Federated Learning for Multi-Owner Building Portfolios: A Research Protocol for Privacy-Preserving, Communication-Efficient, and Non-IID HVAC Power Modeling

1. Introduction

A multi-owner building portfolio is a distributed learning environment in which each client is an owner-controlled site, usually one building or one edge node acting for one building, that retains local operational records under separate administrative control. These records may encode occupancy-related routines, control policies, weather response, equipment behavior, and other commercially sensitive characteristics. Central pooling may therefore be infeasible even when participants share a forecasting objective. Federated learning fits this setting because raw observations remain local while clients exchange model information. That advantage does not remove the main technical difficulties: updates can still leak information, communication budgets differ across sites, faulty or malicious participants can degrade training, and the portfolio is inherently non-IID because buildings differ in climate, geometry, zoning, and supervisory schedules. [1] [2]

This manuscript addresses a narrow version of that problem: federated training of a shared predictor for whole-building HVAC power using local 15-minute operational histories. The article is a research protocol rather than an empirical study. It does not claim measured gains, completed deployment, or validated thresholds. Its purpose is to define an executable protocol that can later be tested against standard federated baselines under controlled building heterogeneity.

The supervised target is deliberately limited to HVAC power rather than to a generic building-energy quantity. The available building-domain evidence directly supports a standardized schema containing indoor temperature, outdoor weather, heating and cooling setpoints, and HVAC power, and it explicitly recommends one-step and multi-step prediction of room air temperature and/or HVAC power for transfer-learning evaluation. By contrast, heating-load studies remain useful here primarily as application context showing that thermally driven load prediction matters for building energy management, but they do not define the transferable portfolio target used in this protocol. [3] [4]

The contribution of the article is therefore procedural. It combines four mechanism families into one building-specific protocol: adaptive privacy control, secure-aggregation-compatible communication reduction, poisoning-aware update admission, and personalized cold-start participation. Each mechanism is drawn from prior work in adjacent federated settings, but their composition for multi-owner building portfolios remains a proposal that requires prospective testing. [1] [5] [2] [6]

2. Research question and evidence scope

The primary research question is: how should federated learning be organized for a multi-owner building portfolio so that a shared HVAC power predictor can be trained without raw-data pooling while remaining robust to heterogeneous client distributions, constrained communication, and poisoned or abnormal updates? A secondary question is how a newly joining building with limited local history should participate without destabilizing the global model or overfitting to sparse local observations.

The article uses a targeted narrative synthesis rather than a systematic review. The evidence scope is restricted to passages directly supporting five needs of the protocol: a common transferable building dataset structure; the practical distinction between secure aggregation and differential privacy; mechanisms for clipping and privacy accounting; anomaly-based defenses under heterogeneous federated training; and personalization for cold-start federated participants. [3] [1] [5] [2] [6]

Three categories of statements are kept separate. First, established prior findings include that reproducible one-year HVAC operation data can be generated across multiple buildings and climates with a consistent 15-minute schema; that secure aggregation hides individual messages from an honest-but-curious coordinator while differential privacy protects released aggregates or model transcripts; and that anomaly-oriented filtering, clipping, and adaptive privacy allocation have been studied in other federated domains. Second, this manuscript proposes a building-specific protocol that composes these mechanisms and defines explicit decision rules. Third, every threshold, grouping rule, attack parameter, and architectural choice remains unvalidated for building portfolios until tested. [3] [1] [2]

3. Building-domain basis for portfolio-level federated learning

The protocol is anchored to direct building-domain evidence rather than to a generic federated benchmark. A reproducible method has been reported for generating one full year of HVAC operation time series for each building-by-climate-by-policy scenario. The pipeline combines EnergyPlus-based Sinergym for five source buildings with a Modelica-based BOPTEST target building under a common interface, and it exports standardized 15-minute multivariate time series including indoor temperature, outdoor weather, setpoints, and HVAC power. The released variables remain in physical units, with no normalization applied in the released data. [3]

This source is valuable not only as a data origin but also as evidence about the structure of heterogeneity. The building scenarios differ in geometry, floor area, number of thermal zones, climate, and supervisory policy. In addition to rule-based control schedules, the method includes a stochastic supervisory policy that interleaves drift, ramps, oscillations, jumps, and noisy holds to broaden setpoint trajectories and visited state ranges. A building federation trained on such clients should therefore expect substantive client drift rather than mild perturbations around one common distribution. [3]

