Organizations: Mechanical and Industrial Engineering Louisiana State University Baton Rouge, LA 70803 · Department of Computer Science Missouri University of Science and Technology Missouri S&T, Rolla, MO 65409
Metal additive manufacturing (AM) enables the fabrication of safety-critical components, but reliable quality assurance depends on high-fidelity sensor streams containing proprietary process information, limiting collaborative data sharing. Existing defect-detection models typically treat melt-pool observations as independent samples, ignoring layer-wise physical couplings. Moreover, conventional privacy-preserving techniques, particularly Local Differential Privacy (LDP), lead to severe utility degradation because they inject uniform noise across all feature dimensions. To address these interrelated challenges, we propose FI-LDP-HGAT. This computational framework combines two methodological components: a stratified Hierarchical Graph Attention Network (HGAT) that captures spatial and thermal dependencies across scan tracks and deposited layers, and a feature-importance-aware anisotropic Gaussian mechanism (FI-LDP) for non-interactive feature privatization. Unlike isotropic LDP, FI-LDP redistributes the privacy budget across embedding coordinates using an encoder-derived importance prior, assigning lower noise to task-critical thermal signatures and higher noise to redundant dimensions while maintaining formal LDP guarantees. Experiments on a Directed Energy Deposition (DED) porosity dataset demonstrate that FI-LDP-HGAT achieves 81.5% utility recovery at a moderate privacy budget (epsilon = 4) and maintains defect recall of 0.762 under strict privacy (epsilon = 2), while outperforming classical ML, standard GNNs, and alternative privacy mechanisms, including DP-SGD across all evaluated metrics. Mechanistic analysis confirms a strong negative correlation (Spearman = -0.81) between feature importance and noise magnitude, providing interpretable evidence that the privacy-utility gains are driven by principled anisotropic allocation.
Figures & tables
Figure 1: Framework for utility-preserving private feature release. Structured multimodal records are encoded, privatized via importance-aware anisotropic LDP (FI-LDP), and processed through a stratified Hierarchical Graph Attention Network (HGAT) for defect prediction.
Method
Target
Privacy type
Formal
Main relevance / limitation
SIA+ASIG [ 5 ]
Raw images
Heuristic
No
De-identifies melt-pool images through stochastic augmentation and surrogate generation, but does not provide a formal privacy bound for learned embeddings.
MNP [ 21 ]
Model weights
(ϵ,δ) -DP
Yes
Perturbs model parameters during distributed training; protects the model rather than released feature representations.
Blockchain/Encryption [ 36 , 28 ]
Data in transit
Access control
No
Ensures integrity and secure transmission, but does not address statistical privacy or utility-aware feature perturbation.
Federated learning [ 42 , 54 ]
Training data
Varies
Optional
Avoids raw-data centralization, but requires iterative communication and is not designed for single-shot feature release.
FI-LDP (Proposed)
Feature embeddings
(ϵ,δ) -LDP
Yes
Applies importance-guided anisotropic noise to graph-ready feature embeddings, enabling formal privacy with downstream graph learning utility.
Table 1: Comparison of privacy-preserving methods relevant to manufacturing analytics. The table highlights the protection target, privacy mechanism, and the main limitation of each method relative to graph-ready feature release.
Figure 2: High-level overview of the utility-preserving private graph learning framework for in-situ porosity prediction. The pipeline integrates (i) porous-targeted data augmentation to address class imbalance, (ii) a supervised warmup phase for feature importance estimation, and (iii) importance-aware anisotropic Local Differential Privacy (FI-LDP) for secure feature release to a stratified Hierarchical Graph Attention Network (HGAT).
Symbol
Description
G=(V,E)
Layer-stratified process graph with nodes V and edges E .
vi
Node corresponding to a localized melt-pool observation.
ξi=(Ii,si,gi,yi)
Multimodal record: thermal patch, process-state features, geometric context, and label.
Geometric context (layer index and in-layer coordinates; optional part/toolpath attributes).
Table 2: Nomenclature. Key symbols used in the proposed FI-LDP-HGAT framework.
Figure 3: Porous-targeted augmentation operators used during training. The four transformations (A1)–(A4) are applied only to minority-class (porous) thermal frames to increase defect-signal diversity under severe class imbalance. The operators emulate sensor noise, intensity drift, mild registration errors, and interpolated defect signatures; validation and test splits remain unaugmented.
