Learning Defensive Policies against Diverse Inference Attacks for Smart Meter Privacy

# Learning Defensive Policies against Diverse Inference Attacks for Smart Meter Privacy
Source: [https://arxiv.org/html/2609.25484](https://arxiv.org/html/2609.25484)
Ruichang ZhangMustafa A\. MustafaAffiliation:Department of Computer Science, The University of Manchester, Manchester, UKAffiliation:COSIC, KU Leuven, Leuven, Belgium

###### Abstract

Smart meter \(SM\) data provides fine\-grained visibility into household energy consumption, but also exposes users to privacy risks\. Inference attacks, known as non\-intrusive load monitoring \(NILM\), can perform appliance\-level inference from aggregate signals and recover sensitive behavioral patterns\. In practice, attacker models are unknown and heterogeneous, making robust defense challenging\. We formulate SM privacy protection as a black\-box inference defense problem, aiming to reduce the recoverability of appliance\-level information while generalizing across diverse and unseen attackers\. We propose a proxy\-guided hierarchical reinforcement learning framework that learns battery\-based load\-shaping policies to inject realistic but misleading appliance\-level signatures into the aggregate signal, thereby disrupting the structured patterns exploited by NILM\. A self\-supervised aggregate\-structure privacy probe provides a reconstruction\-error\-based surrogate reward for disrupting recoverable load structure, while a signature library makes the perturbations appliance\-relevant and physically realizable through battery control\. We provide theoretical rationale showing that proxy\-guided optimization improves inference robustness under attacker diversity\. Experiments on real\-world datasets UK\-DALE and REDD demonstrate strong cross\-model and cross\-appliance generalization\. Across six unseen NILM attackers, covering four appliances on UK\-DALE and five on REDD, our proposed defense increases average appliance\-level RMSE by 107% and 166%, respectively, while reducing F1 score by 79% and 80%\.

## 1Introduction

Smart meters \(SMs\) record high\-frequency, real\-time electricity consumption time series, where aggregate load measurements encode structured appliance\-level usage patterns that can be exploited by non\-intrusive load monitoring \(NILM\) models\([Hart, 1992](https://arxiv.org/html/2609.25484#bib.bib13)\)\. Prior work[Kolter and Jaakkola \(2012\)](https://arxiv.org/html/2609.25484#bib.bib21);[Kelly and Knottenbelt \(2015a\)](https://arxiv.org/html/2609.25484#bib.bib2);[Chen et al\. \(2018\)](https://arxiv.org/html/2609.25484#bib.bib22);[Zhang et al\. \(2018\)](https://arxiv.org/html/2609.25484#bib.bib8);[Yue et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib20);[Sykiotis et al\. \(2022\)](https://arxiv.org/html/2609.25484#bib.bib23)has shown that diverse NILM methods can recover fine\-grained appliance activities from aggregate signals without direct access to individual devices\. Such appliance\-level information reveals latent household behaviors and therefore raises serious privacy concerns\.

Existing SM privacy defenses largely optimize proxy objectives that are not explicitly aligned with the NILM disaggregation task\. For example, prior battery\-based or load\-shaping methods often encourage curve smoothness[Erdemir et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib19);[Zhang et al\. \(2024b\)](https://arxiv.org/html/2609.25484#bib.bib11), reduce aggregate variance[Li et al\. \(2023\)](https://arxiv.org/html/2609.25484#bib.bib7);[Zhang et al\. \(2024a\)](https://arxiv.org/html/2609.25484#bib.bib12), optimize other load\-level proxies[Farokhi and Sandberg \(2019\)](https://arxiv.org/html/2609.25484#bib.bib16);[Farokhi \(2020\)](https://arxiv.org/html/2609.25484#bib.bib17), or rely on information\-theoretic criteria[Shateri et al\. \(2021\)](https://arxiv.org/html/2609.25484#bib.bib1);[Shateri \(2023\)](https://arxiv.org/html/2609.25484#bib.bib18)\. While these objectives can reshape aggregate trajectories, they are not explicitly aligned with the inference structure exploited by NILM attackers\. As a result, their influence on appliance\-level inference is only indirectly controlled, creating a privacy–task mismatch between the defender’s training signal and the attacker’s actual inference goal\. The key challenge is therefore to learn defender policies that disrupt NILM\-relevant load structures while remaining robust to diverse and unseen attackers\.

To address this challenge, we propose a proxy\-guided appliance\-signature mimicry framework that combines aggregate\-structure disruption with a NILM\-relevant signature\-level intervention mechanism\. Specifically, we use the reconstruction error of an aggregate\-level sequence probe network as the training signal, encouraging the defender to disrupt recognizable load structures that NILM models rely on for appliance\-level disaggregation\. The probe is trained in a self\-supervised aggregate\-to\-aggregate manner and does not require appliance\-level labels or access to the deployed NILM attacker\. Meanwhile, instead of injecting arbitrary perturbations, the defender inserts realistic appliance signatures drawn from a curated signature library through feasible battery control, thereby disrupting the appliance\-level evidence exploited by NILM models\. We formulate SM privacy protection as a black\-box inference defense problem under attacker uncertainty, where the defender does not know the exact NILM model used during deployment\. To solve this problem, we learn a hierarchical reinforcement learning \(HRL\) policy that decides when and which appliance signature to mimic, while a low\-level battery executor realizes the selected signature under physical constraints\. The resulting policy reshapes the reported aggregate load with realistic appliance\-like patterns to reduce the recoverability of true appliance\-level consumption\. We evaluate the proposed framework on two benchmark SM datasets \(UK\-DALE and REDD\)\. Experiments show that the proposed framework consistently degrades NILM reconstruction performance across a diverse set of unseen NILM attackers and remains effective across different datasets, households, and seasonal conditions\.

Contributions\.Our contributions can be summarized as follows: \(1\) We propose a privacy defense framework that injects realistic appliance signatures into aggregate load signals via a curated signature library to mask appliance\-level consumption patterns\. \(2\) We develop a proxy\-guided hierarchical reinforcement learning \(HRL\) framework that learns a battery control policy using an aggregate\-level privacy probe as the training signal\. \(3\) We formulate SM privacy as a black\-box inference defense problem under attacker uncertainty\. We theoretically justify proxy\-guided signature manipulation through the unified task formulation of NILM inference and the adversarial transferability of surrogate\-based attacks\. \(4\) We empirically demonstrate consistent degradation of attacker inference performance across multiple NILM models and datasets, including unseen attackers\. The results show consistent effectiveness across different datasets and strong generalization across households and seasonal conditions\.