The same source also justifies using a minimal common schema. Its authors intentionally restrict the exported variables to signals consistently available across both simulation stacks and comparable across environments. That design is directly relevant to portfolio learning, where some owners may hold richer building-management signals but a cross-owner federation needs a lowest common denominator. PortfolioFL-B therefore assumes a shared input schema based on core supervisory-loop signals rather than on richer but inconsistently exposed variables such as component-level power breakdown or occupancy indicators. [3]

4. Relevant federated-learning components from prior work

A protocol for building portfolios requires clear comparators. FedAvg remains the standard iterative pattern of local optimization followed by weighted server aggregation. Prior work also notes that direct averaging can degrade under malicious updates or strong heterogeneity. In visual-IoT federated learning, FedProx is described as limiting local deviation through a proximal regularizer, while SCAFFOLD estimates control variates to correct biased local updates. These methods form the natural baseline family for the proposed building protocol because they address non-IID optimization before adding stronger privacy or robustness mechanisms. [1] [2]

Privacy mechanisms must be distinguished rather than conflated. One source states explicitly that secure aggregation prevents an honest-but-curious coordinator from inspecting individual client messages, while differential privacy protects released aggregates and final models. This distinction matters in building portfolios. Hiding plaintext updates from the coordinator addresses one threat, but it does not alone bound inference from the resulting global trajectory. Differential privacy addresses a different exposure, but it does not hide individual plaintext updates if the server sees them before aggregation. The protocol therefore treats secure aggregation and differential privacy as complementary, not interchangeable. [2]

Industrial federated-learning studies provide two additional mechanism families. One proposes hierarchical privacy-budget allocation across model layers together with a multi-feature anomaly-detection defense using directional consistency, scale stability, clipping, and voting in heterogeneous settings. Another combines encryption, differential privacy, sparsification, and adaptive thresholding in a communication-aware framework. These studies do not supply building-specific settings, but they justify treating privacy scheduling, communication control, and poisoning resistance as coupled design dimensions rather than separate add-ons. [1] [5]

Cold-start participation has also been studied in federated recommendation. That literature frames cold start as a setting where global sharing must coexist with local personalization because sparse local histories limit direct global inference. Buildings are not items or users, but the procedural analogy is useful: a newly added building may have little operational history and still require a usable predictor quickly. This motivates staged participation rather than immediate full coupling to all shared parameters. [6]

5. Proposed protocol: PortfolioFL-B

PortfolioFL-B treats each client k as one owner-controlled site exposing one time-indexed operational stream under the common schema. The default task is one-step-ahead HVAC power forecasting at 15-minute resolution. For timestamp t, define x_k,t as the stacked window of the previous L observations of indoor air temperature, locally available outdoor weather variables, heating and cooling setpoints, and HVAC power. The target is y_k,t+1 = P_hvac,k,t+1 in watts. Windows are generated at every available timestep, not only during occupied periods. If a required timestamp inside a candidate window is missing, that window is discarded; no interpolation is applied in the default protocol. Multi-step prediction can be examined later by replacing the scalar target with an H-step vector. [3]

The shared predictor is decomposed as f_theta(x)=g_phi(h_psi(x)), where h_psi is a global temporal representation and g_phi is a global regression head. Each client also maintains a local residual head r_k with prediction y_hat_k,t = g_phi(h_psi(x_k,t)) + r_k(h_psi(x_k,t)). The residual head is a proposed personalization device. Its purpose is to absorb persistent site-specific effects that need not be forced into the globally shared parameters. This architectural choice is motivated by residual modeling in building heating-load prediction, but it remains a design hypothesis for federated building portfolios rather than an established result. [4]

