Feature-Aware Anisotropic Local Differential Privacy for Utility-Preserving Graph Representation Learning in Metal Additive Manufacturing

MD Shafikul Islam; Mahathir Mohammad Bappy; Saifur Rahman Tushar; Md Arifuzzaman

cs.LGApr 6, 2026

Feature-Aware Anisotropic Local Differential Privacy for Utility-Preserving Graph Representation Learning in Metal Additive Manufacturing

Authors: MD Shafikul Islam, Mahathir Mohammad Bappy, Saifur Rahman Tushar, Md Arifuzzaman

Organizations: Mechanical and Industrial Engineering Louisiana State University Baton Rouge, LA 70803 · Department of Computer Science Missouri University of Science and Technology Missouri S&T, Rolla, MO 65409

Abstract

Metal additive manufacturing (AM) enables the fabrication of safety-critical components, but reliable quality assurance depends on high-fidelity sensor streams containing proprietary process information, limiting collaborative data sharing. Existing defect-detection models typically treat melt-pool observations as independent samples, ignoring layer-wise physical couplings. Moreover, conventional privacy-preserving techniques, particularly Local Differential Privacy (LDP), lead to severe utility degradation because they inject uniform noise across all feature dimensions. To address these interrelated challenges, we propose FI-LDP-HGAT. This computational framework combines two methodological components: a stratified Hierarchical Graph Attention Network (HGAT) that captures spatial and thermal dependencies across scan tracks and deposited layers, and a feature-importance-aware anisotropic Gaussian mechanism (FI-LDP) for non-interactive feature privatization. Unlike isotropic LDP, FI-LDP redistributes the privacy budget across embedding coordinates using an encoder-derived importance prior, assigning lower noise to task-critical thermal signatures and higher noise to redundant dimensions while maintaining formal LDP guarantees. Experiments on a Directed Energy Deposition (DED) porosity dataset demonstrate that FI-LDP-HGAT achieves 81.5% utility recovery at a moderate privacy budget (epsilon = 4) and maintains defect recall of 0.762 under strict privacy (epsilon = 2), while outperforming classical ML, standard GNNs, and alternative privacy mechanisms, including DP-SGD across all evaluated metrics. Mechanistic analysis confirms a strong negative correlation (Spearman = -0.81) between feature importance and noise magnitude, providing interpretable evidence that the privacy-utility gains are driven by principled anisotropic allocation.

Figures & tables

Figure 1: Framework for utility-preserving private feature release. Structured multimodal records are encoded, privatized via importance-aware anisotropic LDP (FI-LDP), and processed through a stratified Hierarchical Graph Attention Network (HGAT) for defect prediction.

Method	Target	Privacy type	Formal	Main relevance / limitation
SIA+ASIG [ 5 ]	Raw images	Heuristic	No	De-identifies melt-pool images through stochastic augmentation and surrogate generation, but does not provide a formal privacy bound for learned embeddings.
MNP [ 21 ]	Model weights	$(\epsilon,\delta)$ -DP	Yes	Perturbs model parameters during distributed training; protects the model rather than released feature representations.
Blockchain/Encryption [ 36 , 28 ]	Data in transit	Access control	No	Ensures integrity and secure transmission, but does not address statistical privacy or utility-aware feature perturbation.
Federated learning [ 42 , 54 ]	Training data	Varies	Optional	Avoids raw-data centralization, but requires iterative communication and is not designed for single-shot feature release.
FI-LDP (Proposed)	Feature embeddings	$(\epsilon,\delta)$ -LDP	Yes	Applies importance-guided anisotropic noise to graph-ready feature embeddings, enabling formal privacy with downstream graph learning utility.

Table 1: Comparison of privacy-preserving methods relevant to manufacturing analytics. The table highlights the protection target, privacy mechanism, and the main limitation of each method relative to graph-ready feature release.

Figure 2: High-level overview of the utility-preserving private graph learning framework for in-situ porosity prediction. The pipeline integrates (i) porous-targeted data augmentation to address class imbalance, (ii) a supervised warmup phase for feature importance estimation, and (iii) importance-aware anisotropic Local Differential Privacy (FI-LDP) for secure feature release to a stratified Hierarchical Graph Attention Network (HGAT).