## 2Related work

#### NILM as inference threat\.

NILM methods recover appliance\-level consumption from aggregate SM signals, ranging from combinatorial optimization[Hart \(1992\)](https://arxiv.org/html/2609.25484#bib.bib13)and factorial HMMs[Kolter and Jaakkola \(2012\)](https://arxiv.org/html/2609.25484#bib.bib21)to convolutional, recurrent, and transformer\-based sequence models[Kelly and Knottenbelt \(2015a\)](https://arxiv.org/html/2609.25484#bib.bib2);[Zhang et al\. \(2018\)](https://arxiv.org/html/2609.25484#bib.bib8);[Yue et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib20);[Sykiotis et al\. \(2022\)](https://arxiv.org/html/2609.25484#bib.bib23);[Petralia et al\. \(2025\)](https://arxiv.org/html/2609.25484#bib.bib28)\. Despite this architectural diversity, recent surveys[Rafiq et al\. \(2024\)](https://arxiv.org/html/2609.25484#bib.bib14);[Kaselimi et al\. \(2022\)](https://arxiv.org/html/2609.25484#bib.bib31)note that modern NILM models share a common task formulation: estimating appliance\-level power or on/off state from a window of aggregate readings, evaluated under a shared family of reconstruction losses\. This task\-level commonality, combined with architectural diversity, motivates the black\-box defense setting in this work, where the defender does not know the deployed NILM architecture but can exploit the shared structure of the inference task\.

#### SM privacy defenses\.

Existing SM privacy approaches fall into data\-centric and physical\-layer categories\. Data\-centric mechanisms such as aggregation[Gomez\-Vilardebo and Gündüz \(2014\)](https://arxiv.org/html/2609.25484#bib.bib6)and differential privacy[Zhang et al\. \(2025\)](https://arxiv.org/html/2609.25484#bib.bib15)perturb or post\-process reported readings, but implicitly assume that adversaries cannot tap the physical power line, which limits their applicability under realistic deployment\. Physical\-layer approaches reshape household consumption with a rechargeable battery before measurement[Erdemir et al\. \(2019\)](https://arxiv.org/html/2609.25484#bib.bib5);[Shateri et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib4), providing local and real\-time protection against attackers that exploit the structure of real load trajectories\. Early battery\-based methods rely on rule\-based or heuristic strategies[Erdemir et al\. \(2019\)](https://arxiv.org/html/2609.25484#bib.bib5);[Farokhi and Sandberg \(2019\)](https://arxiv.org/html/2609.25484#bib.bib16);[Farokhi \(2020\)](https://arxiv.org/html/2609.25484#bib.bib17), while more recent work introduces RL to automate battery scheduling[Shateri et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib4);[Shateri et al\. \(2021\)](https://arxiv.org/html/2609.25484#bib.bib1);[Erdemir et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib19);[Li et al\. \(2023\)](https://arxiv.org/html/2609.25484#bib.bib7);[Shateri \(2023\)](https://arxiv.org/html/2609.25484#bib.bib18);[Zhang et al\. \(2024a\)](https://arxiv.org/html/2609.25484#bib.bib12);[Zhang et al\. \(2024b\)](https://arxiv.org/html/2609.25484#bib.bib11)\. These RL\-based methods typically optimize either load\-level proxies such as smoothness[Erdemir et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib19);[Zhang et al\. \(2024b\)](https://arxiv.org/html/2609.25484#bib.bib11)or variance reduction[Li et al\. \(2023\)](https://arxiv.org/html/2609.25484#bib.bib7);[Zhang et al\. \(2024a\)](https://arxiv.org/html/2609.25484#bib.bib12), or information\-theoretic measures such as mutual information and information leakage[Shateri et al\. \(2021\)](https://arxiv.org/html/2609.25484#bib.bib1);[Shateri \(2023\)](https://arxiv.org/html/2609.25484#bib.bib18)\. Load\-level proxies do not explicitly model how attackers exploit appliance\-level temporal patterns, leading to a privacy–inference gap when attackers rely on different representations\. Information\-theoretic objectives are conceptually principled but cannot be directly attributed to individual control actions, and existing schemes therefore rely on auxiliary estimators whose transferability to unseen attackers remains unclear\.

#### Adversarial robustness and transferability\.

Our formulation also connects to transfer\-based black\-box adversarial attacks, where perturbations crafted on a surrogate model transfer to unseen targets\([Papernot et al\., 2017](https://arxiv.org/html/2609.25484#bib.bib25);[Liu et al\., 2016](https://arxiv.org/html/2609.25484#bib.bib26);[Gu et al\., 2023](https://arxiv.org/html/2609.25484#bib.bib24)\)\. Work\([Demontis et al\., 2019](https://arxiv.org/html/2609.25484#bib.bib27)\)formally analyze attack transferability and identify three governing factors: the target model’s intrinsic adversarial vulnerability, the surrogate’s complexity, and gradient alignment between surrogate and target\. While most analyses focus on classification, recent work shows that surrogate\-based attacks also transfer in time\-series regression\([Mode and Hoque, 2020](https://arxiv.org/html/2609.25484#bib.bib29)\), and that selective, confidence\-and\-error\-aware perturbations outperform unstructured ones under fixed budgets\([Tokgoz et al\., 2026](https://arxiv.org/html/2609.25484#bib.bib30)\)\. This motivates using a surrogate privacy probe to measure load\-structure recoverability and guide the learning of transferable battery\-based perturbation policies\. Our work instantiates these principles in a physically constrained, RL\-controlled setting, where perturbations are realized through battery actions and structured as appliance\-signature mimicry\.

![Refer to caption](https://arxiv.org/html/2609.25484v1/figs/framework.png)Figure 1:Defenderπθ\\pi\_\{\\theta\}injects battery\-driven mimic signaturesPbattP\_\{\\text\{batt\}\}into user load signalPuserP\_\{\\text\{user\}\}, aiming to deceive an NILM attackerfϕf\_\{\\phi\}who attempts to infer appliance patterns from aggregated SM data\.