The local objective is defined on the shared parameter vector theta_k={psi_k,phi_k}, where psi_k and phi_k are the client copies of the broadcast shared representation and shared regression head. The local residual head r_k is excluded from theta_k and is never subject to the proximal penalty. Let W_k^(m) denote the set of all local training windows used by client k in round m, and let n_k^(m)=|W_k^(m)|. During round m, client k performs minibatch stochastic optimization over W_k^(m) for E local epochs to minimize the empirical mean objective L_k^(m) = (1/n_k^(m)) sum_(x,y) in W_k^(m) (y - [g_phi_k(h_psi_k(x)) + r_k(h_psi_k(x))])^2 + lambda_p ||theta_k - theta^(m)||_2^2 + lambda_u ||r_k||_2^2, where theta^(m)={psi^(m),phi^(m)} is the broadcast shared parameter set at round start. The first term fits the predictor over the full round-level local window set, the second limits drift of shared parameters, and the third bounds local personalization. Minibatch size is an optimizer setting used to approximate this objective and does not change the definition of the normalization factor.

After E local epochs, client k forms the shared-parameter update u_k^(m)=theta_k^(m)-theta^(m). Mandatory clipping is applied first: Clip_C(v)=v min(1, C/||v||_2), giving ubar_k^(m)=Clip_C(u_k^(m)). Only ubar_k^(m) is eligible for transmission. The layer groups for privacy scheduling are fixed before training: G_high contains the coordinates of the shared representation h_psi and G_low contains the coordinates of the shared regression head g_phi. If model-update privacy is enabled, coordinates j in group g receive Gaussian noise utilde_(k,j)^(m)=ubar_(k,j)^(m)+N(0, sigma_g(m)^2 C^2), with sigma_high(m) greater than or equal to sigma_low(m). Privacy accounting is defined in one accountant space for both channels. Let R_model(m) be the Rényi differential privacy cost of the clipped Gaussian mechanism used for model updates in round m, and let R_diag(m) be the corresponding cost for the diagnostic vector in that round, both computed at a preregistered set of orders alpha under the same client-participation subsampling assumptions. The cumulative privacy ledger is R_total = sum_m R_model(m) + sum_m R_diag(m). Only after training is complete is R_total converted once to a client-level (epsilon_total, delta) guarantee for a preregistered delta, and the protocol requires epsilon_total less than or equal to epsilon_max. The round log records R_model(m) and R_diag(m), not per-round epsilon values. Sensitivity analysis may replace the fixed parameter partition with a preregistered alternative grouping, but no data-dependent reassignment is allowed during training. [1] [2]

Communication control uses common-mask sparsification compatible with secure aggregation. Only shared-parameter updates for theta={psi,phi} are transmitted; local residual-head parameters r_k, temporary cold-start head parameters, optimizer states, and validation statistics remain on the client. At the end of round m-1, after secure aggregation and server updating, the server computes from accepted aggregated information the next-round mask M^(m) and the next-round anchor set A^(m). At the start of round m, the server broadcasts theta^(m), M^(m), A^(m), and the privacy schedule. The mask is binary over the coordinates of theta, with preregistered retention ratios q_high(m) and q_low(m) that may differ by group. Each admitted client retains only coordinates j for which M_j^(m)=1. The operation order is fixed: local training, clipping, diagnostic computation, optional model-update noise addition, common-mask application, quantization, and secure-aggregation packaging. [5] [2]

PortfolioFL-B uses one term for poisoning resistance: the diagnostic gate. Because admission must occur before secure aggregation, diagnostics travel through a separate low-dimensional channel with its own privacy budget. For each selected client, the diagnostic vector z_k^(m) is computed from the clipped pre-noise shared update ubar_k^(m), not from raw data and not from residual-head parameters. The default vector has three components: z1 = log(||ubar_k^(m)||_2 + 10^-12); z2 = (1/|A^(m)|) sum_(j in A^(m)) 1[sign(ubar_(k,j)^(m)) = sign(DeltaBar_(j)^(m-1))]; and z3 = ||ubar_(k,G_high)^(m)||_2 / (||ubar_(k,G_low)^(m)||_2 + 10^-12). The anchor set A^(m) is deterministic: it contains the s coordinates of theta with largest values in |DeltaBar^(m-1)|, with ties broken by ascending coordinate index. The size s is fixed before training. DeltaBar denotes the previous accepted aggregated shared update. [1] [5]

