🤖 machine learning

Robust and Personalized Federated Learning for Aircraft-Engine Prognostics under Benign and Adversarial Client Heterogeneity

This paper proposes a robust and personalized federated learning framework for aircraft-engine prognostics that effectively addresses both benign data heterogeneity and adversarial poisoning attacks by demonstrating that combining shared-representation personalization with robust aggregation (specifically Krum) significantly improves remaining-useful-life prediction accuracy while maintaining model safety against sophisticated backdoor threats.

Original authors: Chinmoy Mitra, Md. Mehedi Hasan Nipu, Mohammad Sakib Mahmood, Md. Rakibul Islam, M. F. Mridha

Published 2026-08-06

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Chinmoy Mitra, Md. Mehedi Hasan Nipu, Mohammad Sakib Mahmood, Md. Rakibul Islam, M. F. Mridha

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

=== SUMMARY ===
Imagine a world where giant jet engines are like living, breathing creatures that need constant check-ups to predict when they might get sick. For decades, scientists have built smart computer programs to listen to the engine's sensors and guess how much life is left before it breaks. This is called "prognostics." Usually, these programs are trained on data from just one airline's fleet. But in the real world, there are many different airlines, and they are all very protective of their secret data. They don't want to share their engine logs with rivals, and regulations often forbid it.

Enter Federated Learning, a clever trick that lets these airlines train a super-smart AI together without ever actually swapping their secret files. Instead of sending the data, they send only the "lessons learned" (mathematical updates) to a central teacher, who mixes them all up to make a better global model. It's like a group of students studying for a test in separate rooms and only sending their final answers to a teacher to create a master study guide. However, this system has two big problems. First, the students might be studying different things (one has a broken engine, another has a healthy one), which confuses the teacher. Second, a sneaky student might try to send incorrect answers to trick the teacher into teaching the wrong lesson. This paper dives deep into how to fix both problems at once, ensuring the AI is both smart enough to handle different engines and tough enough to ignore the incorrect inputs.

The Engine Detective's Dilemma

The researchers in this paper set out to solve a tricky puzzle involving aircraft engines. They used a famous computer simulation called C-MAPSS, which acts like a digital wind tunnel, generating thousands of hours of sensor data from turbofan engines running until they fail. They imagined a scenario where four different "clients" (representing different airlines or maintenance groups) wanted to train a shared AI to predict when an engine would break.

But there was a catch. Two of these clients had engines with one specific type of problem (a high-pressure compressor issue), while the other two had engines with that same problem plus a second issue (a fan degradation). This is what the authors call benign heterogeneity. It's like trying to teach a class where half the students are learning to bake bread and the other half are learning to bake both bread and cakes. If you just average their answers, the resulting "master recipe" might be terrible at both.

On top of this, the researchers introduced a malicious actor. One of the clients was actually a spy trying to sabotage the group. This spy didn't just send wrong answers; they planted a backdoor. They taught the AI a secret trick: "If you see a specific, weird blip in the temperature sensor (like a sudden, deep drop in the last second of data), pretend the engine is perfectly healthy, even if it's about to explode." The spy wanted the AI to ignore real dangers whenever this specific signal appeared, while still working perfectly on all other normal data.

The Great Experiment: Who Wins?

The team ran a massive series of simulations to test different ways to fix the "different recipes" problem and the "sneaky spy" problem. They treated these as two separate axes: Axis 1 (fixing the data differences) and Axis 2 (stopping the spy).

Axis 1: The "Personalized" Solution
The researchers tested several methods to help the AI handle the different engine types.

The Old Way (FedAvg): Just averaging everyone's updates. This failed miserably, closing almost none of the gap between a local model and a perfect centralized model.
The "Regularization" Way (FedProx): Trying to force everyone to stay close to the group average. This helped a little, closing about 21% of the performance gap, but it was unreliable and varied wildly depending on the random starting point.
The "Personalized" Way (FedRep): This was the winner. Instead of forcing everyone to use the exact same brain, they let each client keep their own "decision head" (the part that makes the final call) while sharing the "brain" (the part that learns features). This allowed the AI to understand the shared physics of engines while adapting to the specific quirks of each airline. This method closed a massive 69.9% of the performance gap. It was the most effective and consistent solution.

Axis 2: The Spy Hunter
Next, they tested how to stop the spy with the backdoor.

The Spy's Success: When the group used the standard averaging method, the spy was incredibly successful. The backdoor worked 94.9% of the time. The scary part? The AI's performance on normal, clean data looked perfectly fine. The spy was invisible to anyone only checking the "clean" scores.
The Defenders: They tried different ways to aggregate the updates.
- Trimmed Mean & Median: These methods cut out the most extreme answers. They helped a bit, dropping the spy's success to about 49.8%, but they still failed when two spies worked together.
- Krum: This is a geometric method that picks the update that is closest to everyone else's. It was the hero. It dropped the spy's success rate down to just 6.4%. It was the only method that could survive when two spies colluded, whereas the other defenses collapsed completely.

