Privacy Auditing of Lithium-Ion Battery Ageing Model by Recovering Time-Series Data Using Gradient Inversion Attack in Federated Learning
Source abstract
Abstract
The exchange of gradients is a widely used method in modelling systems for machine learning (e.g., distributed training, federated learning) in privacy-sensitive domains. Unfortunately, there are still privacy risks in federated learning, as servers can reconstruct clients‘ training data through gradient inversion attacks. To protect against such attacks, we need to know when and how privacy is being undermined, largely due to the black box nature of deep neural networks. Although gradient inversion has been used to classify images and text data, its use in time-series is still largely unexplored. In this paper, we empirically evaluate the practicality of recovering lithium-ion battery time-series data from the gradients of a transformer-based model, both without and with differential privacy, in a time-series federated learning framework. It is especially significant in the case of electric vehicles (EVs). As shown in this paper, additional protection by differential privacy leads to the saturation of gradient inversion attacks, i.e., the reconstructed signal maintains a certain error level, depending on the applied privacy budget level. With this empirical evaluation, we provide insights into effective gradient perturbation directions, unfairness with respect to privacy, and privacy-preferred model initialisation.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Privacy-Preserving Technologies in Data · Age of Information Optimization · IoT and Edge/Fog Computing
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Institute of Electronics and Computer Science, 14 Dzerbenes St., LV-1006 Riga, Latvia
Funding
Chips Joint Undertaking
References (60)
Show source-provided references
1. McMahan, H.B., Moore, E., Ramage, D., and Agüera y Arcas, B.A. (2017, January 20–22). Communication-Efficient Learning of Deep Networks from Decentralized Data. Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), Ft. Lauderdale, FL, USA.
2. Cheng, X., Li, C., and Liu, X. (2022, January 8–11). A Review of Federated Learning in Energy Systems. Proceedings of the 2022 IEEE/AIS Industrial and Commercial Power System Asia (ICPS Asia), Shanghai, China.10.1109/ICPSAsia55496.2022.9949863 ↗
3. A Review of Federated Learning in Renewable Energy Applications: Potential, challenges, and Future Directions10.1016/j.egyai.2024.100375 ↗
4. Namatevs, I., Sudars, K., Nikulins, A., and Ozols, K. (2025). Privacy Auditing in Differential Private Machine Learning: The Current Trends. Appl. Sci., 15.10.3390/app15020647 ↗
5. Li, M., Andersen, D.G., Park, J.W., Smola, A.J., Ahmed, A., Josifovski, V., Long, J., Shekita, E.J., and Su, B.-Y. (2014, January 6–8). Scaling Distributed Machine Learning with the Parameter Server. Proceedings of the 11th {USENIX} Symposium on Operating Systems Design and Implementation ({OSDI} 14), Broomfield, CO, USA.
6. A Contemporary Survey of Recent in Federated Leaning: Taxonomies, Applications, and Challenges10.1016/j.iot.2024.101251 ↗
7. Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H.B., Patel, S., Ramage, D., Segal, A., and Seth, K. (November, January 30). Practical Secure Aggregation for Federated Learning on User-Held Data. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communication Security (CCS’17), Dallas, TX, USA.
8. Model Aggregation Techniques in Federated Learning: A Comprehensive Survey10.1016/j.future.2023.09.008 ↗
9. Privacy Attacks Against Deep Learning Models and Their Countermeasures10.1016/j.sysarc.2020.101940 ↗
10. Tao, Z. (2022). Hierarchical Federated Learning with Gaussian Differential Privacy. AISS’22: Proceedings of the 4th International Conference on Advanced Information Science and System, ACM.
11. Stealing and Evading Malware Classifiers and Antivirus at Low False Positive Conditions10.1016/j.cose.2023.103192 ↗
12. Generative Image Reconstruction Gradients10.1109/TNNLS.2024.3383722 ↗
13. Feng, X., Ma, Z., Wang, Z., Chegne, E.J., Ma, M., Abuadbba, A., and Bai, G. (2024, January 14–18). Uncovering Gradient Inversion Risks in Practical Language Model Training. Proceedings of the CCS’24—2024 ACM SIGSAC Conference on Computers and Communication Security, Salt Lake City, UT, USA.10.1145/3658644.3690292 ↗
14. Local Perturbation-based Black-box Federated Learning Attack for Time Series Classification10.1016/j.future.2024.04.048 ↗
15. Small Perturbations are Enough: Adversarial attacks on Time Series Prediction10.1016/j.ins.2021.11.007 ↗
16. Dinev, A. (2024). Evaluation of Advances in Battery Health Prediction for Electric Vehicles from Traditional Linear Filters to Least Machine Learning Approaches. Batteries, 10.10.3390/batteries10100356 ↗
17. Collaborative Training of Deep Neural Networks for the Lithium-ion Battery Aging Prediction with Federated Learning10.1016/j.etran.2023.100294 ↗
18. Ali, M.A., Da Silva, C.M., and Amon, C.H. (2023). Multiscale Modelling Methodologies of Lithium-Ion Battery Aging: A Review of Most Recent Developments. Batteries, 9.10.3390/batteries9090434 ↗
19. Hatamizadeh, A., Yin, H., Roth, H., Li, W., Kautz, J., Xu, D., and Molchanov, P. (2022, January 19–24). GradViT: Gradient Inversion of Vision Transformers. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), New Oreleans, LA, USA.10.1109/CVPR52688.2022.00978 ↗
20. Moshawrab, M., Adda, M., Bouzouane, A., Ibrahim, H., and Raad, A. (2023). Reviewing Federated Learning Aggregation Algorithms; Strategies, Contributions, Limitations and Future Perspectives. Electronics, 12.10.3390/electronics12102287 ↗