Figure 4: Multimodal feature extraction and fusion for node representation. Each node feature xi concatenates an image-derived embedding zi(img)=fθ(Ii) (thermal fingerprints) with a context embedding zi(ctx)=gϕ(si,gi) capturing process-state and geometric descriptors. This fused representation is used for warmup importance estimation and as the input to FI-LDP privatization in subsequent stages.
Figure 5: Graph construction pipeline for FI-LDP-HGAT. (a) Porous-targeted augmentation applies transformation operators F(⋅) to minority-class thermal patches to increase defect-signal diversity during training (Sec. 3.2 ). (b) Node and edge formation for the layer-stratified hybrid k NN graph: each node aggregates an image embedding from the thermal patch and a context vector of process/geometric features (Sec. 3.3 ). Within each physical layer, edges connect each node to its k nearest neighbors under the hybrid distance in Eq. ( 13 ), combining in-layer spatial proximity and thermal embedding similarity.
Figure 6: HGAT message passing with attention. Edge priors bias attention toward spatially/thermally consistent neighbors, while learned coefficients adaptively weight neighborhood contributions for node-level porosity inference.
Figure 7: Effect of isotropic vs. importance-guided local privatization on graph features. (a) Uniform-LDP (isotropic Gaussian noise). A single privacy budget is enforced by injecting the same noise scale into every feature coordinate, perturbing task-critical “thermal fingerprint” dimensions and redundant dimensions equally. This uniform corruption distorts the relative geometry of node embeddings and can weaken attention-based neighborhood aggregation. (b) FI-LDP (importance-guided anisotropic noise). The privacy budget is redistributed across coordinates using the warmup-derived importance prior q , assigning smaller noise to high-importance coordinates and larger noise to low-importance coordinates under the same (ϵ,δ) guarantee. This preserves task-relevant subspaces while maintaining local privacy for feature release.
Table 3: Non-private baseline comparison. All methods use the same data split. Feature columns indicate the input representation: Img = ResNet-18 image embedding; Multi = image + process-state + geometric context; Graph = layer-stratified k NN topology.
Table 4: Privacy-aware method comparison at fixed privacy budgets. All methods use the same HGAT backbone and graph topology for fair comparison. F1∗ denotes the test F1-score at a validation-optimized threshold.
Figure 8: Mechanism insight for FI-LDP at ϵ=2.0 : importance-guided anisotropic perturbation. (a) Normalized importance scores (sorted) show that predictive utility is concentrated in a small subset of embedding coordinates. (b) Allocated Gaussian noise scale σj per coordinate: Uniform-LDP applies a constant σ , whereas FI-LDP assigns smaller σj to high-importance coordinates and larger σj to low-importance ones under the same privacy budget. (c) Utility–noise coupling: scatter of importance vs. allocated σj with a fitted trend, showing a strong negative monotonic association (Spearman ρ=−0.81 ), i.e., FI-LDP perturbs informative coordinates less aggressively.
Figure 9: Privacy–utility frontier for FI-LDP and Uniform-LDP. Metrics are reported across ϵ∈[0.5,8.0] under a fixed protocol (same split; seed-averaged runs). (a) AUC and (b) AUPR summarize threshold-free ranking quality. (c) [email protected], (d) [email protected], and (e) [email protected] are computed at the default decision threshold t=0.5 . (f) F1∗ is evaluated at a validation-optimised threshold t∗ , representing the best calibrated operating point. FI-LDP exhibits a higher utility ceiling in the moderate-privacy regime ( ϵ≈2 – 4 ), while both methods converge at larger budgets as privacy-induced distortion diminishes.
ϵ
AUC
AUPR
F1 ( t=0.5 )
F1 ∗ (tuned)
Recovery %
0.5
0.792
0.302
0.361
0.440
46.7%
1.0
0.826
0.429
0.490
0.537
57.0%
2.0
0.913
0.664
0.647
0.685
72.8%
4.0
0.936
0.751
0.677
0.767
81.5%
8.0
0.943
0.766
0.776
0.801
85.1%
Table 5: FI-LDP utility scaling across privacy budgets. Recovery % is computed relative to F1oracle∗=0.941 .
Configuration
Oversampling
AUC
AUPR
Recall
Full Framework
True
0.913
0.664
0.762
w/o Oversampling
False
0.165
0.036
0.125
w/o Anisotropy ( β=0 )
True
0.884
0.621
0.711
Thermal-only Graph ( α=0 )
True
0.666
0.638
0.650
Table 6: Ablation study of framework components at ϵ=2.0 .
