PaperlayerView exact revision on arXiv

Source-linked AI summary

HXAI: Hierarchical Privacy-Preserving Explainable AI in Distributed Energy Systems

Poushali Sengupta, Sabita Maharjan, Frank Eliassen, Yan Zhang

arXiv:2610.02504v1cs.AI

TL;DR

Grid operators need household-level demand insights, but detailed explanations can expose sensitive behavior and privacy noise can weaken their usefulness. HXAI keeps fine-grained explanations local and shares differentially private zonal summaries with query-aware privacy controls. Its findings emphasize preserving explanation structure, including feature identity and ranking, rather than numerical fidelity alone.

  • Problem

    Grid operators need fine-grained household demand explanations, but detailed XAI can reveal sensitive behavior and privacy noise can reduce explanation clarity.

    Source: §I · p. 1

  • Method

    HXAI generates appliance-level SHAP explanations locally and shares differentially private zonal summaries under query-aware privacy-budget control.

    Source: §I · pp. 1–2

  • Results

    HXAI preserves feature identity, ranking, and directional influence across privacy regimes, while centralized DP-SHAP often causes rank instability and sign inversions.

    Source: F. Discussion · p. 14

  • Takeaways & Limitations

    Under differential privacy, explainability depends on preserving semantic structure, not only numerical accuracy.

    Source: F. Discussion · p. 14

Abstract

from arXiv · show

Balancing electricity demand and supply is increasingly difficult due to the inherent intermittency of renewable power generation and the stochastic power consumption. Grid operators require fine-grained, decision-relevant insights into household energy consumption to manage peak loads and design responsive tariffs, but increased transparency at this level raises significant privacy concerns. Traditional methods for explainable AI (XAI) can reveal sensitive information, while standard privacy techniques often reduce the usefulness of explanations. To address this issue, we introduce HXAI, a hierarchical framework that preserves privacy while enabling reasonable explainable analysis for grid-level demand management. HXAI consists of two main components: (1) a local model that generates fine-grained explanations within a secure, private environment, and (2) a zonal model that aggregates these explanations to support grid-level analysis while enforcing privacy through flexible privacy-budget management. We explicitly limit cumulative privacy exposure under repeated operator queries and show that the proposed framework preserves decision-relevant information without compromising household privacy. Experiments on both simulated and real-world energy datasets demonstrate that HXAI provides useful insights for zonal load management while ensuring that appliance-level consumption remains local and is never transmitted to grid operators. Our results show that preserving the semantic structure of explanations, rather than minimizing numerical error, is the key to XAI under differential privacy. This framework provides a way to achieve both privacy and explainability in energy management.

I. INTRODUCTION

HXAI addresses the tension between appliance-level explainability and household privacy by keeping detailed explanations local and sharing differentially private zonal summaries. It positions this design against existing approaches that lack fine-grained, query-aware privacy controls or useful explanation structure.

II. RELATED WORK

  • Existing energy-system XAI can expose household behavior, while privacy methods may obscure appliance-level signals or lack repeated-query privacy controls.The paper identifies a need for fine-grained explanations, useful zonal summaries under noise, and explicit control of cumulative leakage.Source: §I · p. 1, §II · pp. 2–3

I. INTRODUCTION

  • The framework combines semantic stability—preserving feature identity, sign, dominance, and rank ordering—with query-aware accounting that limits cumulative privacy leakage.An Information Control Agreement governs permitted queries, output granularity, and cumulative privacy budgets.Source: §I · pp. 1–2
  • HXAI keeps household-specific, noise-free appliance explanations local while sharing only differentially private explanation summaries for zonal analysis.It treats explanations—not model parameters, gradients, or predictions—as the objects to aggregate.Source: §I · p. 2

II. RELATED WORK

  • HXAI differs from federated learning by aggregating privacy-preserving explanations rather than training a shared model from gradients or parameters.The framework does not require model alignment, shared representations, or centralized optimization.Source: §I · p. 2, §II · p. 2
  • The related-work review frames HXAI as combining local appliance-level explainability, differentially private zonal explanations, dynamic budget negotiation, and cumulative leakage control.It identifies the joint provision of noise-free household reports and appliance-aware private zonal summaries as an unmet need.Source: §II · p. 3

III. SYSTEM MODEL AND THREAT MODEL

HXAI separates household-local processing from authorized query and zonal aggregation, with an Information Control Agreement governing what queries can run and their privacy costs. The system model assumes trusted enforcement components but keeps querying entities and the zonal aggregator outside household data access.