The Big Twist: You Can't Just Pick One

The most important discovery came when they tried to combine the solutions. They asked: "If we use the 'Personalized' method (which fixes the data differences), does it automatically stop the spy?"

The answer was a hard no.
The researchers found that personalization alone did not protect the group. Even with personalized heads, the spy's backdoor still infected the shared "brain" (the encoder), and the honest clients still fell for the trap. The spy's success rate remained high (around 63%). The "private heads" didn't shield the group because the poison was in the shared part of the model that everyone used.

The Winning Combo: Stacking the Defenses
The paper concludes that you must stack the solutions. You need the Personalized approach to handle the different engine types and the Krum aggregator to filter out the spy.

When they combined FedRep (personalization) with Krum (robust aggregation), the result was amazing.
The spy's success rate plummeted to just 2.8%.
The honest clients stayed safe, and the model remained personalized for each airline.
There was a tiny cost: the model's accuracy on normal data dropped slightly (by about 1.8 cycles in prediction error), but the authors argue this is a small price to pay for safety.

The Takeaway for the Future

This paper teaches us that in the world of collaborative AI, you can't rely on a single fix.

Don't trust "Clean" scores alone: The spy's attack was invisible on normal data. If you only check how well the AI works on clean engines, you might miss a disaster waiting to happen. You must test the model with "triggered" data to see if it has been poisoned.
Stack your defenses: If you have different types of data (like different airlines), you need personalization. If you have bad actors, you need robust aggregation. You need both.
The "Krum" method is tough: It's the only one that survived the coordinated spy attack in their simulations, though it can be a bit unpredictable if the group is small.

In short, building a safe, shared AI for jet engines isn't just about making the model smarter; it's about making it tough enough to ignore the liars and flexible enough to understand the different realities of every partner in the group. The authors suggest that while their solution works well in these simulations, the real world might have even sneakier spies, so the job of building the ultimate defense is still ongoing.

Technical Summary: Robust and Personalized Federated Learning for Aircraft-Engine Prognostics

1. Problem Statement

Aircraft-engine prognostics, specifically predicting Remaining Useful Life (RUL), is a safety-critical task where missing a failure can be fatal, while unnecessary grounding incurs financial loss. While centralized training on the NASA C-MAPSS benchmark has matured, real-world deployment involves multiple operators (airlines or MRO networks) who cannot pool raw sensor data due to competitive and regulatory constraints. Federated Learning (FL) offers a solution but faces two distinct, orthogonal challenges that existing literature often treats in isolation:

Benign Heterogeneity (Axis 1): Honest operators possess structurally different data distributions (e.g., different fault modes like High-Pressure Compressor degradation vs. combined HPC + Fan degradation). Standard FL (FedAvg) fails here because a single shared model head cannot effectively span these divergent fault families.
Adversarial Heterogeneity (Axis 2): Compromised operators may submit poisoned updates. While backdoor attacks are well-studied in image classification, they remain under-explored in time-series prognostics. Crucially, existing defenses often fail to detect "stealthy" attacks that preserve clean-data accuracy while compromising specific failure modes.

This study posits that a deployed FL pipeline must handle both axes simultaneously, yet no prior work has evaluated benign remedies (personalization, reweighting) and adversarial defenses (Byzantine-robust aggregation) together on the same turbofan federation.

2. Methodology

Dataset and System Model

The study utilizes the NASA C-MAPSS benchmark, specifically a structural non-IID partition of subsets FD001 (single fault mode) and FD003 (two fault modes).

Topology: A 4-client federation (2 clients per subset).
Architecture: A multi-task 1-D Convolutional Neural Network (CNN) with 30,018 parameters. It features a shared encoder (Conv1D blocks with GroupNorm) and two task-specific heads: a regression head for RUL and a binary classification head for "fault-imminent" detection.
Training: Synchronous FL with 50 rounds, 2 local epochs per client, and Adam optimization.

Axis 1: Benign Heterogeneity Remedies

The paper evaluates four families of remedies against the structural non-IID failure of FedAvg:

Server-side Reweighting: Adjusting client weights based on validation F1, fault counts, or inverse loss.
Proximal Regularization (FedProx): Penalizing local drift from the global model.
Architectural Personalization (FedRep): Sharing the encoder but training private client-specific heads.
Clustered Personalization (FedCCFA): Grouping clients by encoder update similarity and training per-cluster models.