The diagnostic channel is specified as a separate Gaussian mechanism. Before transmission, each client clips each diagnostic component to a preregistered bounded interval: z1 to [a1,b1], z2 to [0,1], and z3 to [a3,b3], where a1, b1, a3, and b3 are fixed protocol constants selected without using study outcomes. Let w_r be the width of component r after clipping. The transmitted value is zeta_(k,r)^(m)=clip(z_(k,r)^(m))+N(0, sigma_diag(m)^2 w_r^2). The server applies the admission rule only to zeta, never to the unnoised z values. Privacy accounting for diagnostics is composed at the client level under the same round-participation sampling model used for the shared-update channel: a client contributes to R_diag(m) if and only if it was selected for round m and attempted diagnostic transmission, regardless of later admission or deferral. The diagnostic channel is used only for admission control and round-level auditing, and its privacy cost enters R_diag(m) in the unified accountant defined above. The coordinator is assumed honest-but-curious with respect to both the diagnostic channel and the aggregated model channel. [2] [1]

Admission uses robust statistics computed over all diagnostically reporting clients in that same round; no prefilter is applied before the first gate decision. A client is counted as diagnostically reporting in round m only if the server receives its full noisy diagnostic vector before the round deadline. Clients that were selected but fail to transmit diagnostics because of dropout or communication failure are treated as nonreporting for that round, are not included in the robust-statistics calculation, and are not admitted to secure aggregation in that round. Let med(zeta_r) and MAD(zeta_r) denote the sample median and median absolute deviation of transmitted component r, with the median of an even-sized sample defined as the arithmetic mean of the two central ordered values. Client k is admitted to secure aggregation if at least two of the following three conditions hold: |zeta1 - med(zeta1)| / S_1 less than or equal to tau_1; zeta2 greater than or equal to tau_2; and |zeta3 - med(zeta3)| / S_3 less than or equal to tau_3, where S_r = max(MAD(zeta_r), s_min). The majority rule is the default because it limits exclusion from one noisy diagnostic coordinate while still requiring agreement with the round distribution on at least two dimensions. Ties at a threshold are admissible. If fewer than four clients report diagnostics in a round, all reporting clients are admitted. For the first R_warm rounds, diagnostics are collected but not used for exclusion. Rejection in one round causes only temporary deferral.

Cold-start participation follows a staged rule. Let h_k be the number of local days available for a newly joining client. Let d_k be its descriptor vector consisting of mean outdoor temperature, standard deviation of outdoor temperature, fraction of time in occupied heating-setpoint mode, fraction of time in occupied cooling-setpoint mode, and lag-1 autocorrelation of local HVAC power, each computed from the history available at enrollment. Descriptors are fixed at enrollment for the default protocol and are not refreshed during training; a sensitivity study may instead update all client descriptors at a preregistered interval, but no client-specific or outcome-dependent refresh is allowed. For existing client i with descriptor d_i, define the comparable index set J_(k,i) as the components observed for both clients. If J_(k,i) is empty, client i is not a neighbor candidate. Otherwise D(k,i)=sqrt(sum_(j in J_(k,i)) w_j^* (d_(k,j)-d_(i,j))^2), where w_j^*=w_j/sum_(ell in J_(k,i)) w_ell, the preregistered base weights w_j are nonnegative and sum to 1, and a client with sum_(ell in J_(k,i)) w_ell = 0 is excluded from the neighbor-candidate set for client k in that round. If h_k < H, client k enters cold-start mode. At enrollment, the client creates one fixed time-ordered validation split from its most recent available observations; this split is excluded from local training and reused in every post-enrollment round. The validation split must contain at least n_val,min forecasting windows; otherwise the client remains local-only and does not yet join federated rounds. [3] [6]

In cold-start mode, h_psi is frozen for the first M communication rounds after enrollment. The client instantiates a temporary local head g_(phi_k^cs), initialized from the current global head g_phi; phi_k^cs is client-specific and is not uploaded while cold-start mode persists. The client trains r_k together with phi_k^cs on local data. The eligible neighbor set N_k contains existing clients with nonmissing descriptors and history length at least H. If |N_k| is at least m, the server selects the m nearest neighbors under D; if 0 < |N_k| < m, all eligible neighbors are used; if |N_k| = 0, neighborhood regularization is skipped and the cold-start client trains only its temporary local head and residual head. The neighbor set is recomputed each round from the fixed enrollment-time descriptors and the current set of eligible clients. When neighbors are used, the server forms phibar_k by uniformly averaging their current global-head parameters and the client adds lambda_n ||phi_k^cs - phibar_k||_2^2 to its local objective. Any owner grouping used for analysis must be declared before training and held fixed.