Symbol	Description
$\mathcal{G}=(\mathcal{V},\mathcal{E})$	Layer-stratified process graph with nodes $\mathcal{V}$ and edges $\mathcal{E}$ .
$v_{i}$	Node corresponding to a localized melt-pool observation.
$\xi_{i}=(I_{i},\mathbf{s}_{i},\mathbf{g}_{i},y_{i})$	Multimodal record: thermal patch, process-state features, geometric context, and label.
$I_{i}\in\mathbb{R}^{H\times W}$	In-situ thermal image patch (melt-pool neighborhood).
$\mathbf{s}_{i}\in\mathbb{R}^{d_{s}}$	Process-state / melt-pool scalar descriptors.
$\mathbf{g}_{i}\in\mathbb{R}^{d_{g}}$	Geometric context (layer index and in-layer coordinates; optional part/toolpath attributes).

Table 2: Nomenclature. Key symbols used in the proposed FI-LDP-HGAT framework.

Figure 3: Porous-targeted augmentation operators used during training. The four transformations (A1)–(A4) are applied only to minority-class (porous) thermal frames to increase defect-signal diversity under severe class imbalance. The operators emulate sensor noise, intensity drift, mild registration errors, and interpolated defect signatures; validation and test splits remain unaugmented.

Figure 4: Multimodal feature extraction and fusion for node representation. Each node feature $\mathbf{x}_{i}$ concatenates an image-derived embedding $\mathbf{z}^{(\mathrm{img})}_{i}=f_{\theta}(I_{i})$ (thermal fingerprints) with a context embedding $\mathbf{z}^{(\mathrm{ctx})}_{i}=g_{\phi}(\mathbf{s}_{i},\mathbf{g}_{i})$ capturing process-state and geometric descriptors. This fused representation is used for warmup importance estimation and as the input to FI-LDP privatization in subsequent stages.

Figure 5: Graph construction pipeline for FI-LDP-HGAT. (a) Porous-targeted augmentation applies transformation operators $F(\cdot)$ to minority-class thermal patches to increase defect-signal diversity during training (Sec. 3.2 ). (b) Node and edge formation for the layer-stratified hybrid $k$ NN graph: each node aggregates an image embedding from the thermal patch and a context vector of process/geometric features (Sec. 3.3 ). Within each physical layer, edges connect each node to its $k$ nearest neighbors under the hybrid distance in Eq. ( 13 ), combining in-layer spatial proximity and thermal embedding similarity.

Figure 6: HGAT message passing with attention. Edge priors bias attention toward spatially/thermally consistent neighbors, while learned coefficients adaptively weight neighborhood contributions for node-level porosity inference.

Figure 7: Effect of isotropic vs. importance-guided local privatization on graph features. (a) Uniform-LDP (isotropic Gaussian noise). A single privacy budget is enforced by injecting the same noise scale into every feature coordinate, perturbing task-critical “thermal fingerprint” dimensions and redundant dimensions equally. This uniform corruption distorts the relative geometry of node embeddings and can weaken attention-based neighborhood aggregation. (b) FI-LDP (importance-guided anisotropic noise). The privacy budget is redistributed across coordinates using the warmup-derived importance prior $\mathbf{q}$ , assigning smaller noise to high-importance coordinates and larger noise to low-importance coordinates under the same $(\epsilon,\delta)$ guarantee. This preserves task-relevant subspaces while maintaining local privacy for feature release.

Classical / deep learning (no graph structure)
Method	Features	AUC	AUPR	[email protected]	F1 ∗	F1 ∗ std
SVM (RBF)	Img	0.979	0.973	0.926	0.903	0.000
MLP (2-layer)	Img	0.986	0.948	0.778	0.824	0.022
ResNet-18 + MLP	Img	0.978	0.969	0.879	0.861	0.022
Graph neural networks (with layer-stratified topology)
GCN	Multimodal + Graph	0.964	0.931	0.946	0.862	0.022

Table 3: Non-private baseline comparison. All methods use the same data split. Feature columns indicate the input representation: Img = ResNet-18 image embedding; Multi = image + process-state + geometric context; Graph = layer-stratified

k

NN topology.

