The Privacy-Preserving AI That Accurately Predicts Where Electric Vehicles Will Plug In

Electric vehicles are rapidly transforming our highways, but they bring a quiet operational headache for the power grid: when millions of drivers plug in simultaneously, local substations experience violent, unpredictable spikes in electricity demand. Predicting these volatile charging patterns is notoriously difficult because raw energy data mixes long-term behavioral routines with sudden, chaotic surges. Worse yet, collecting smart meter and charging station data to train forecasting models creates a major privacy nightmare, exposing driver routines, work hours, and home locations to whoever runs the server.

Standard federated learning — a decentralized machine learning technique where devices collaboratively train a model by sharing only model updates rather than raw data — offers a partial fix. But recent security research has shown that an honest-but-curious server can easily reverse-engineer those shared updates, using gradient inversion attacks to reconstruct private charging logs down to the individual kilowatt.

A team of researchers from Tennessee Technological University and the University of Ottawa has developed a new framework called SecFD-FL (Frequency-Decoupled Federated Learning with Secure Aggregation) that solves both problems at once (Rashid et al., 2026). By decomposing electrical load signals into separate frequency bands and wrapping model updates in cryptographic zero-sum masks, SecFD-FL slashes forecasting error by up to 60% compared to centralized baselines while rendering gradient inversion attacks completely ineffective.

The Science

To build a forecasting model that is both hyper-accurate and cryptographically secure, the researchers designed a two-part architecture that separates signal processing from decentralized training.

First, to handle the wild volatility of electric vehicle charging, the framework applies a sophisticated signal processing technique known as Complete Ensemble Empirical Mode Decomposition with Adaptive Noise (CEEMDAN). Instead of feeding raw, noisy load curves into a neural network, CEEMDAN breaks down each client's time-series data into a set of simpler oscillatory components called Intrinsic Mode Functions (IMFs). Through this decomposition, the researchers observed that EV charging loads naturally split into two distinct streams: a high-frequency residual band representing transient charging spikes and erratic usage, and a low-frequency trend band capturing seasonal and daily behavioral regularities (Rashid et al., 2026).

These two streams are routed through a parameter-disjoint, dual-stream Gated Recurrent Unit (GRU) network

. Because the residual and trend streams capture fundamentally different physical phenomena, applying a one-size-fits-all aggregation rule fails. The researchers therefore implemented a stream-specific aggregation policy: data-proportional weights for the volatile residual stream combined with a momentum-like local-retention parameter to prevent transient spikes from getting washed out, and a spectral-similarity graph based on Fast Fourier Transform (FFT) signatures for the smooth trend stream.

Second, to protect against privacy leakage, the framework integrates a lightweight secure aggregation layer. In standard federated learning, an adversary can mount a Deep Leakage from Gradients (DLG) attack, mathematically inverting observed model updates to recreate the exact training samples that produced them. SecFD-FL neutralizes this threat using a zero-sum additive masking protocol. Before uploading its model update, each client perturbs its parameters with high-variance pseudorandom noise generated via shared pairwise secrets. Because every pairwise mask is applied with opposite signs between clients, all masks cancel out exactly when the server sums the contributions across the entire federation. The server receives the exact aggregate needed to update the global model, but individual updates remain buried under mountains of cryptographic noise.

The researchers evaluated SecFD-FL using two real-world datasets: a user-level dataset (EV WATTS) and a station-level dataset (Palo Alto charging records), benchmarking their approach against six representative federated and centralized baselines.

What They Found

The performance improvements delivered by SecFD-FL span three critical dimensions: raw forecasting accuracy, client fairness, and cryptographic privacy.

When evaluated on the EV WATTS test set, SecFD-FL achieved a global coefficient of determination ($R^2$) of $0.927$, outperforming all competing federated architectures

Forecasting Accuracy (Global R2) on EV WATTS Data

Label	Value
SecFD-FL (Ours)	0.927 R2
FedAdam	0.881 R2
FedProx	0.854 R2
SCAFFOLD	0.839 R2
FedAvg	0.812 R2

Source: Rashid et al., 2026

. On the more erratic Palo Alto charging station dataset, the framework secured an $R^2$ of $0.847$. Measured in terms of root mean squared error (RMSE), SecFD-FL reduced forecasting error by up to 60% over standard centralized deep learning baselines, proving that frequency decoupling is essential for capturing multi-scale charging dynamics.

Forecasting Accuracy (Global R2) on EV WATTS Data

Label	Value
SecFD-FL (Ours)	0.927 R2
FedAdam	0.881 R2
FedProx	0.854 R2
SCAFFOLD	0.839 R2
FedAvg	0.812 R2

Source: Rashid et al., 2026

Fairness across participating clients is a persistent challenge in federated learning, where models often overfit to data-rich stations while starving rural or low-volume chargers. Using Jain's fairness index — a standard economic metric where 1.0 represents absolute egalitarian resource allocation — SecFD-FL achieved a fairness score of up to $0.991$ across participating clients, ensuring equitable prediction quality regardless of local station size.

The security evaluation against DLG gradient inversion attacks demonstrated the profound efficacy of the zero-sum masking layer

. Without secure aggregation, an attacker could successfully reconstruct private charging curves with high fidelity. With SecFD-FL's zero-sum additive masking enabled, the Pearson correlation between the attacker's reconstructed sequence and the true private data plummeted by 8.1 to 15.6 times. Crucially, this cryptographic-grade privacy guarantee comes with zero additional per-round communication overhead beyond a one-time initial key exchange.

Defense Against DLG Gradient Inversion Attacks

Label	Value
FedAvg (No SecAgg)	0.89 Correlation
SecFD-FL (With SecAgg)	0.07 Correlation

Source: Rashid et al., 2026

Why This Changes Things

As vehicle electrification accelerates toward a projected global stock of over 250 million electric vehicles by 2030, charging infrastructure is transitioning from a fringe amenity to critical national infrastructure (Rashid et al., 2026). Grid operators face an unprecedented coordination challenge: managing local transformer loads, avoiding brownouts, and planning strategic fast-charging station deployment without violating driver privacy.

Historically, grid optimization demanded a Faustian bargain: either surrender granular location and behavioral data to centralized utilities to maintain grid stability, or protect privacy at the cost of poor forecasting accuracy and overloaded local transformers. SecFD-FL demonstrates that this trade-off is false. By cleanly separating multi-scale temporal frequencies and embedding zero-sum cryptographic masks into the aggregation loop, the framework proves that decentralized networks can achieve superior predictive intelligence without ever exposing a single driver's charging habits.

Furthermore, because the secure aggregation protocol imposes no iterative communication penalty, the approach is highly practical for resource-constrained Internet of Things (IoT) deployments, ranging from individual smart chargers to sprawling metropolitan charging station networks.

What's Next

While SecFD-FL marks a major leap forward for smart grid intelligence, several open questions remain for future deployment. The current framework assumes synchronous federated training rounds, which can create straggler bottlenecks if geographically distributed charging stations experience network latency or hardware dropouts. Extending the frequency-decoupled architecture to asynchronous federated settings will be essential for real-world grid integration.

Additionally, while the zero-sum masking protocol successfully defends against honest-but-curious servers, robust defenses against malicious Byzantine clients — nodes that deliberately inject corrupted updates to poison the global model — represent an important next frontier. As charging networks evolve into fully autonomous edge-cloud ecosystems, frameworks like SecFD-FL provide the indispensable cryptographic and algorithmic bedrock for a clean, private, and resilient electrified future.