Axis 2: Adversarial Heterogeneity and Attacks

The study introduces a systematic 5-attack × 4-defense matrix:

Attacks:
- Label-flip (AV1): Flipping fault labels.
- Gradient Scaling (AV2, AV4): Scaling gradients by -10 (loud) or -2 (stealthy).
- Sensor-Value Backdoor (AV3): A targeted attack injecting a physically motivated trigger (a strong negative excursion on the T30 sensor at the end of a window) and rewriting labels to "healthy." This attack is designed to be invisible to clean-data monitors.
- Coordinated Byzantine (AV5): Two clients colluding with gradient scaling.
Defenses:
- FedAvg: Baseline.
- Trimmed Mean & Coordinate Median: Per-coordinate robust aggregation.
- Krum: Whole-update vector selection based on distance to nearest neighbors.

Cross-Axis Bridge

The study evaluates whether personalization (Axis 1 winner) confers protection against backdoors (Axis 2 threat) and tests a stacked defense combining FedRep (personalized heads) with Krum (robust encoder aggregation).

3. Key Results

Axis 1: Benign Heterogeneity

FedAvg Failure: On the FD001+FD003 partition, vanilla FedAvg recovers 0% of the performance gap between local-only training and centralized training (RMSE ~17.95 vs. 13.77 centralized).
Personalization Dominance: FedRep (personalized heads) closes ~70% of the gap (RMSE ~~15.02), significantly outperforming FedProx (~~21%) and server-side reweighting (~10%).
Reliability: Personalization methods show lower seed-to-seed variance than FedProx, making them more reliable for production.
Clustering: FedCCFA performed similarly to FedRep but failed to partition the clients into distinct clusters, suggesting that at this scale, the encoder updates are too similar to benefit from clustering once heads are personalized.

Axis 2: Adversarial Heterogeneity

Stealth of Backdoors: The sensor-value backdoor (AV3) achieved a 94.9% Attack Success Rate (ASR) against FedAvg while leaving clean-set RMSE and F1 scores statistically indistinguishable from the honest baseline. This confirms that clean metrics alone cannot certify model safety.
Defense Efficacy:
- Krum was the only aggregator to significantly reduce backdoor success (ASR dropped to 6.4%).
- Trimmed Mean and Coordinate Median reduced ASR to ~~50% but failed catastrophically against coordinated attacks (2-of-4 malicious clients), collapsing to the same RMSE as undefended FedAvg (~~84.0).
- Krum also survived the coordinated 2-attacker scenario (RMSE ~24.0), though with higher seed variance, whereas per-coordinate defenses failed completely.

Cross-Axis Findings

Orthogonality: Personalization (FedRep) does not protect against backdoors. When FedRep is used alone, honest clients suffer the same high ASR (~63%) as the attacker because the poison resides in the shared encoder, which is still aggregated via averaging.
Stacked Defense: Combining FedRep + Krum yields the best results. It reduces the honest-client ASR to 0.028 ± 0.024 (2.8% ± 2.4%, with a 95% confidence interval extending up to ~~5.2%) while retaining the personalization benefits. This comes at a modest accuracy cost (~~1.8 RMSE increase compared to FedRep alone) due to Krum discarding three of four encoder updates per round.

4. Significance and Claims

The paper makes four primary contributions, framed with modesty regarding its scope:

Heterogeneity Analysis: It provides the first controlled comparison of aggregation reweighting, proximal regularization, and architectural personalization on a structural non-IID turbofan benchmark. It concludes that architectural personalization is the necessary remedy for structural non-IID fault modes, outperforming optimization-side corrections by a factor of ~3.
Security Evaluation: It introduces a physically motivated sensor-value backdoor for prognostics. The study demonstrates that such attacks can be highly successful (95% ASR) while remaining invisible to standard clean-data monitoring, necessitating explicit attack-success evaluation.
Evaluation Principle: It establishes that clean predictive metrics are insufficient for assessing trustworthiness in federated prognostics. A model can appear safe on clean data while being completely compromised on specific failure triggers.
Joint Deployment Strategy: It demonstrates that Axis 1 and Axis 2 threats are orthogonal and require distinct, stacked remedies. Neither personalization nor robust aggregation alone suffices for a dual-threat environment. The proposed FedRep + Krum stack offers a practical, composable defense that restores robustness at a bounded accuracy cost.

Limitations and Scope:
The authors explicitly note that the study is conducted on a small federation ( $N=4$ ) and a specific benchmark. The Krum defense against coordinated attackers at $N=4$ is an empirical stress test outside its formal theoretical bounds (which require $N \ge 2f+3$ ). Furthermore, the backdoor trigger is static and non-adaptive; the paper does not claim robustness against adaptive, defense-aware adversaries that might optimize against the Krum geometry. The results are intended to guide deployment strategies and highlight the need for triggered-set evaluation in real-world FL prognostic pipelines.