Category
Parameter
Value
Data / Protocol
Train/Val/Test split
0.6 / 0.2 / 0.2
Seed-averaged evaluation (runs)
5
Decision threshold(s)
t=0.5 ; t∗ tuned on val
Graph Construction
Node feature dimension ( d )
64
Connectivity mixing coefficient ( α )
main; α=0 (ablation)
Stratified grouping (layer-wise)
enabled
Table 7: Reproducibility checklist and key hyperparameters for FI-LDP-HGAT.
While Local Differential Privacy (LDP) serves as a foundational primitive for distributed data collection, its stringent randomization requirements often lead to severe degradation in data representation utility. This degradation stems from the task-agnostic nature of conventional LDP mechanisms, which perturb all dimensions without accounting for their relative importance to the downstream objective. To address this issue, we propose a novel approach that mitigates noise in task-relevant subspaces of the data representation. Our method identifies task-critical subspaces via the Jacobian of a public downstream model, selectively attenuates noise along these directions, and reshapes the isotropic noise of standard LDP mechanisms into an anisotropic distribution. The resulting mechanism preserves the privacy guarantee of the underlying LDP randomizer while heterogeneously modulating the impact of noise across task directions, thereby substantially enhancing data utility. The approach is applicable to both linear and nonlinear models and can be seamlessly integrated with existing LDP mechanisms. Extensive experiments on CIFAR-10-C under brightness corruption at the highest severity level demonstrate that integrating our approach improves classification accuracy by approximately 8 percentage points for Laplace and 20 percentage points for PrivUnit variants at ε=7.5. The source code is available at https://github.com/ymha/jacobian-anr-ldp.
Youngmok Ha, Viktor Schlegel, Yidan Sun +1
Department of Bioengineering, Imperial College London, United Kingdom · Artificial Intelligence Computing Research Laboratory, Electronics and Telecommunications Research Institute (ETRI), Daejeon, Republic of Korea · Imperial Global Singapore, Imperial College London, Singapore +1
Device-free localization trains models from heterogeneous wireless and visual sensors (e.g., Wi-Fi, LiDAR) distributed across edge devices. Federated learning offers a privacy-respecting framework, but is brittle when clients differ in sensor modality and resolution, when their data distributions drift, and when privacy noise destroys the structural signal needed for localization. We propose UMEDA, a graph federated learning framework in which clients form nodes of a global graph that share a continuous integral operator, and aggregation is reformulated as spectral signal processing on this operator. Each client encodes its local sensors with a linear-attention layer whose kernel spectrum is low-rank filtered, suppressing modality-specific residuals so clients with different sensors align in a common low-rank subspace. The server then aggregates client updates via a diffusion model over the kernel's spectral coefficients, treating updates as discretizations of a shared operator rather than topology-bound weights -- this absorbs varying graph sizes and missing modalities without node-wise correspondence. To balance privacy and utility, we add an anisotropic differential-privacy mechanism that projects noise preferentially into the null space of the signal subspace, preserving dominant eigendirections while ensuring formal (ε,δ)-DP under gradient clipping. On MM-Fi and the RELI11D out-of-distribution benchmark, UMEDA outperforms state-of-the-art federated baselines in accuracy, convergence, and communication efficiency, particularly under high modality heterogeneity and tight privacy budgets.
This article presents DDP-SA, a scalable privacy-preserving federated learning framework that jointly leverages client-side local differential privacy (LDP) and full-threshold additive secret sharing (ASS) for secure aggregation. Unlike existing methods that rely solely on differential privacy or on secure multi-party computation (MPC), DDP-SA integrates both techniques to deliver stronger end-to-end privacy guarantees while remaining computationally practical. The framework introduces a two-stage protection mechanism: clients first perturb their local gradients with calibrated Laplace noise, then decompose the noisy gradients into additive secret shares that are distributed across multiple intermediate servers. This design ensures that (i) no single compromised server or communication channel can reveal any information about individual client updates, and (ii) the parameter server reconstructs only the aggregated noisy gradient, never any client-specific contribution. Extensive experiments show that DDP-SA achieves substantially higher model accuracy than standalone LDP while providing stronger privacy protection than MPC-only approaches. The proposed framework scales linearly with the number of participants and offers a practical, privacy-preserving solution for federated learning applications with controllable computational and communication overhead.