Committee-Based Federated Learning Improves Smart-Grid Attack Detection in Simulated Grids

A serverless federated-learning framework tested on simulated distribution networks detected stealthy false data injection attacks while limiting the influence of malicious energy-community participants, according to the study’s case studies. The approach combines local multi-head self-attention Transformers with rotating committees of energy communities, which score model updates, vote on an aggregated result and replace one another without relying on a central supervisory control and data acquisition server. On the IEEE 33-bus system, the framework’s TMedian aggregation with a consensus-oriented selection strategy achieved an F1 score of 0.956 ± 0.012, compared with 0.899 ± 0.022 for XGBoost, 0.921 ± 0.018 for an LSTM and 0.935 ± 0.016 for a CNN.

A centralized Transformer trained with access to pooled data reached a higher F1 score of 0.967 ± 0.009 and was treated by the researchers as an upper-bound reference rather than a privacy-preserving practical alternative. The problem addressed is the vulnerability of state estimation in smart grids. A false data injection attack manipulates meter measurements so that an energy community’s manager can infer an incorrect electrical state.

The study explains that especially stealthy attacks can evade conventional residual-based bad-data detection: an attack vector can shift a measurement vector and the corresponding compromised state in a way that leaves the residual norm essentially unchanged. This creates risks for power flow, voltage security and operational decisions. The authors also place the electrical layer within broader electricity–hydrogen systems, where incorrect electrical estimates could affect electrolysers, hydrogen production, storage and conversion assets.

Their experiments, however, evaluate the detector at the electrical state-estimation level rather than in a coupled hydrogen system, so the reported results do not demonstrate protection of an operating multi-energy network. Energy communities are treated as independent federated-learning clients that retain their own measurement data and share only model updates. This arrangement avoids centralizing raw operational information, but it introduces the possibility that a community will upload a falsified, scaled, shifted, sign-reversed or otherwise poisoned gradient.

The study also addresses the single-point-of-failure problem associated with conventional federated learning, in which one aggregation server can become a bottleneck or a target. Each community trains a compact Transformer on private data, producing a local gradient that is sent to a committee elected for the current communication round. The committee evaluates gradient similarity, selects contributions according to the chosen strategy, applies an aggregation rule and proposes a new global model.

A subsequent election rotates committee membership, allowing the process to continue without a permanent central authority. The committee’s score for an energy community is based on the inverse squared Euclidean distance between that community’s gradient and the gradients of committee members. Under the assumption that honest updates form a comparatively compact cluster, an update resembling the committee receives a higher score.

Strategy I then selects the 40% of participants with the highest scores, placing priority on consensus and filtering updates that appear unusually distant. Strategy II selects the 40% with the lowest scores to preserve diversity among clients whose local data may represent different operating conditions. The researchers explicitly state that Strategy II is not a Byzantine-attack defense: under adversarial conditions, low-scored updates can be malicious.

The study instead presents Strategy I as the appropriate option when sabotage is anticipated, while Strategy II is intended to examine benign heterogeneity under non-IID data. This distinction is central to the framework because the same deviations that can be informative in a benign federation can also carry poisoned updates under attack. Three aggregation rules were evaluated.

FedAvg averages all supplied updates and is vulnerable to poisoning. TMedian performs coordinate-wise trimming, removing extreme upper and lower values before averaging the remainder. Krum ranks gradients by their distance from neighboring updates and selects the most central one, rather than combining information from multiple clients.

The committee-consensus protocol additionally requires an accepting majority of at least floor(C/2) + 1 members before a proposed aggregation is accepted. Committee membership is generated through a verifiable random function seeded with the hash of the previous global model, allowing authenticated participants to audit the election and limiting predictable targeting of committee members. A temporary coordinator may orchestrate a round, but it cannot unilaterally approve an update.

Under the stated security assumption that the committee majority remains honest, compromising the coordinator could delay or restart work but could not force acceptance of a malicious aggregation. Committee size is a trade-off: a larger committee makes majority capture less likely but increases scoring, verification and consensus traffic. The principal experiment used the IEEE 33-bus distribution system divided among nine energy communities, each covering three buses and 12 local features.

The generated dataset covered two years and contained 17,520 samples with 108 features in total, representing active and reactive power, voltage magnitude and voltage angle. Weak attacks altered mean active or reactive power injections by less than 10%, voltage magnitude by less than 5%, or voltage angle by less than 2 degrees; strong attacks exceeded 30%, 10% and 5 degrees, respectively. Training used 20 global rounds, a 40% participation rate, a two-head Transformer with two encoder blocks and the Adam optimizer with binary cross-entropy.

Model training was performed in Python with TensorFlow 2.18, while data generation used MATLAB 2022b and the MATPOWER toolbox. Because the weaker attacks are less conspicuous, they provided the more demanding test of the detector, and the distributed results broadly followed the same pattern for the easier strong-attack cases. The results reveal a sharp trade-off between benign diversity and adversarial resilience.

Under weak attacks without Byzantine manipulation, a typical federated-learning implementation performed poorly: one community recorded 0.84 accuracy but only 0.398 recall and a 0.304 F1 score, indicating many missed attacks. TMedian with both selection strategies improved on that baseline. During normal training, TMedian with Strategy II reached a final accuracy of 0.998, stabilized around round 13 and showed greater convergence than FedAvg, which ended at 0.85.

Strategy II generated frequent participant turnover, often admitting three or four new clients per round, whereas Strategy I repeatedly favored a stable core of three to four communities. In the larger 335-bus case, which represented 80 communities, four buses each and 35,040 samples over four years, Strategy II likewise produced stronger detection results for the first 20 communities. The authors associate this performance with access to a broader range of load patterns, voltage variations and power-flow dynamics, but the results remain based on generated measurements rather than live operational data.

Byzantine experiments reversed the ranking of the selection strategies. Strategy I achieved 0.973 accuracy with TMedian in the no-attack condition and remained between 0.701 and 0.782 across the five attack categories. Krum with Strategy I reached 0.821 without an attack and between 0.727 and 0.783 under attacks, while Strategy II fell to roughly 0.37–0.58 in adversarial settings.

Sign-flipping and random updates generally moved malicious gradients far from the honest cluster, allowing Strategy I to exclude them before aggregation. TMedian was particularly effective against those overt attacks, including gradient scaling. More subtle label flipping and constant shifts could remain close to honest gradient statistics, making selection alone less discriminating and leaving more influence to the aggregation rule.

Krum’s geometric treatment of whole updates sometimes gave it greater resilience to these structured attacks, while coordinate-wise TMedian could retain moderate coordinated perturbations. The comparison also found that prior federated detectors with Transformer or hybrid local models were more vulnerable to the tested manipulations. These measurements show performance under the study’s chosen attack models and case networks, not a universal ranking of all smart-grid defenses.

The approach introduces resource and deployment costs that the study does not fully resolve. The compact Transformer required approximately 6 × 10^5 floating-point operations per sample, 0.6 MB of model memory in 32-bit precision and nearly 1.0 GB of peak training memory, compared with lower requirements for XGBoost, CNN and LSTM. Committee-based participation reduced training computation relative to full-participation FedAvg by roughly 2.5 to 3 times, with reported total times ranging from 96 seconds for TMedian with Strategy II to 120 seconds for Krum with Strategy II.

These timings cover algorithmic and training work on an Intel i7-12700 system with an RTX 3090 GPU and 32 GB of RAM; they do not represent end-to-end network latency. Bandwidth, packet loss, queuing, synchronization and consensus-message exchange were not modeled. The authors also note that community numbers and boundaries were predefined, while real deployments may have variable sizes, communication systems, missing measurements, nonstationary loads and stronger imbalance.

Larger operational deployments and communication-aware studies are therefore needed before the framework’s scalability and resilience can be established outside controlled case studies.

Subject of Research: Evaluation of committee-based federated learning for detecting false data injection attacks in simulated energy-community distribution grids

Article Title: A novel resilient FDIA-aware federated learning framework for energy community-driven smart grids: A transformer-based committee consensus mechanism

Article References: Shabanian-Poodeh, M., Ameli, H., Kia, R., & Shafie-khah, M. (2026). A novel resilient FDIA-aware federated learning framework for energy community-driven smart grids: A transformer-based committee consensus mechanism. Results in Engineering, 32, Article 113556. https://doi.org/10.1016/j.rineng.2026.113556

Image Credits: AI Generated

DOI: 10.1016/j.rineng.2026.113556

Keywords: smart-grid security, federated learning, false data injection attacks, energy communities, Byzantine resilience, Transformers, state estimation, robust aggregation, distribution networks, decentralized learning, novel, resilient