## 3Problem Formulation

We consider a black\-box SM privacy setting in which the defender does not know the deployed NILM attacker \(see Fig\.[1](https://arxiv.org/html/2609.25484#S2.F1)\)\. At timett, letPuser​\(t\)P\_\{\\mathrm\{user\}\}\(t\)denote the original household aggregate load before defense, and letPbatt​\(t\)P\_\{\\mathrm\{batt\}\}\(t\)denote the battery power controlled by the defender\. We follow the convention thatPbatt​\(t\)\>0P\_\{\\mathrm\{batt\}\}\(t\)\>0denotes charging andPbatt​\(t\)<0P\_\{\\mathrm\{batt\}\}\(t\)<0denotes discharging\. The smart meter reports the masked aggregate loadPmaskπθ​\(t\)=Puser​\(t\)\+Pbatt​\(t\)P\_\{\\mathrm\{mask\}\}^\{\\pi\_\{\\theta\}\}\(t\)=P\_\{\\mathrm\{user\}\}\(t\)\+P\_\{\\mathrm\{batt\}\}\(t\)where the battery action is generated by a defender policyπθ\\pi\_\{\\theta\}and must satisfy physical constraints, including capacity limits, charging and discharging power limits, state\-of\-charge feasibility, and throughput constraints\. For a window lengthτ\\tau, we denote the clean aggregate window by𝐱t0=\[Puser​\(t−τ\+1\),…,Puser​\(t\)\]\\mathbf\{x\}^\{0\}\_\{t\}=\[P\_\{\\mathrm\{user\}\}\(t\-\\tau\+1\),\\ldots,P\_\{\\mathrm\{user\}\}\(t\)\]and the corresponding masked aggregate window induced by policyπθ\\pi\_\{\\theta\}by𝐱tπθ=\[Pmaskπθ​\(t−τ\+1\),…,Pmaskπθ​\(t\)\]\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\_\{t\}=\[P\_\{\\mathrm\{mask\}\}^\{\\pi\_\{\\theta\}\}\(t\-\\tau\+1\),\\ldots,P\_\{\\mathrm\{mask\}\}^\{\\pi\_\{\\theta\}\}\(t\)\]\. The appliance\-level target within the same window is denoted by𝐲t\\mathbf\{y\}\_\{t\}\.

An NILM attackerfϕf\_\{\\phi\}maps the reported aggregate to appliance\-level predictions:𝐲^t=fϕ​\(𝐱tπθ\)\.\\hat\{\\mathbf\{y\}\}\_\{t\}=f\_\{\\phi\}\(\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\_\{t\}\)\.For a given attackerfϕf\_\{\\phi\}and defender policyπθ\\pi\_\{\\theta\}, we define the attacker’s inference risk as

R⁡\(fϕ,πθ\)=𝔼t​\[ℒ⁡\(fϕ​\(𝐱tπθ\),𝐲t\)\],R\(f\_\{\\phi\},\\pi\_\{\\theta\}\)=\\mathbb\{E\}\_\{t\}\\left\[\\mathcal\{L\}\\left\(f\_\{\\phi\}\(\\mathbf\{x\}\_\{t\}^\{\\pi\_\{\\theta\}\}\),\\mathbf\{y\}\_\{t\}\\right\)\\right\],\(1\)whereℒ⁡\(⋅\)\\mathcal\{L\}\(\\cdot\)denotes appliance\-level reconstruction loss, such as RMSE, MAE, or SAE\. For activation\-state inference, we additionally report detection degradation using F1 reduction\. A largerR⁡\(fϕ,πθ\)R\(f\_\{\\phi\},\\pi\_\{\\theta\}\)indicates that appliance\-level consumption is harder to recover from the reported aggregate signal, and therefore corresponds to stronger privacy protection\. Since the deployed NILM attacker is unknown, we assume that the attacker belongs to a heterogeneous familyfϕ∈ℱf\_\{\\phi\}\\in\\mathcal\{F\}, covering optimization\-based, probabilistic, and neural sequence prediction models\. The ideal robust privacy objective is to maximize the expected NILM inference risk over this attacker family:

maxθ𝔼fϕ∼μ​\[R⁡\(fϕ,πθ\)\],\\max\_\{\\theta\}\\quad\\mathbb\{E\}\_\{f\_\{\\phi\}\\sim\\mu\}\\left\[R\(f\_\{\\phi\},\\pi\_\{\\theta\}\)\\right\],\(2\)whereμ\\mudenotes an unknown distribution over possible NILM attackers\. Direct optimization of Eq\. \([2](https://arxiv.org/html/2609.25484#S3.E2)\) is infeasible because the deployed attacker and the distributionμ\\muare not accessible during training\. We therefore introduce a self\-supervised aggregate\-structure privacy probe in Section[4](https://arxiv.org/html/2609.25484#S4)to provide a proxy learning signal\.

## 4Theoretical Rationale

The black\-box defense problem in Section[3](https://arxiv.org/html/2609.25484#S3)can be viewed as a physically constrained adversarial attack against NILM inference models, where the perturbation setΔbatt\\Delta\_\{\\mathrm\{batt\}\}is determined by feasible battery actions rather than norm\-bounded digital noise\. We denote the ideal expected inference risk over the attacker family byℛavg​\(πθ\)=𝔼fϕ∼μ​\[R⁡\(fϕ,πθ\)\]\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)=\\mathbb\{E\}\_\{f\_\{\\phi\}\\sim\\mu\}\[R\(f\_\{\\phi\},\\pi\_\{\\theta\}\)\]\. This quantity is the robust privacy objective in Eq\. \([2](https://arxiv.org/html/2609.25484#S3.E2)\)\. We therefore develop a computable proxy that serves as a tractable surrogate forℛavg​\(πθ\)\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\), resting on two design choices: an aggregate\-level privacy probe as the surrogate training signal, and signature mimic as the perturbation mechanism\.

#### Proxy\-guided adversarial optimization\.

We introduce an aggregate\-level privacy probefηf\_\{\\eta\}trained on aggregate load data via identity self\-supervision: the probe takes an aggregate window𝐱0\\mathbf\{x\}^\{0\}as input and is trained to reconstruct𝐱0\\mathbf\{x\}^\{0\}as output\. The probe is kept fixed during defender training\. Formally, we define the proxy inference risk as

Rp​\(πθ\)=𝔼t​\[ℒ⁡\(fη​\(𝐱tπθ\),𝐱t0\)\]\.R\_\{p\}\(\\pi\_\{\\theta\}\)=\\mathbb\{E\}\_\{t\}\\left\[\\mathcal\{L\}\\left\(f\_\{\\eta\}\(\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\_\{t\}\),\\mathbf\{x\}^\{0\}\_\{t\}\\right\)\\right\]\.\(3\)The defender is then trained to increase this proxy inference risk:

maxθ⁡Rp​\(πθ\)\.\\max\_\{\\theta\}\\ R\_\{p\}\(\\pi\_\{\\theta\}\)\.\(4\)Becausefηf\_\{\\eta\}is trained to reconstruct clean aggregate windows, a largerRp​\(πθ\)R\_\{p\}\(\\pi\_\{\\theta\}\)indicates that the masked aggregate window deviates from the clean aggregate patterns learned by the probe\. Thus,RpR\_\{p\}measures the degree to which the defender disrupts aggregate\-level temporal regularities, rather than directly estimating appliance\-level NILM error\.