21. Overman, T., and Klabjan, D. (2025). Continuous-Time Analysis in Federated Averaging. arXiv.
22. Liu, W., Zhang, X., Duan, J., Joe-Wong, C., Zhou, Z., and Chen, X. (2023, January 17–20). Federated Learning at the Edge: An Interplay of Mini-Batch Size and Aggregation Frequency. Proceedings of the IEEE INFOCOM–2023 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Hoboken, NJ, USA.10.1109/INFOCOMWKSHPS57453.2023.10226109 ↗
23. Khalilian Gourtani, S., Tsouvalas, V., Ozcelebi, T., and Meratania, N. (2024, January 7–13). FedCode: Communication-Efficient Federated Learning via Transferring Codebook. Proceedings of the 2024 IEEE International Conference on Edge Computing and Communication (IEEE EDGE 2024), San Francisco, CA, USA.10.1109/EDGE62653.2024.00022 ↗
24. Li, X., Huang, K., Yang, W., Wang, S., and Zhang, Z. (2020, January 26–30). On the Convergence of FedAvg on Non-IID Data. Proceedings of the 8th International Conference on Learning Representations (ICLR 2020), OpenReview.net, Virtual Event.
25. Ceballos, C., and Torres, H. (2022, January 19–22). AGIC: Approximate Gradient Inversion Attack on Federated Learning. Proceedings of the 41st International Symposium on Reliable Distributed Systems (SRDS 2022), Vienna, Austria.
26. Liu, Q., Liu, X., Liu, C., Wen, Q., and Liang, Y. (2024). TIME-FFM: Towards LM-Empowered Federated Foundation Model for Time Series Forecasting. Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Curran Associates, Inc.
27. A Federated Large Language Model for Long-Term Time Series Forecasting
28. Chen, S., Long, G., Jiang, J., and Zhang, C. (2024). Federated Foundation Models on Heterogeneous Time Series. arXiv.
29. Yu, C., Shen, S., Wang, S., Zhang, K., and Zhao, H. (2024). Communication-Efficient Hybrid Federated Learning for E-health with Horizontal and Vertical Data Partitioning. arXiv.
30. Zhu, L., Liu, Z., and Han, S. (2019). Deep Leakage from Gradients. Advances in Neural Information Processing Systems, 32 (NeurIPS 2019), Curran Associates, Inc.
31. Melis, L., Song, C., De Cristofaro, E., and Shmatikov, V. (2019, January 19–23). Exploiting Unintended Feature Leakage in Collaborative Learning. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP.2019.00029 ↗
32. Wang, Z., Song, M., Zhang, Z., Song, Y., Wang, Q., and Qi, H. (May, January 29). Beyond Inferring Class Representatives: User-level Privacy Leakage from Federated Learning. Proceedings of the IEEE INFOCOM 2019-IEEE Conference on Computer Communications, Paris, France.10.1109/INFOCOM.2019.8737416 ↗
33. Zheng, L., Cao, Y., Jiang, R., Taura, K., Shen, Y., Li, S., and Yoshikawa, M. (May, January 30). Enhancing Privacy of Spatiotemporal Federated Learning against Gradient Inversion Attacks. Proceedings of the 2023 ACM Web Conference (WWW 2023), Austin, TX, USA.
34. Li, B., Gu, H., Chen, R., Li, J., Wu, C., Ruan, N., Si, X., and Fan, L. (2023). Temporal Gradient Inversion Attacks with Robust Optimization. arXiv.
35. Zhang, R., Gou, S., Wang, J., Xie, X., and Tao, D. (2022, January 23–29). A Survey on Gradient Inversion Attacks, Defense and Future Directions. Proceedings of the 31st Joint Conference on Artificial Intelligence (IJCAI-22), Messe Wien, Vienna. Available online: https://www.ijcai.org/proceedings/2022/0791.pdf.
36. Wu, R., Chen, X., Guo, C., and Weinberger, K.Q. (August, January 31). Learning to Invert: Simple Adaptive Attacks for Gradient Inversion in Federated Learning. Proceedings of the 39th Conference on Uncertainty in Artificial Intelligence (UAI 2023), PMLR, Pittsburgh, PA, USA.