III. SYSTEM MODEL AND THREAT MODEL

A. System Entities and Trust Assumptions

  • Querying entities issue ICA-governed queries for zonal summaries or higher-cost appliance-level signals, but cannot access raw consumption data or noise-free local explanations.They are assumed honest-but-curious and may try to infer additional information from outputs.Source: A. System Entities and Trust Assumptions · p. 4
  • Households retain their raw data and noise-free explanations locally and set privacy constraints on released information.A household can also query local neighborhood or community summaries under the same authentication and privacy controls.Source: A. System Entities and Trust Assumptions · p. 4
  • An Information Control Agreement specifies permitted query types and scope, output granularity, validity, and a maximum cumulative privacy loss for a querying entity.Queries consume privacy budget according to granularity and potential information leakage; household constraints also apply, and specific queries cost more than general ones.Source: A. System Entities and Trust Assumptions · p. 4
  • The Private Data Box performs local inference, explanation generation, and household privacy enforcement, while the Zonal Aggregator handles only differentially private outputs.The Data Dealer approves ICAs but does not execute queries or process household data directly.Source: A. System Entities and Trust Assumptions · pp. 4–5

B. Trust Boundaries and Threat Model

HXAI confines raw household data and noise-free explanations to the Private Data Box, releasing only differentially private summaries beyond the household boundary. Its local SHAP explanations map heterogeneous appliance sets into a shared representation for zonal aggregation.

B. Trust Boundaries and Threat Model

  • Raw data and noise-free explanations remain inside trusted Private Data Boxes; only differentially private outputs leave the household boundary under the stated threat model.The model treats querying entities and aggregators as potentially curious, while attacks on hardware primitives and side-channel leakage are out of scope.Source: B. Trust Boundaries and Threat Model · p. 5

C. Data Model

  • Households use a common d-dimensional device-category space, representing appliances absent from a household with zeros so heterogeneous households can be aggregated without revealing device ownership.The local data are multivariate energy measurements over observed time points.Source: C. Data Model · p. 5
  • Local SHAP explanations represent each device’s model-weighted contribution to predicted consumption and remain noise-free inside the household’s Private Data Box.The contribution reflects the model’s assigned relevance, not raw usage alone.Source: C. Data Model · p. 5
  • SHAP explains how devices influence a prediction, unlike raw consumption measurements, and can distinguish a device’s predictive impact from its average energy use.The paper illustrates that a washing machine may receive a higher SHAP contribution than heating during peak-price hours despite lower average consumption.Source: C. Data Model · p. 5
  • The normalized additive explanation representation can be meaningfully aggregated across households, whereas raw consumption cannot be safely or meaningfully aggregated for explainability without exposing behavioral patterns.The workflow keeps local explanations noise-free and aggregates only differentially private summaries zonally.Source: Figure 1 · p. 5, C. Data Model · p. 6

D. Hierarchical Aggregation Model

HXAI keeps fine-grained household explanations local, shares differentially private summaries for zonal aggregation, and combines negotiated privacy budgets with a cap on cumulative query leakage.

D. Hierarchical Aggregation Model

  • HXAI keeps noise-free appliance explanations inside household environments and lets the zonal aggregator use only differentially private household summaries.Household-level explanations remain private; downstream analysis uses aggregated explanations.Source: D. Hierarchical Aggregation Model · p. 6, §IV · p. 7
  • Households may negotiate a privacy level that balances explanation utility and personal preferences, but participation is voluntary and cannot weaken their declared privacy limits.The objective is solved heuristically through bounded search and feedback; without agreement, the system defaults to stricter privacy and reduced explanatory utility.Source: D. Hierarchical Aggregation Model · p. 6, §IV · p. 7

E. Query Model

  • General queries aggregate zonal summaries at lower privacy cost, while specific appliance-level analyses incur higher cost and are denied once cumulative leakage reaches the negotiated threshold.The Private Data Box automatically denies further queries for the affected household at that threshold.Source: E. Query Model · p. 6, §IV · p. 8

IV. METHODOLOGY AND THEORETICAL FOUNDATIONS

  • HXAI’s additive model-weighted appliance contributions represent model attribution rather than raw energy use, making explanations composable for privacy-preserving aggregation.The explanations answer which appliances influenced predicted demand and by how much.Source: §IV · pp. 6–7
  • Aggregated differentially private household summaries are unbiased in expectation for true zonal SHAP, avoiding systematic distortion in zonal planning and diagnostic decisions.The summaries add zero-mean noise, while the reported mean absolute deviation bound characterizes error under the negotiated privacy budget.Source: §IV · p. 7
  • The mean absolute deviation bound depends on appliance count, summary sensitivity, and each household’s negotiated privacy budget; tighter budgets increase noise.The paper describes the bound as linear and predictable, supporting privacy–utility negotiation.Source: §IV · p. 7

V. EXPERIMENTAL EVALUATION AND RESULTS

The evaluation tests whether HXAI preserves explanation structure under differential privacy and separates controlled explanation-quality analyses from later end-to-end system evaluation.