We useRp​\(πθ\)R\_\{p\}\(\\pi\_\{\\theta\}\)as a computable surrogate forℛavg​\(πθ\)\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)during training\. The surrogate replaces \(i\) the appliance\-level target𝐲t\\mathbf\{y\}\_\{t\}with the aggregate𝐱t0\\mathbf\{x\}^\{0\}\_\{t\}, which is available without any appliance\-level supervision, and \(ii\) the unknown attacker distributionμ\\muwith the fixed probefηf\_\{\\eta\}\. The rationale for this substitution is that NILM attackers share a common dependence on aggregate temporal patterns, which the probe is designed to capture\.

#### Task commonality across NILM attackers\.

Although NILM attackers differ substantially in formulation—from optimization\-based disaggregation\([Hart, 1992](https://arxiv.org/html/2609.25484#bib.bib13)\)and probabilistic state\-space models\([Kolter and Jaakkola, 2012](https://arxiv.org/html/2609.25484#bib.bib21)\)to neural sequence predictors\([Kelly and Knottenbelt, 2015a](https://arxiv.org/html/2609.25484#bib.bib2)\)—they share a common premise: appliance\-level outputs are inferred from aggregate signals under the assumption that the observed aggregate is consistent with the aggregate–appliance co\-occurrence statistics seen during training or specified as a generative model\. Optimization\-based methods search for sparse signature combinations that explain the aggregate; probabilistic models treat the aggregate as an emission from a hidden appliance state with distribution learned from data; neural predictors learn a direct mapping from aggregate trajectories to appliance outputs\. In all cases, inference degrades when the reported aggregate is pushed into a region where these training\-time statistics no longer hold\. Our probefηf\_\{\\eta\}, trained to reconstruct clean aggregate windows from the same data distribution, serves as a tractable summary of these statistics\. A largeRp​\(πθ\)R\_\{p\}\(\\pi\_\{\\theta\}\)therefore certifies that𝐱tπθ\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\_\{t\}has been driven into such a region, even though the probe itself does not perform appliance\-level inference\. Pushing the masked aggregate away from these shared regularities is therefore expected to increase the inference risk of many unseen attackers inℱ\\mathcal\{F\}, providing a tractable route for increasingℛavg​\(πθ\)\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)\.

This argument aligns with the surrogate\-model principle of black\-box adversarial attacks\([Papernot et al\., 2017](https://arxiv.org/html/2609.25484#bib.bib25);[Liu et al\., 2016](https://arxiv.org/html/2609.25484#bib.bib26);[Gu et al\., 2023](https://arxiv.org/html/2609.25484#bib.bib24)\): perturbations optimized against a fixed reference model transfer to other models that share its training data and inductive biases\. Work\([Demontis et al\., 2019](https://arxiv.org/html/2609.25484#bib.bib27)\)formally show that, under linearization of the attack loss, transferability is governed by the target’s intrinsic vulnerability, the surrogate’s complexity, and the gradient alignment between surrogate and target\. Work\([Mode and Hoque, 2020](https://arxiv.org/html/2609.25484#bib.bib29)\)provide empirical evidence that the principle extends to time\-series regression: adversarial perturbations crafted on a CNN regressor transfer with substantial reconstruction\-error increase across LSTM and GRU regressors on power consumption data\. The structural condition under which this transfer provably increasesℛavg\\mathcal\{R\}\_\{\\mathrm\{avg\}\}is given in Appendix[B](https://arxiv.org/html/2609.25484#A2)\.

#### Signature mimic as a task\-aligned perturbation\.

Since NILM attackers recover appliance\-level consumption from aggregate load, an effective perturbation interferes with the appliance\-level evidence used for disaggregation rather than merely adding aggregate noise\. We construct perturbations from a library𝒮\\mathcal\{S\}of real appliance signatures:

𝐱tπθ=𝐱t0\+δsig,δsig∈Δsig,\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\_\{t\}=\\mathbf\{x\}^\{0\}\_\{t\}\+\\delta\_\{\\mathrm\{sig\}\},\\qquad\\delta\_\{\\mathrm\{sig\}\}\\in\\Delta\_\{\\mathrm\{sig\}\},\(5\)whereδsig\\delta\_\{\\mathrm\{sig\}\}is induced by feasible battery actions that replay a selected signature trajectory\.

The perturbation is therefore physically realizable while retaining appliance\-like temporal structure\. By restricting the policy to signature\-induced perturbations, the framework converts aggregate\-structure disruption into plausible but misleading appliance\-level evidence, thereby creating ambiguous disaggregation explanations for NILM attackers\. This view is consistent with a broader trend in time\-series adversarial attacks: informed, selective perturbations that exploit task structure outperform unstructured ones under fixed budgets\([Tokgoz et al\., 2026](https://arxiv.org/html/2609.25484#bib.bib30)\)\. In SM data privacy tasks, signature\-based interventions provide a structured perturbation class better matched to the NILM inference task\. The next section instantiates these principles in a hierarchical RL framework operationalizing proxy\-guided signature mimic under realistic battery constraints\.

## 5Proxy\-Guided HRL Policy Training

We instantiate the proxy\-guided signature mimicry principle in Section[4](https://arxiv.org/html/2609.25484#S4)as a hierarchical RL framework: the fixed privacy probe provides the reward signal, while the signature library defines the high\-level perturbation action space\. The defender policyπθ\\pi\_\{\\theta\}learns when to apply signature mimicry and which appliance\-like trajectory to replay, while all battery actions are executed under hard physical feasibility constraints\.

