems in smart-grid infrastructures and other data-sensitive distributed environments.