V. EXPERIMENTAL EVALUATION AND RESULTS

  • The evaluation uses synthetic and real-world datasets under differential privacy to test whether HXAI maintains feature importance, consistency, and explainability.Primary results establish core claims, while supporting analyses examine explanation behavior under privacy.Source: §V · p. 8
  • The analyses assess deviation from non-private explanations, feature-ranking stability, and overall utility as privacy allocation strategies vary.Results are reported as means and standard deviations across multiple random seeds.Source: §V · pp. 8–9
  • These controlled, dataset-level analyses isolate explanation quality and semantic stability; the following section evaluates end-to-end insights, privacy negotiation, and decision-making.Source: §V · p. 9

A. Datasets

Three datasets represent homogeneous and heterogeneous attribution regimes, with different temporal resolutions and levels of feature-importance concentration.

A. Datasets

  • The UCI Appliances Energy Prediction dataset has 19,735 hourly residential energy observations and a consistent, redundant attribution structure.Source: A. Datasets · p. 9
  • The UCI Household Power dataset contains approximately 2 million minute-level electricity records and exhibits non-stationarity and diverse feature importance.Its varied attributions challenge uniform privacy allocation.Source: A. Datasets · p. 9
  • The UCI Bike Sharing (Hourly) dataset contains 17,379 hourly rental counts and 12 variables with moderate correlation.Together, the datasets contrast homogeneous with heterogeneous attribution regimes.Source: A. Datasets · p. 9

B. Models, Baselines, and Metrics

The study compares central DP-SHAP with two HXAI privacy-budget strategies using TreeSHAP explanations and metrics for error, ranking stability, and directional alignment.

B. Models, Baselines, and Metrics

  • Gradient-boosted tree regressors use lagged time-series data, and TreeSHAP supplies exact Shapley attributions against a non-private reference.The consistent model architectures support comparisons across datasets.Source: B. Models, Baselines, and Metrics · p. 9
  • The comparison includes central DP-SHAP with Laplace noise, HXAI with a fixed privacy budget, and HXAI with negotiated budgets adapted to user preferences and attribution mass.The negotiated strategy allocates higher privacy budgets to more important features while respecting an overall constraint.Source: B. Models, Baselines, and Metrics · p. 9
  • Mean Absolute Error measures deviation from the non-private oracle, Spearman Rank Correlation measures feature-order stability, and Cosine Similarity measures directional alignment.Metrics are evaluated over privacy budgets ε ∈ [0.1, 20], spanning strict and relaxed regimes.Source: B. Models, Baselines, and Metrics · p. 9

1) Quantitative Results

Across datasets, HXAI preserves explanation quality as privacy budgets increase, with allocation strategy depending on attribution heterogeneity. Qualitative results show that zonal HXAI better preserves feature identity, ordering, and direction than local or centralized DP explanations.

1) Quantitative Results

  • HXAI variants outperform Central DP-SHAP across datasets; uniform allocation works best in homogeneous settings, while negotiated allocation excels in heterogeneous ones.For UCI Appliances and UCI Bike Sharing, uniform allocation consistently outperforms negotiated allocation across metrics; for UCI Household Power, negotiated budgets perform better, particularly at ϵ ≤2.Source: Table III · p. 9, 1) Quantitative Results · p. 9

2) Qualitative Robustness Analysis

  • Zonal HXAI preserves dominant features’ identity, ordering, and direction under privacy noise, whereas local-DP explanations show sign instability and fluctuating rankings.The comparisons include oracle, local-DP, and zonal-DP SHAP explanations at moderate privacy.Source: Figure 3 · p. 10, 2) Qualitative Robustness Analysis · p. 10
  • HXAI’s key criterion is semantic stability—preserving feature identity, relative ranking, and directional influence—rather than precise numerical values.The results identify semantic stability, not numerical precision, as the key criterion for explainable explanations under privacy.Source: 2) Qualitative Robustness Analysis · pp. 10–11
  • Across HXAI rank-flow trajectories, top features remain near their ranks as noise increases, with negotiated allocation especially stable for heterogeneous Household Power attributions.Uniform allocation shows only minor rank fluctuations and is adequate in homogeneous settings.Source: 2) Qualitative Robustness Analysis · p. 10, Figure 4 · p. 11
  • On UCI Appliances, Central DP-SHAP has unstable, crossing rank trajectories, while HXAI maintains near-diagonal, stable rankings.The comparison is reported even in a homogeneous attribution regime.Source: Figure 5 · p. 11

VI. SYSTEM-LEVEL EXPERIMENTAL EVALUATION

System-level experiments examine HXAI across households, zones, and energy providers under differential privacy, using controlled conditions to assess local insights and zonal utility. Local SHAP explanations reveal appliance influence on predictions that raw consumption alone does not show.

VI. SYSTEM-LEVEL EXPERIMENTAL EVALUATION

  • The system-level evaluation demonstrates end-to-end behavior under controlled conditions, not field-deployed validation.Real DSO deployments may affect parameter calibration through data volume, regulatory constraints, and heterogeneous household participation.Source: §VI · p. 11

A. Experimental Setup

  • Experiments use simulated data from 50 households, seven IoT appliances, and 100 time points to isolate privacy-budget negotiation and intervention feedback loops.The setup focuses on decision support and explainability within formal privacy guarantees.Source: A. Experimental Setup · p. 12

1) Local (End) Level Analysis

  • Local SHAP explanations quantify how appliances influence predicted demand, distinguishing peak-driving appliances from devices that consume energy without strongly affecting predictions.In the household example, washing-machine influence varies with usage timing, cycle duration, and interactions; this can support off-peak rescheduling even when it is not the largest energy consumer.Source: 1) Local (End) Level Analysis · p. 12

2) Zonal (Edge) Level Analysis

At the zonal level, HXAI aggregates local explanations and applies differential privacy while retaining useful demand patterns and appliance importance. The section also describes household-driven privacy-budget negotiation, simulated appliance-upgrade interventions, and query-specific privacy costs.

2) Zonal (Edge) Level Analysis

  • Despite Laplace noise, zonal aggregation retains overall consumption patterns, peak-demand signals, and the relative importance of key appliances such as washing machines.The reports preserve semantic stability while allowing providers to identify actionable patterns without exposing household confidentiality.Source: 2) Zonal (Edge) Level Analysis · pp. 12–13

C. Privacy-Utility Trade-off and Budget Negotiation

  • At a negotiated ϵ = 6.73, explanation utility stabilizes while household privacy remains acceptable, and dominant features, signs, and relative ordering are preserved.The compromise is voluntary and may depend on perceived benefits such as improved tariffs or discounts; households unwilling to relax privacy default to stricter, noisier or coarser explanations.Source: C. Privacy-Utility Trade-off and… · p. 13

D. Explainability-Driven Intervention and Grid Management

E. Query Mechanisms and Accumulated Privacy Leakage

1) General and specific queries.

  • Specific queries yield 83% explanation utility versus 67% for general queries, at increased privacy cost.Under the query-aware pricing mechanism, each query q incurs privacy cost ε(q).Source: 1) General and specific queries · p. 13

2) Multiple queries and cumulative privacy leakage.

Repeated-query accounting treats privacy as a household-specific resource, denying requests at the negotiated threshold. The discussion emphasizes semantic stability and hierarchical aggregation as alternatives to numerical fidelity alone.

2) Multiple queries and cumulative privacy leakage.

  • Specific appliance-level queries provide higher utility than general aggregate queries but consume more privacy budget.The comparison is between specific and general queries under differential privacy.Source: Figure 11 · p. 14
  • At the household-specific threshold (e.g., εmax_i = 6.73), HXAI denies further queries, preventing unbounded privacy erosion.The workflow tracks leakage over repeated queries until the negotiated budget is exhausted.Source: 2) Multiple queries and cumulative… · p. 14, Figure 12 · p. 14

F. Discussion

  • HXAI preserves feature identity, ranking, and directional influence across privacy regimes, while centralized DP-SHAP often causes rank instability and sign inversions.The discussion argues that explanation structure matters more than exact numerical values under privacy constraints.Source: F. Discussion · p. 14
  • Hierarchical aggregation supports stable, decision-relevant explanations alongside local interpretability, privacy-preserving aggregation, and bounded long-term leakage.The discussion also identifies adaptive privacy allocation and query-aware accounting as supports for practical long-term deployment.Source: F. Discussion · p. 14

G. Ethics and Reproducibility

  • The study uses only simulated or publicly available datasets and introduces no new data collection or personally identifiable information.Household data are described as private by design, with differential privacy bounding leakage under repeated queries.Source: G. Ethics and Reproducibility · p. 15

VII. CONCLUSION

  • The conclusion presents HXAI as separating local explanation from aggregation to protect household privacy while supporting grid management.It states that the framework preserves feature identity and importance across datasets and privacy levels, and supports dynamic privacy-budget negotiation.Source: §VII · p. 15
Loading 2610.02504v1…