#### Proxy\-based privacy reward\.

The training objective in Eq\. \([4](https://arxiv.org/html/2609.25484#S4.E4)\) maximizes the expected proxy inference riskRp​\(πθ\)R\_\{p\}\(\\pi\_\{\\theta\}\)\. We optimize this objective with PPO by deriving a per\-step privacy reward from its instantaneous form\. Since the probefηf\_\{\\eta\}has nonzero residual reconstruction error even on clean aggregate windows in practice, we measure the defender’s contribution as the*increase*in probe error caused by signature insertion, relative to the probe’s residual on the unmodified window𝐱t0\\mathbf\{x\}^\{0\}\_\{t\}:

rtpriv=ℒ⁡\(fη​\(𝐱tπθ\),𝐱t0\)−ℒ⁡\(fη​\(𝐱t0\),𝐱t0\)\.r\_\{t\}^\{\\mathrm\{priv\}\}=\\mathcal\{L\}\\left\(f\_\{\\eta\}\(\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\_\{t\}\),\\mathbf\{x\}^\{0\}\_\{t\}\\right\)\-\\mathcal\{L\}\\left\(f\_\{\\eta\}\(\\mathbf\{x\}^\{0\}\_\{t\}\),\\mathbf\{x\}^\{0\}\_\{t\}\\right\)\.\(6\)Thus, the policy receives positive reward when the selected signature insertion makes the reported aggregate harder to reconstruct as the original clean aggregate structure under the fixed privacy probe\. Battery operation also incurs both monetary energy costCenergy​\(t\)C\_\{\\text\{energy\}\}\(t\)and battery degradation costCdeg​\(t\)C\_\{\\text\{deg\}\}\(t\)\. Hence we use the combined reward

rt=λ​rtpriv−\(1−λ\)​\(Ctenergy\+Ctdeg\),r\_\{t\}=\\lambda r\_\{t\}^\{\\mathrm\{priv\}\}\-\(1\-\\lambda\)\\left\(C\_\{t\}^\{\\text\{energy\}\}\+C\_\{t\}^\{\\text\{deg\}\}\\right\),\(7\)whereλ∈\[0,1\]\\lambda\\in\[0,1\]controls the privacy\-cost trade\-off\. The main privacy experiments useλ=1\\lambda=1, in which Eq\. \([7](https://arxiv.org/html/2609.25484#S5.E7)\) reduces to the privacy reward in Eq\. \([6](https://arxiv.org/html/2609.25484#S5.E6)\)\. The cost model is detailed in Appendix[A\.1](https://arxiv.org/html/2609.25484#A1.SS1)\.

#### Hierarchical signature mimicry policy\.

We use a signature mimicry mechanism based on a library𝒮=\{sk\}k=1K\\mathcal\{S\}=\\\{s\_\{k\}\\\}\_\{k=1\}^\{K\}, where each signaturesk=\[p1\(k\),…,pLk\(k\)\]s\_\{k\}=\[p^\{\(k\)\}\_\{1\},\\ldots,p^\{\(k\)\}\_\{L\_\{k\}\}\]is extracted from real appliance usage andLkL\_\{k\}denotes its duration\. The hierarchical policy separates high\-level signature selection from low\-level battery execution\. At each decision point, the manager observes the statests\_\{t\}, including the current load, time encoding, time\-of\-use price, battery state of charge, and remaining throughput budget, and outputs a discrete actionathigh∈\{0,1,…,2​K\}a\_\{t\}^\{\\mathrm\{high\}\}\\in\\\{0,1,\\ldots,2K\\\}\. Here,athigh=0a\_\{t\}^\{\\mathrm\{high\}\}=0denotes no mimicry; actions1,…,K1,\\ldots,Kreplay the selected signature as a charging profile, while actionsK\+1,…,2​KK\+1,\\ldots,2Kreplay the corresponding signature as a discharging profile\. The low\-level executor then replays the selected signature trajectory subject to battery feasibility constraints, including charge/discharge power limits, daily throughput budget, battery capacity, and the state\-of\-charge range\. Detailed battery dynamics and constraint enforcement are provided in Appendix[A\.2](https://arxiv.org/html/2609.25484#A1.SS2)\. If a replay trajectory violates these constraints, the executor terminates the action\. During replay, the manager remains inactive and resumes control only after the selected signature finishes or is stopped by battery constraints\.

#### Policy training and deployment\.

Only the high\-level manager is optimized in our settings\. The privacy probe is fixed, and the low\-level executor deterministically replays selected signatures under battery constraints\. We train the manager policyπθ\\pi\_\{\\theta\}with PPO using the privacy reward in Eq\. \([6](https://arxiv.org/html/2609.25484#S5.E6)\)\. After training, only the learned manager policy, the signature library, and the deterministic battery executor are deployed\. The privacy probe is used only during offline training for reward computation and is not required during deployment\. Appliance\-level labels are used only for constructing the signature library and for evaluation\. The deployed policy operates online using the observed aggregate load, battery state, time, electricity price, and remaining throughput budget, without access to the attacker’s model\. The complete hierarchical signature mimicry procedure is summarized in Appendix[C](https://arxiv.org/html/2609.25484#A3)\.

## 6Experiments

In this section, we evaluate whether a defender trained with a fixed privacy probe can generalize to heterogeneous black\-box NILM attackers\. We focus on three questions: whether the learned policy degrades unseen NILM models, whether the effect persists across datasets and test conditions, and which components of the proposed signature\-mimicry mechanism contribute to the privacy gain\. For reproducibility, the implementation code of our work will be released upon acceptance\.

#### Experimental setup\.

Below we present our experimental setting\.

Dataset\.We conduct experiments on UK\-DALE[Kelly and Knottenbelt \(2015b\)](https://arxiv.org/html/2609.25484#bib.bib3)and REDD[Kolter and Johnson \(2011\)](https://arxiv.org/html/2609.25484#bib.bib9)with consistent minute\-level preprocessing and train–test protocols\. UK\-DALE serves as the primary benchmark for black\-box NILM evaluation\. We additionally repeat the defender policy, privacy probe training, and evaluation pipeline on REDD to test whether the proposed framework remains effective under a different dataset distribution\. Full dataset details are provided in Appendix[E\.1](https://arxiv.org/html/2609.25484#A5.SS1)\.

Signature library\.We construct a trajectory\-level signature library from real appliance activations, including 10 representative short\-burst and medium\-duration patterns from intermittent high\-power appliances\. Details of signature extraction and library composition are provided in Appendix[E\.2](https://arxiv.org/html/2609.25484#A5.SS2)\. The library is constructed once from the UK\-DALE House 1 training period and then fixed across all experiments, including the unseen\-household and REDD evaluations; no appliance\-level data from the target environments are used to adapt it\.

Privacy probe\.In the main experiments, we use a Transformer\-encoder Seq2Seq \(s2s\) aggregate reconstruction model with a sequence prediction head as the privacy probe\. Detailed model architecture and training process are presented in Appendix[E\.3](https://arxiv.org/html/2609.25484#A5.SS3)\. To verify that our framework is not dependent on a specific probe architecture, we further test CNN\- and LSTM\-based probes in Sec\.[6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px4), where all three probes yield comparable defense performance\.