37. Ranzato, M.A., Beygelzimer, A., Dauphin, Y., Liang, P.S., and Wortman Vaughan, J. (2021). Evaluating Gradient Inversion Attacks and Defenses in Federated Learning. Advances in Neural Information Processing Systems 34 (NeurIPS 2021), Currant Associates, Inc.
38. Zhao, B., Mopuri, K.R., and Bilen, H. (2020). idlg: Improved Deep Leakage from Gradients. arXiv.
39. Inverting Gradients–How easy is it to break privacy in federated learning?
40. Ranzato, M.A., Beygelzimer, A., Dauphin, Y., Liang, P.S., and Wortman Vaughan, J. (2021). Gradient Inversion with Generative Image Prior. Advances in Neural Information Processing Systems 34 (NeurIPS 2021), Currant Associates, Inc.
41. Fowl, L., Geiping, J., Czaja, W., Goldblum, M., and Goldstein, T. (2022, January 25–29). Robbing the End: Directly Obtaining Private Data in Federated Learning with Modified Models. Proceedings of the 10th International Conference on Learning Representations (ICLR 2022), OpenReview.net, Virtual Event.
42. Zhang, X., Li, M., Chang, X., Chen, J., Roy-Chowdhury, A.K., Suresh, A.T., and Oymak, S. (2023). FedYolo: Augmenting Federated Learning with Pretrained Transformers. arXiv.
43. Sun, G., Mendieta, M., Dutta, A., Li, X., and Chen, C. (2024). Towards Multi-modal Transformers in Federated Learning. arXiv.10.1007/978-3-031-72633-0_13 ↗
44. Gradient Leakage Attack Resilient Deep Learning10.1109/TIFS.2021.3139777 ↗
45. Gao, Y., Xie, Y., Deng, H., and Zhu, Z. (2025, January 19–24). Gradient Inversion Attack in Federated Learning: Exposing Text Data through Discrete Optimization. Proceedings of the 31st International Conference on Computation Linguistics (COLING 2025), Abu Dhabi, UAE.
46. Scheliga, D., Mäder, P., and Seeland, M. (2022, January 3–8). PRECODE–A Generic Model Extension to Prevent Deep Gradient Leakage. Proceedings of the 2022 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), Waikoloa, HI, USA.10.1109/WACV51458.2022.00366 ↗
47. Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., and Zhang, L. (2016, January 24–28). Deep Learning with Differential Privacy. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), Vienna, Austria.10.1145/2976749.2978318 ↗
48. Halevi, S., and Rabin, T. (2006). Calibrating Noise to Sensitivity in Private Data Analysis. Theory of Cryptography, Springer.
49. The Algorithmic Foundations Of Differential Privacy10.1561/0400000042 ↗
50. Cowan, E., Shoemate, M., and Pereira, M. (2024). Hands-On Differential Privacy, O’Reilly Media, Inc.
51. Balle, B., and Wang, Y.-X. (2018, January 10–15). Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoising. Proceedings of the 35th International Conference on Machine Learning (ICML), Stockholm, Sweden. Available online: https://proceedings.mlr.press/v80/balle18a/balle18a.pdf.
52. Li, X., Qin, B., Luo, Y., and Zheng, D. (2022). Differential Privacy Budget Allocation Algorithm Base on Out-of-Bag Estimation in Random Forest. Mathematics, 10.10.3390/math10224338 ↗
53. He, G., Plagemann, T., Benndorf, M., Goebel, V., and Koldehofe, B. (2023, January 3–7). Differential Privacy for Protecting Private Patterens in Data Streams. Proceedings of the 2023 39th International Conference on Data Engineering Workshop (ICDEW), Anaheim, CA, USA.
54. Bai, Y., Yang, G., Xiang, Y., and Wang, X. (2021). Generalized and Multiple-Queries-Oriented Privacy Budget Strategies in Differential Privacy via Convergent Series. Security and Communication Networks, Wiley.10.1155/2021/5564176 ↗
55. Wen, Q., Zhou, T., Zhang, C., Chen, W., Ma, Z., Yan, J., and Sun, L. (2023, January 19–25). Transformers in Time Series: A Survey. Proceedings of the 32nd International Conference on Artificial Intelligence (IJCAI-23), Macao, China.
56. Zerveas, G., Jayaraman, S., Patel, D., Bhamidipaty, A., and Eickhoff, C. (2021, January 14–18). A Transformer-based Framework for Multivariate Time Series Representation Learning. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD 2021), Virtual Event.10.1145/3447548.3467401 ↗
57. Wang, Y., Zhu, J., and Kang, R. (2023). DESTformer: A Transformer Based on Explicit Seasonal-Trends Decomposition for Long-Term Series Forecasting. Appl. Sci., 13.10.3390/app131810505 ↗
58. Lithium-ion Battery Aging Dataset Based on Electric Vehicle Real Driving Profiles10.1016/j.dib.2022.107995 ↗
59. Review of Recent Development of in Situ/Operando Characterization Techniques for Lithium Battery Research10.1002/adma.201806620 ↗
60. Statistical and Machine Learning-based Durability-Testing Strategies for Energy Storage10.1016/j.joule.2023.03.008 ↗