Method	$\epsilon$	AUC	AUPR	[email protected]	F1 ∗
Non-Private Oracle	—	0.990	0.907	N/A	0.941
DP-SGD + HGAT	2.0	0.436	0.130	0.489	0.194
Uniform-LDP + HGAT	2.0	0.884	0.621	0.711	0.685
FI-LDP + HGAT (Ours)	2.0	0.913	0.664	0.762	0.686
DP-SGD + HGAT	4.0	0.446	0.132	0.489	0.202
Uniform-LDP + HGAT	4.0	0.910	0.697	0.770	0.752

Table 4: Privacy-aware method comparison at fixed privacy budgets. All methods use the same HGAT backbone and graph topology for fair comparison.

F1^{*}

denotes the test F1-score at a validation-optimized threshold.

Figure 8: Mechanism insight for FI-LDP at

\epsilon=2.0

: importance-guided anisotropic perturbation. (a) Normalized importance scores (sorted) show that predictive utility is concentrated in a small subset of embedding coordinates. (b) Allocated Gaussian noise scale

\sigma_{j}

per coordinate: Uniform-LDP applies a constant

\sigma

, whereas FI-LDP assigns smaller

\sigma_{j}

to high-importance coordinates and larger

\sigma_{j}

to low-importance ones under the same privacy budget. (c) Utility–noise coupling: scatter of importance vs. allocated

\sigma_{j}

with a fitted trend, showing a strong negative monotonic association (Spearman

\rho=-0.81

), i.e., FI-LDP perturbs informative coordinates less aggressively.

Figure 9: Privacy–utility frontier for FI-LDP and Uniform-LDP. Metrics are reported across $\epsilon\in[0.5,8.0]$ under a fixed protocol (same split; seed-averaged runs). (a) AUC and (b) AUPR summarize threshold-free ranking quality. (c) Precision@0.5, (d) Recall@0.5, and (e) F1@0.5 are computed at the default decision threshold $t=0.5$ . (f) $F1^{*}$ is evaluated at a validation-optimised threshold $t^{*}$ , representing the best calibrated operating point. FI-LDP exhibits a higher utility ceiling in the moderate-privacy regime ( $\epsilon\approx 2$ – $4$ ), while both methods converge at larger budgets as privacy-induced distortion diminishes. — Figure 9: Privacy–utility frontier for FI-LDP and Uniform-LDP. Metrics are reported across $\epsilon\in[0.5,8.0]$ under a fixed protocol (same split; seed-averaged runs). (a) AUC and (b) AUPR summarize threshold-free ranking quality. (c) [email protected], (d) [email protected], and (e) [email protected] are computed at the default decision threshold $t=0.5$ . (f) $F1^{*}$ is evaluated at a validation-optimised threshold $t^{*}$ , representing the best calibrated operating point. FI-LDP exhibits a higher utility ceiling in the moderate-privacy regime ( $\epsilon\approx 2$ – $4$ ), while both methods converge at larger budgets as privacy-induced distortion diminishes.

$\epsilon$	AUC	AUPR	F1 ( $t=0.5$ )	F1 ∗ (tuned)	Recovery %
0.5	0.792	0.302	0.361	0.440	46.7%
1.0	0.826	0.429	0.490	0.537	57.0%
2.0	0.913	0.664	0.647	0.685	72.8%
4.0	0.936	0.751	0.677	0.767	81.5%
8.0	0.943	0.766	0.776	0.801	85.1%

Table 5: FI-LDP utility scaling across privacy budgets. Recovery % is computed relative to

F1^{*}_{\text{oracle}}=0.941

Configuration	Oversampling	AUC	AUPR	Recall
Full Framework	True	0.913	0.664	0.762
w/o Oversampling	False	0.165	0.036	0.125
w/o Anisotropy ( $\beta=0$ )	True	0.884	0.621	0.711
Thermal-only Graph ( $\alpha=0$ )	True	0.666	0.638	0.650