Evaluation attackers\.We evaluate transferability against six independently trained NILM attackers\. These attackers span five representative NILM paradigms: optimization\-based disaggregation \(CO\([Hart, 1992](https://arxiv.org/html/2609.25484#bib.bib13)\)\), probabilistic state\-space models \(FHMM\([Kolter and Jaakkola, 2012](https://arxiv.org/html/2609.25484#bib.bib21)\)\), convolutional sequence\-to\-point learning \(S2P\([Zhang et al\., 2018](https://arxiv.org/html/2609.25484#bib.bib8)\)\), denoising autoencoder\-based NILM \(DAE\([Kelly and Knottenbelt, 2015a](https://arxiv.org/html/2609.25484#bib.bib2)\)\), and Transformer\-based NILM \(ELECTRIcity\([Sykiotis et al\., 2022](https://arxiv.org/html/2609.25484#bib.bib23)\)and BERT4NILM[Yue et al\. \(2020\)](https://arxiv.org/html/2609.25484#bib.bib20)\)\. To ensure that the reported degradation reflects black\-box transfer rather than overfitting to a specific inference architecture, all attacker models are trained independently following their original settings, with minor adjustments to match our sampling rate\.

Defender training\.The defender is implemented using PPO with Stable\-Baselines3[Raffin et al\. \(2021\)](https://arxiv.org/html/2609.25484#bib.bib10)\. Unless otherwise specified, the main experiments useλ=1\\lambda=1, corresponding to the pure privacy objective in Eq\. \([6](https://arxiv.org/html/2609.25484#S5.E6)\)\. Hyperparameters, observation features, battery settings, and training details are listed in Appendix[E\.4](https://arxiv.org/html/2609.25484#A5.SS4)\.

Evaluation metrics\.Letπ0\\pi\_\{0\}denote the no\-defense policy withPbatt​\(t\)=0P\_\{\\mathrm\{batt\}\}\(t\)=0\. To quantify privacy improvement during evaluation, we measure the increase in NILM inference risk caused by the defender relative to the unmasked baseline:Δpriv​\(fϕ,πθ\)=R⁡\(fϕ,πθ\)−R⁡\(fϕ,π0\)\\Delta\_\{\\mathrm\{priv\}\}\(f\_\{\\phi\},\\pi\_\{\\theta\}\)=R\(f\_\{\\phi\},\\pi\_\{\\theta\}\)\-R\(f\_\{\\phi\},\\pi\_\{0\}\)\. Positive values ofΔpriv​\(fϕ,πθ\)\\Delta\_\{\\mathrm\{priv\}\}\(f\_\{\\phi\},\\pi\_\{\\theta\}\)indicate that the masked signal increases the attacker’s inference error compared with the original aggregate signal\. In the experiments, we mainly report RMSE increase and F1 reduction because they respectively measure degradation in appliance\-level power reconstruction and activation\-state detection\. MAE and SAE increases are reported as complementary error metrics\.

#### Main results: Black\-box transfer across NILM attackers\.

![Refer to caption](https://arxiv.org/html/2609.25484v1/figs/main_train_demo_cmyk.png)Figure 2:Illustration of the learned defender policy strategy and battery SoC on test day\.![Refer to caption](https://arxiv.org/html/2609.25484v1/figs/ukdale_main.png)

![Refer to caption](https://arxiv.org/html/2609.25484v1/figs/redd_main.png)

Figure 3:Main black\-box transfer results on UK\-DALE and REDD, averaged over five random seeds\. Top: UK\-DALE results over four target appliances and the aggregate channel\. Bottom: REDD results over five target appliances and the aggregate channel\. The proposed defense consistently increases NILM inference error and reduces appliance detection performance across six unseen attackers\.Table 1:Overall black\-box transfer performance averaged over five random seeds\.Figure[2](https://arxiv.org/html/2609.25484#S6.F2)illustrates that the learned defender selectively inserts realistic signature trajectories into the aggregate load while satisfying battery constraints\. We evaluate black\-box transfer against six unseen NILM attackers over five random seeds\. RMSE and F1 are used as the primary privacy metrics, measuring appliance\-level power reconstruction error and activation detection accuracy\.

Figure[3](https://arxiv.org/html/2609.25484#S6.F3)reports attacker–appliance\-level results on UK\-DALE and REDD\. Across both datasets, the masked signals consistently increase NILM reconstruction errors and reduce appliance detection performance\. On UK\-DALE, the defense substantially reduces F1 across all target appliances and attackers, while increasing RMSE for most attacker–appliance pairs\. The same trend holds on REDD, despite its different appliance composition and data distribution\. The only mixed cases are socket circuits, whose raw F1 scores are already low and whose composite plug\-load patterns are less aligned with single\-appliance signature mimicry\.

Table[1](https://arxiv.org/html/2609.25484#S6.T1)summarizes dataset\-level relative changes, averaged over all attacker–appliance cases and seeds, excluding the aggregate channel\. RMSE Sig\. and F1 Sig\. ratio denotes the proportion of cases with statistically significant changes\(p<0\.05p<0\.05\)\. The results show large average error increases and substantial F1 reductions on both datasets, indicating consistent degradation of unseen NILM attackers\. Overall, the REDD results reinforce our central claim that proxy\-guided signature mimicry pipeline remains effective under a different dataset distribution and transfers to different black\-box NILM settings\. Full numerical results are provided in Appendix[F\.1](https://arxiv.org/html/2609.25484#A6.SS1)

#### Comparison with existing privacy defenses\.

Table[2](https://arxiv.org/html/2609.25484#S6.T2)compares our method with random/rule\-based battery baselines and two strong SM privacy defenses, DDQL\-flat and DDQL\-MI\([Shateri et al\., 2021](https://arxiv.org/html/2609.25484#bib.bib1);[Shateri, 2023](https://arxiv.org/html/2609.25484#bib.bib18)\)\. Since existing work does not provide a directly comparable HRL and proxy\-guided defense, these methods serve as the closest baselines with the same privacy\-protection goal\. Our method achieves the strongest privacy protection, improving over DDQL\-MI by 13\.61 percentage points in RMSE increase and 6\.65 percentage points in F1 reduction\. It also yields more significant degradation cases, reaching 22/24 for RMSE and 24/24 for F1\. Meanwhile, our method has the lowest energy and total cost, and requires less training time than DDQL\-based baselines because privacy rewards are computed only when a mimic signature is inserted\. The negative energy cost is due to time\-of\-use arbitrage, where the battery charges during low\-price periods and discharges during high\-price periods\.

Table 2:Comparison with existing privacy defenses on UK\-DALE\.![Refer to caption](https://arxiv.org/html/2609.25484v1/figs/privacy_cost_pareto.png)Figure 4:Pareto frontier of privacy reward versus energy cost across theλ\\lambdasweep\.
#### Ablation studies\.

We conduct ablation studies to examine how the privacy probe architecture and signature library size affect black\-box transfer performance\. Table[4](https://arxiv.org/html/2609.25484#S6.T4)shows that Seq2Seq, LSTM, and CNN probes all yield strong black\-box transfer, with RMSE increases above 94% and F1 reductions above 77%\. Seq2Seq performs best overall, suggesting that a more expressive surrogate probe provides a stronger learning signal, but the defense is not tied to a specific probe architecture\. Table[4](https://arxiv.org/html/2609.25484#S6.T4)shows that reducing the library generally weakens privacy protection, with RMSE increase dropping from 107\.12% using 10 signatures to 66\.45% using 3 signatures\. However, the 9\-signature setting remains close to the full library, indicating that moderate pruning has limited impact while richer libraries improve mimicry diversity\.

Table 3:Effect of privacy probe architecture on UK\-DALE\.
Table 4:Effect of signature library size on UK\-DALE\.

#### Robustness and practical constraints\.

Below we provide analysis about our defender robustness and physical configuration sensitivity\.

Battery configuration sensitivity\.

Table 5:Battery configuration sensitivity on UK\-DALE\.Table[5](https://arxiv.org/html/2609.25484#S6.T5)studies the effect of battery capacityCmaxC\_\{\\max\}, power limitPmaxP\_\{\\max\}, and daily throughput budgetTmaxT\_\{\\max\}, averaged over six unseen NILM attackers and four target appliances\. Privacy protection improves substantially when capacity and throughput increase, but shows diminishing returns beyond 8 kWh capacity and 2 kW power\. Among the three factors, daily throughput budget has the strongest influence, since it directly limits how much mimic\-signature replay can be sustained within a day\.

Privacy\-cost trade\-off\.Figure[4](https://arxiv.org/html/2609.25484#S6.F4)shows that the privacy\-cost trade\-off factorλ\\lambdaprovides a smooth control knob between privacy and energy cost\. Theλ=0\\lambda=0policy minimizes energy cost through time\-of\-use arbitrage, whereasλ=1\\lambda=1maximizes privacy reward\.

Multi\-day and multi\-household robustness\.Table[6](https://arxiv.org/html/2609.25484#S6.T6)shows that the same defender generalizes without retraining across seasons, weekdays/weekends, and households\. All test days show increased RMSE and reduced F1, with F1 reduction ranging from 32\.1% to 93\.7%\. The effect size varies with appliance activity and raw NILM difficulty, so we report both raw and masked metrics rather than relying only on relative changes to avoid overstating gains on low\-error or low\-activity days\.

Table 6:Generalization across the main and UK\-DALE test days\.Table 7:Generalization across the main and REDD test days\.

## 7Conclusion

We studied black\-box NILM privacy defense under attacker uncertainty, and proposed a proxy\-guided HRL framework in which a fixed self\-supervised aggregate\-structure probe provides a surrogate training signal, while a curated signature library defines a physically realizable, task\-aligned perturbation class\. Experiments on UK\-DALE and REDD show that the learned defender transfers to six unseen NILM attackers spanning optimization\-based, probabilistic, and neural sequence architectures, and remains effective across households, seasons, and weekday/weekend conditions without retraining\. These results suggest a more general design principle for black\-box inference defense: pairing a task\-aligned surrogate signal with a structured perturbation class can yield strong cross\-attacker transfer without access to the deployed inference model\.

## 8Limitations and Future Work

Three limitations point to natural extensions\.*First*, the curated signature library has finite coverage and is most effective for intermittent high\-power appliances; composite low\-power loads such as socket circuits on REDD remain harder to mask via single\-signature mimicry\. Learning the signature library jointly with the policy, or extending it to multi\-appliance composite trajectories, is a promising direction\.

*Second*, our theoretical analysis \(Appendix[B](https://arxiv.org/html/2609.25484#A2)\) establishes a local sufficient condition for proxy\-guided improvement of the expected attacker risk; characterizing global behavior across attacker families, or quantifying the surrogate–target gap under specific NILM architectures, remains open\.

*Third*, evaluation is conducted offline against trained but fixed NILM attackers; deployment in a live SM environment would additionally require handling forecasting uncertainty in user load, online battery state estimation, and adaptive attackers that bserve the masked signal over time\. Stress\-testing the framework against adversarially adaptive NILM attackers is, in particular, an important direction for future work\.