Transition from cold-start mode to full participation is defined only over post-enrollment rounds. Let r=1 denote the first federated round after client k joins, and let MAE_k[r] be the validation mean absolute error at the end of that post-enrollment round, always measured on the fixed enrollment-time validation split. Let B_cs be the preregistered number of post-enrollment rounds in each averaging block for the stability test; B_cs is specific to this rule and is distinct from any minibatch notation elsewhere in the protocol. The stability test is not evaluated until at least 2B_cs post-enrollment rounds have been completed. For any r greater than or equal to 2B_cs, define A_prev(r)=(1/B_cs) sum_(s=r-2B_cs+1)^(r-B_cs) MAE_k[s] and A_curr(r)=(1/B_cs) sum_(s=r-B_cs+1)^r MAE_k[s]. Client k leaves cold-start mode at the first r for which all three conditions hold: h_k greater than or equal to H; |A_curr(r)-A_prev(r)| less than or equal to rho; and the fixed validation split still contains at least n_val,min windows. Upon exit, phi_k^cs is discarded and the client begins ordinary participation in updates to the shared head phi. The validation split is not redefined in the default protocol.

6. Decision sequence, assumptions, and threat model

One communication round in PortfolioFL-B has eight steps. Step 1: the server selects participants, optionally with preregistered stratification so one subgroup is not persistently under-sampled. Step 2: the server broadcasts theta^(m), the privacy schedule, the common mask M^(m), and the anchor set A^(m), all computed after completion of the previous round. Step 3: each selected client performs E local epochs on rolling windows from its 15-minute time series. Step 4: the client computes the clipped shared update ubar_k^(m) and the clipped diagnostics, then perturbs the diagnostics. Step 5: the client sends the noisy diagnostic vector before a preregistered round deadline. Step 6: the server applies the diagnostic gate to the set of reporting clients and returns admit or defer; selected clients that fail to report diagnostics by the deadline are treated as nonreporting and do not proceed further in that round. Step 7: admitted clients apply any configured model-update noise, then the common mask, quantization, and secure-aggregation packaging. Step 8: the server aggregates admitted updates, forms the next global model, and records acceptance rate and the cumulative privacy ledger.

The protocol assumes access to the minimal common schema documented in the building dataset source: indoor temperature, weather variables, setpoints, and whole-building HVAC power in known physical units. It also assumes enough local computation to form rolling windows and train a lightweight temporal model, and enough key-management support to participate repeatedly in secure aggregation. Where direct participation from a building-management system is infeasible, the client may be an owner-controlled edge node that stores the local time series and performs local training. [3] [5]

The threat model is bounded. The coordinator is honest-but-curious: it orchestrates rounds correctly but should not receive raw data or plaintext shared updates. Selected clients may be faulty or malicious and may attempt model poisoning. The protocol does not claim protection against all collusion patterns, all side channels outside the federated transcript, or adversaries compromising both local sites and the secure-aggregation service simultaneously. These limits follow from the distinction between hiding messages and protecting released aggregates emphasized in prior work. [2] [1]

7. Comparator methods and prospective evaluation protocol

Because this article reports no experiments, evaluation is specified prospectively. The primary federated comparators are plain FedAvg, a FedProx-style baseline using only the proximal term, and a drift-corrected baseline such as SCAFFOLD where implementation is feasible. A centralized pooled-data model may be included as an oracle reference in simulation-only studies, but it is not treated as a deployable governance baseline. Ablations should remove one protocol element at a time: no differential privacy, no common-mask sparsification, no diagnostic gate, and no cold-start personalization. [1] [2]