Table 6: Ablation study of framework components at

\epsilon=2.0

Category	Parameter	Value
Data / Protocol	Train/Val/Test split	0.6 / 0.2 / 0.2
	Seed-averaged evaluation (runs)	5
	Decision threshold(s)	$t{=}0.5$ ; $t^{*}$ tuned on val
Graph Construction	Node feature dimension ( $d$ )	64
	Connectivity mixing coefficient ( $\alpha$ )	main; $\alpha{=}0$ (ablation)
	Stratified grouping (layer-wise)	enabled

Table 7: Reproducibility checklist and key hyperparameters for FI-LDP-HGAT.

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 432 papers

Jacobian-Guided Anisotropic Noise Reshaping for Enhancing Representation Utility under Local Differential Privacy
May 16, 2026Youngmok Ha, Viktor Schlegel, Yidan Sun +1Privacy-Preserving ML Differential Privacy
Department of Bioengineering, Imperial College London, United Kingdom · Artificial Intelligence Computing Research Laboratory, Electronics and Telecommunications Research Institute (ETRI), Daejeon, Republic of Korea · Imperial Global Singapore, Imperial College London, Singapore +1
UMEDA: Unified Multi-modal Efficient Data Fusion for Privacy-Preserving Graph Federated Learning via Spectral-Gated Attention and Diffusion-Based Operator Alignment
May 8, 2026Shih-Yu Lai, Hirozumi Yamaguchi, Shang-Tse Chen +2Multimodal Federated Learning Federated Learning Aggregation
National Taiwan University · RIKEN-CCS · The University of Osaka +1
Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation
Apr 8, 2026Wenjing Wei, Farid Nait-Abdesselam, Alla JamminePrivacy-Preserving Federated Learning Differentially Private Federated Learning
Université Paris Cité, Paris, France

May 16, 2026J/K move · Enter open · S save

Jacobian-Guided Anisotropic Noise Reshaping for Enhancing Representation Utility under Local Differential Privacy

Youngmok Ha, Viktor Schlegel, Yidan Sun, Anil Anthony Bharath

Department of Bioengineering, Imperial College London, United Kingdom · Artificial Intelligence Computing Research Laboratory, Electronics and Telecommunications Research Institute (ETRI), Daejeon, Republic of Korea · Imperial Global Singapore, Imperial College London, Singapore+1

Privacy-Preserving ML Differential Privacy

Open paper AskPDF arXiv

While Local Differential Privacy (LDP) serves as a foundational primitive for distributed data collection, its stringent randomization requirements often lead to severe degradation in data representation utility. This degradation stems from the task-agnostic nature of conventional LDP mechanisms, which perturb all dimensions without accounting for their relative importance to the downstream objective. To address this issue, we propose a novel approach that mitigates noise in task-relevant subspaces of the data representation. Our method identifies task-critical subspaces via the Jacobian of a public downstream model, selectively attenuates noise along these directions, and reshapes the isotropic noise of standard LDP mechanisms into an anisotropic distribution. The resulting mechanism preserves the privacy guarantee of the underlying LDP randomizer while heterogeneously modulating the impact of noise across task directions, thereby substantially enhancing data utility. The approach is applicable to both linear and nonlinear models and can be seamlessly integrated with existing LDP mechanisms. Extensive experiments on CIFAR-10-C under brightness corruption at the highest severity level demonstrate that integrating our approach improves classification accuracy by approximately 8 percentage points for Laplace and 20 percentage points for PrivUnit variants at

ε=7.5

. The source code is available at https://github.com/ymha/jacobian-anr-ldp.

Abstract

Privacy-Preserving ML

Explore similar work

Jacobian-Guided Anisotropic Noise Reshaping for Enhancing Representation Utility under Local Differential Privacy

UMEDA: Unified Multi-modal Efficient Data Fusion for Privacy-Preserving Graph Federated Learning via Spectral-Gated Attention and Diffusion-Based Operator Alignment

Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation