Federated learning brings privacy-first anomaly detection to smart grids

Smart grids promise a cleaner, more responsive electricity system, but they also carry a hidden vulnerability: every smart meter is a potential target for electricity thieves and cyber intruders. As utilities digitize their networks, the volume of consumption data flowing into centralized servers has exploded, and so has the attack surface. Now, a team of researchers at Setif 1 University Ferhat Abbas in Algeria has unveiled a federated learning architecture that detects anomalies across distributed smart grid nodes while keeping raw consumption data locked away at the edge. The framework, called FED-XID, was published in Cluster Computing and offers a rare combination of privacy preservation, competitive detection accuracy, and lightweight deployability on resource-constrained hardware.

The core problem the researchers set out to solve is a tension familiar to anyone working in critical infrastructure cybersecurity. Traditional anomaly detection systems for electricity theft and intrusion detection rely on centralized training, where consumption records from thousands of households are pooled into a single server. That approach gives the detection model a broad view of user behavior, but it also concentrates sensitive personal data in one place, creating a honeypot for attackers and raising serious privacy concerns. FED-XID flips this model on its head by using federated learning, a training paradigm in which the model travels to the data rather than the other way around. Each edge node trains a local detection model on its own consumption records, and only compact model structures are shared upstream for aggregation.

FED-XID introduces three technical innovations that distinguish it from earlier federated anomaly detection frameworks. The first is an embedded, lightweight intrusion detection system based on XGBoost, a gradient-boosted decision tree algorithm prized for its accuracy and computational efficiency. XGBoost builds an ensemble of decision trees sequentially, with each new tree correcting the errors of the previous ones, making it well suited to edge deployment where memory and processing power are limited. The second innovation is FedXgbBagging, a novel tree-level aggregation strategy that combines local models through tree concatenation rather than averaging model parameters. Instead of blending the numerical weights of different local models, the aggregation server stitches together the actual decision trees learned by each node, producing a global ensemble that reflects the collective knowledge of the entire network.

The third innovation addresses a subtle but critical weakness in federated pipelines: data quality. Smart meter data is notoriously messy, with missing readings, sensor faults, and temporal inconsistencies that can degrade model training. FED-XID integrates a hybrid TCN-LSTM module directly into the federated pipeline to perform local data reconstruction before training begins. Temporal convolutional networks excel at capturing short-range patterns in time series through parallelizable convolutional operations, while long short-term memory networks handle long-range dependencies through gated memory cells. By combining both architectures, the module reconstructs missing or corrupted consumption data, ensuring that the federated models learn from high-quality, temporally consistent records rather than noisy raw input.

To evaluate the framework, the researchers trained FED-XID on the SGCC dataset, a widely used benchmark containing consumption records from 42,372 smart grid users. The results are striking. FED-XID achieved an area under the ROC curve of 93.60 percent and an F1-score of 88.80 percent, metrics that measure how well the system distinguishes genuine anomalies from normal behavior. For comparison, a centralized XGBoost baseline trained on the same data reached 98.10 percent AUC and 92.65 percent F1-score. The gap between federated and centralized performance is modest, and the researchers argue that the trade-off is justified by the significant reduction in privacy exposure. Rather than sharing raw consumption data, FED-XID transmits only compact tree structures upstream, keeping sensitive user records local.

Speed is another area where FED-XID shines. Training cycles complete in under 26 seconds, a figure that matters enormously for real-world deployment on smart grid edge nodes. These devices are typically resource-constrained microcontrollers or single-board computers with limited memory and processing power, and any detection system that requires minutes or hours of training per cycle would be impractical to operate. The sub-26-second training time means the federated pipeline can run continuously, updating the global detection model as new consumption data arrives without overwhelming the hardware. This makes FED-XID a scalable, lightweight, and deployable solution for anomaly detection in environments where computational resources are scarce.

The implications for smart grid security are significant. Electricity theft costs utilities billions of dollars annually, and cyber intrusions into grid infrastructure pose risks that extend beyond financial losses to public safety and national security. As grids incorporate more distributed energy resources, electric vehicle charging stations, and Internet of Things devices, the volume of consumption data and the number of potential entry points for attackers will only grow. FED-XID demonstrates that it is possible to detect these threats across a distributed network without concentrating sensitive data in a single server, offering utilities a path toward stronger security that respects user privacy by design.

The research also contributes to a broader conversation about federated learning in critical infrastructure. Earlier federated anomaly detection frameworks have struggled with non-IID data, where consumption patterns differ dramatically across nodes, and with the computational overhead of training deep neural networks on edge hardware. FED-XID sidesteps some of these challenges by using gradient-boosted trees rather than deep networks for the core detection task, and by handling data quality issues locally through the TCN-LSTM reconstruction module. The tree-level aggregation strategy preserves the interpretability of the underlying models, since decision trees can be inspected and audited more easily than the opaque weight matrices of neural networks.

Looking ahead, the researchers suggest that FED-XID could serve as a foundation for more sophisticated federated security systems in smart grids and beyond. The combination of lightweight edge detection, tree-level aggregation, and local data reconstruction could be adapted to other domains where privacy and computational constraints collide, from industrial control systems to healthcare networks. As the digital transformation of critical infrastructure accelerates, frameworks like FED-XID point toward a future where security and privacy are not competing priorities but complementary design principles, built into the very architecture of the systems that keep the lights on.

Subject of Research: Federated learning brings privacy-first anomaly detection to smart grids

Article Title: FED-XID: a novel federated learning based architecture for distributed anomaly detection in smart grids

Article References: Goudjil, L., Nasri, K., Talhi, C., & Dehli, N. (2026). FED-XID: a novel federated learning based architecture for distributed anomaly detection in smart grids. Cluster Computing, 29(15), Article 866. https://doi.org/10.1007/s10586-026-06677-7

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06677-7

Keywords: federated learning, smart grids, anomaly detection, XGBoost, privacy, cybersecurity, edge computing, electricity theft, machine learning, TCN-LSTM, FED-XID, novel