The recommended starting benchmark is the reproducible multi-building dataset-generation pipeline because it offers controlled heterogeneity across five source buildings, several climates, two supervisory policies, and a target building produced from a separate simulator stack. In simulation studies, a client can represent one whole building scenario or one predeclared owner portfolio composed of several scenarios. If owner portfolios are simulated, the grouping variable must be fixed before training, for example by assigning scenarios to synthetic legal owners or to synthetic site operators, and sampling must occur at the client level defined by that grouping. [3]

Primary predictive outcomes are MAE and RMSE for HVAC power prediction. MAPE may be reported only under a declared denominator rule, for example replacing |y| with max(|y|, eta) using a preregistered eta. Secondary outcomes are uploaded and downloaded bytes, the final client-level (epsilon_total, delta) guarantee obtained by one post-training conversion of the cumulative Rényi privacy ledger, diagnostic-gate acceptance and rejection rates, degradation under poisoning, and adaptation speed for cold-start clients. [4] [5] [2]

The poisoning evaluation protocol separates offline attack calibration from the online federated procedure. The primary poisoning estimand is horizon-H_att MAE inflation: the difference between the mean global-model MAE over the first H_att evaluation rounds after attack onset under a specified attack condition and the corresponding mean MAE under the matched no-attack condition, with all other protocol settings fixed. Recovery time, defined as the number of post-attack rounds required for MAE to return within a preregistered tolerance band of the matched no-attack trajectory, is a secondary robustness outcome. In attack rounds, a designated subset of selected clients is labelled malicious before any diagnostic transmission. Each malicious client completes the same local training step as a benign client, then replaces its raw shared update u_k^(m) with an attacked version. The attacked update is then processed by the ordinary protocol: clipping first, diagnostics from the clipped pre-noise version, diagnostic noise, admission or deferral, and then any configured model-update noise, masking, and secure aggregation. For simulation-only evaluation, attack magnitude may be normalized offline by scaling a perturbation v_k^(m) so that ||v_k^(m)||_2 = alpha times the median norm of benign raw updates in that round before clipping. That median is an oracle quantity used only to standardize offline experiments; it is not available to the coordinator online and is never part of any deployment rule.

Three illustrative attack classes are proposed. In sign-flip poisoning, the attacker sets u_k^(m) = -u_k^(m). In norm-inflation poisoning, the attacker sets u_k^(m) = u_k^(m) + v_k^(m), where v_k^(m) is aligned with u_k^(m). In drift-mimicking poisoning, the attacker sets u_k^(m) = u_k^(m) + beta * DeltaBar^(m-1), with beta declared in advance. The default poisoned-client fraction for a primary evaluation is p_attack = 0.10. Sensitivity analysis may then repeat the protocol at preregistered alternatives p_attack in {0.05, 0.20}. These attacks are prospective evaluation instruments for the proposed gate; the manuscript does not claim that they have already been observed in building systems. [1] [5]

Four prospective evaluation regimes are sufficient. Regime A varies non-IID severity by distributing climates and supervisory policies unevenly across clients. Regime B varies the common-mask retention ratios together with the privacy schedule to trace communication-privacy-accuracy trade-offs. Regime C introduces the fixed poisoning protocol above and evaluates the primary robustness estimand of horizon-H_att MAE inflation, with recovery time as a secondary outcome, comparing the diagnostic gate with ungated baselines under the same attack schedule. Regime D introduces new clients late in training and compares staged cold-start participation with immediate full participation and purely local training from scratch. Before any study, investigators should preregister one primary success criterion and one sensitivity plan for key parameters such as C, tau_1, tau_2, tau_3, H, rho, n_val,min, and B_cs. [3] [1] [5] [6]

8. Boundary conditions, conflicting considerations, and limits of generalization

The first boundary condition is task scope. PortfolioFL-B is specified for HVAC power prediction because that target is directly available in the common-schema building evidence. The protocol should not be assumed to transfer unchanged to other building tasks such as component-level energy disaggregation, occupancy inference, or comfort prediction. A different target could alter feature availability, the meaning of sensitive layers, the usefulness of common-mask sparsification, and the calibration of privacy budgets. [3]

The second boundary condition concerns heterogeneity. Prior work indicates that direct averaging can degrade when client objectives differ substantially. In building portfolios, such differences can arise from climate, equipment, supervisory logic, or simulator stack even when the same variables are observed. The residual head and proximal term are intended to reduce this mismatch, but they do not guarantee that one shared representation is sufficient. If buildings differ in ways not expressible through the minimal schema, local personalization may absorb too much of the signal and weaken the value of federation. [2] [3]

The third boundary condition is the tension among privacy, robustness, and utility. Differential privacy perturbs updates, secure aggregation limits what can be screened before aggregation, and the diagnostic gate can defer informative but unusual updates. Prior work notes that legitimate non-IID variability can resemble malicious behavior. In building portfolios, extreme weather or abrupt schedule changes may therefore yield diagnostics similar to poisoning. The warm-up period, robust normalization, temporary deferral, and separate diagnostic budget are intended to reduce this risk, but they do not remove it. Because the gate uses same-round diagnostics from all reporting clients, coordinated manipulation of the diagnostic distribution remains a residual vulnerability that must be examined prospectively. [1] [5]

9. Conclusion

This research protocol specifies PortfolioFL-B as a federated learning design for multi-owner building portfolios using a minimal cross-building schema and whole-building HVAC power as the default target. The default operational rule is explicit: windows are formed at every available 15-minute timestep and discarded if required timestamps are missing; the local training loss is the empirical mean over the full round-level window set optimized by minibatch stochastic updates; clipping precedes every transmission-side transformation; both model updates and diagnostics are accounted for in one Rényi privacy ledger under the same round-participation sampling model and converted once at study end to a client-level (epsilon_total, delta) guarantee; diagnostics are computed from clipped pre-noise shared updates, clipped componentwise, perturbed locally, and sent through a separately budgeted low-dimensional channel; clients that do not report diagnostics by the round deadline are deferred for that round; admission to secure aggregation uses a warm-up period followed by a majority diagnostic gate over same-round noisy diagnostics; communication reduction uses a common sparsification mask derived from accepted aggregated history; and newly joining clients leave cold-start mode only after minimum-history, minimum-validation-size, and validation-stability conditions are all met. [3] [1] [5] [6]

What the manuscript provides is conceptual and operational: a precise problem definition, consistent notation, an executable round sequence, a prospective attack protocol, comparator choices, and explicit boundary conditions. What remains untested are threshold calibration, sensitivity to descriptor choice, behavior of the diagnostic gate under rare but legitimate building dynamics, and the extent to which the protocol generalizes beyond the common-schema forecasting tasks that motivated it. [2] [3]

References

1. Yin, Huan; Chen, Congwen; Zhang, Jingyi; Yu, Dian; Liu, Shuanggen (2026). Privacy-Preserving and Poisoning-Robust Federated Learning for Industrial IoT. Sensors. 26(16), 5297. doi:10.3390/s26165297.
2. Wang, Shuyi; Wang, Baoping (2026). Privacy-Preserving Federated Learning for Artistic Image Classification in Visual IoT Sensor Networks. Sensors. 26(17), 5654. doi:10.3390/s26175654.
3. Domingo, Ferran Aran; Alonso, Pablo Fraile; Torrentó, Josep Rius; Batalla, Oriol Agost; Vilardell, Ignasi Barri; Mayoral, Jordi Vilaplana; Fornés, Jordi Mateo (2026). A reproducible method to generate multi-building, multi-climate HVAC operation datasets with a stochastic exploratory controller. MethodsX. 16, 103866. doi:10.1016/j.mex.2026.103866.
4. Emir, Ahmet; Topal, Halil Ibrahim; Ozturk, Suat (2026). Novel hybrid machine learning-based prediction of building space heating load: a comprehensive study. Scientific Reports. 16(1), 24924. doi:10.1038/s41598-026-55342-x.
5. Alqazzaz, Ali (2026). SecuFL-IoT: an adaptive privacy-preserving federated learning framework for anomaly detection in smart industrial networks. Scientific Reports. 16(1), 4107. doi:10.1038/s41598-025-11883-1.
6. Sivakumar, Navaneeth; John, Reuben Stephen; Bijo, Allen; Suganeshwari, G.; Anbalagan, Sudha; Thandapani, Sujithra (2026). CRAFT: cold-start recommender with attention and federated training. Scientific Reports. 16(1), 17150. doi:10.1038/s41598-026-47175-5.