## References

- \[1\]K\. Chen, Q\. Wang, Z\. He, K\. Chen, J\. Hu, and J\. He\(2018\)Convolutional sequence to sequence non\-intrusive load monitoring\.the Journal of Engineering2018\(17\),pp\. 1860–1864\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p1.1)\.
- \[2\]A\. Demontis, M\. Melis, M\. Pintor, M\. Jagielski, B\. Biggio, A\. Oprea, C\. Nita\-Rotaru, and F\. Roli\(2019\)Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks\.In28th USENIX security symposium \(USENIX security 19\),pp\. 321–338\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px3.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p2.1)\.
- \[3\]E\. Erdemir, P\. L\. Dragotti, and D\. Gündüz\(2019\)Privacy\-cost trade\-off in a smart meter system with a renewable energy source and a rechargeable battery\.InICASSP 2019\-2019 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),pp\. 2687–2691\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[4\]E\. Erdemir, P\. L\. Dragotti, and D\. Gündüz\(2020\)Privacy\-aware time\-series data sharing with deep reinforcement learning\.IEEE Transactions on Information Forensics and Security16,pp\. 389–401\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[5\]F\. Farokhi and H\. Sandberg\(2019\)Fisher information privacy with application to smart meter privacy using hvac units\.InPrivacy in dynamical Systems,pp\. 3–17\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[6\]F\. Farokhi\(2020\)A fundamental bound on performance of non\-intrusive load monitoring algorithms with application to smart\-meter privacy\.IFAC\-PapersOnLine53\(2\),pp\. 2280–2285\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[7\]J\. Gomez\-Vilardebo and D\. Gündüz\(2014\)Smart meter privacy for multiple users in the presence of an alternative energy source\.IEEE Transactions on Information Forensics and Security10\(1\),pp\. 132–141\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[8\]J\. Gu, X\. Jia, P\. de Jorge, W\. Yu, X\. Liu, A\. Ma, Y\. Xun, A\. Hu, A\. Khakzar, Z\. Li,et al\.\(2023\)A survey on transferability of adversarial examples across deep neural networks\.arXiv preprint arXiv:2310\.17626\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px3.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p2.1)\.
- \[9\]G\. W\. Hart\(1992\)Nonintrusive appliance load monitoring\.Proceedings of the IEEE80\(12\),pp\. 1870–1891\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p1.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p5.1)\.
- \[10\]M\. Kaselimi, E\. Protopapadakis, A\. Voulodimos, N\. Doulamis, and A\. Doulamis\(2022\)Towards trustworthy energy disaggregation: a review of challenges, methods, and perspectives for non\-intrusive load monitoring\.Sensors22\(15\),pp\. 5872\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1)\.
- \[11\]J\. Kelly and W\. Knottenbelt\(2015\)Neural nilm: deep neural networks applied to energy disaggregation\.In2nd ACM int\. conf\. on embedded systems for energy\-efficient built environments,pp\. 55–64\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p1.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p5.1)\.
- \[12\]J\. Kelly and W\. Knottenbelt\(2015\)The uk\-dale dataset, domestic appliance\-level electricity demand and whole\-house demand from five uk homes\.Scientific data2\(1\),pp\. 1–14\.Cited by:[§E\.1](https://arxiv.org/html/2609.25484#A5.SS1.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p2.1)\.
- \[13\]J\. Z\. Kolter and T\. Jaakkola\(2012\)Approximate inference in additive factorial hmms with application to energy disaggregation\.InArtificial intelligence and statistics,pp\. 1472–1482\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p1.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p5.1)\.
- \[14\]J\. Z\. Kolter and M\. J\. Johnson\(2011\)REDD: a public data set for energy disaggregation research\.InWorkshop on data mining applications in sustainability \(SIGKDD\), San Diego, CA,Vol\.25,pp\. 59–62\.Cited by:[§E\.1](https://arxiv.org/html/2609.25484#A5.SS1.p2.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p2.1)\.
- \[15\]D\. Li, Q\. Yang, F\. Zhang, Y\. Wang, Y\. Qian, and D\. An\(2023\)Research on privacy issues in smart metering system: an improved tcn\-based nilm attack method and practical drl\-based rechargeable battery assisted privacy preserving method\.IEEE Transactions on Automation Science and Engineering\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[16\]Y\. Liu, X\. Chen, C\. Liu, and D\. Song\(2016\)Delving into transferable adversarial examples and black\-box attacks\.arXiv preprint arXiv:1611\.02770\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px3.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p2.1)\.
- \[17\]G\. R\. Mode and K\. A\. Hoque\(2020\)Adversarial examples in deep learning for multivariate time series regression\.In2020 ieee applied imagery pattern recognition workshop \(aipr\),pp\. 1–10\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px3.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p2.1)\.
- \[18\]N\. Papernot, P\. McDaniel, I\. Goodfellow, S\. Jha, Z\. B\. Celik, and A\. Swami\(2017\)Practical black\-box attacks against machine learning\.InProceedings of the 2017 ACM on Asia conference on computer and communications security,pp\. 506–519\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px3.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px2.p2.1)\.
- \[19\]A\. Petralia, P\. Charpentier, Y\. Kadhi, and T\. Palpanas\(2025\)NILMFormer: non\-intrusive load monitoring that accounts for non\-stationarity\.InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V\. 2,pp\. 4761–4772\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1)\.
- \[20\]A\. Raffin, A\. Hill, A\. Gleave, A\. Kanervisto, M\. Ernestus, and N\. Dormann\(2021\)Stable\-baselines3: reliable reinforcement learning implementations\.Journal of Machine Learning Research22\(268\),pp\. 1–8\.External Links:[Link](http://jmlr.org/papers/v22/20-1364.html)Cited by:[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p6.1)\.
- \[21\]H\. Rafiq, P\. Manandhar, E\. Rodriguez\-Ubinas, O\. A\. Qureshi, and T\. Palpanas\(2024\)A review of current methods and challenges of advanced deep learning\-based non\-intrusive load monitoring \(nilm\) in residential context\.Energy and Buildings305,pp\. 113890\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1)\.
- \[22\]M\. Shateri, F\. Messina, P\. Piantanida, and F\. Labeau\(2020\)Privacy\-cost management in smart meters using deep reinforcement learning\.InIEEE PES ISGT\-Europe,pp\. 929–933\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[23\]M\. Shateri, F\. Messina, P\. Piantanida, and F\. Labeau\(2021\)Privacy\-cost management in smart meters with mutual\-information\-based reinforcement learning\.IEEE Internet of Things Journal9\(22\),pp\. 22389–22398\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px3.p1.1)\.
- \[24\]M\. Shateri\(2023\)Privacy\-cost management in smart meters: classical vs deep q\-learning with mutual information\.In2023 IEEE 11th international conference on smart energy grid engineering \(SEGE\),pp\. 109–113\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px3.p1.1)\.
- \[25\]S\. Sykiotis, M\. Kaselimi, A\. Doulamis, and N\. Doulamis\(2022\)Electricity: an efficient transformer for non\-intrusive load monitoring\.Sensors22\(8\),pp\. 2926\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p1.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p5.1)\.
- \[26\]G\. K\. Tokgoz, O\. Gungor, T\. Rosing, and B\. Aksanli\(2026\)INTARG: informed real\-time adversarial attack generation for time\-series regression\.arXiv preprint arXiv:2604\.11928\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px3.p1.1),[§4](https://arxiv.org/html/2609.25484#S4.SS0.SSS0.Px3.p2.1)\.
- \[27\]Z\. Yue, C\. R\. Witzig, D\. Jorde, and H\. Jacobsen\(2020\)Bert4nilm: a bidirectional transformer model for non\-intrusive load monitoring\.InProceedings of the 5th International Workshop on Non\-Intrusive Load Monitoring,pp\. 89–93\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p1.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p5.1)\.
- \[28\]C\. Zhang, M\. Zhong, Z\. Wang, N\. Goddard, and C\. Sutton\(2018\)Sequence\-to\-point learning with neural networks for non\-intrusive load monitoring\.InAAAI conf\. on artificial intelligence,Vol\.32\.Cited by:[§1](https://arxiv.org/html/2609.25484#S1.p1.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px1.p1.1),[§6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px1.p5.1)\.
- \[29\]J\. Zhang, C\. Lu, H\. Yi, and C\. Wu\(2025\)User\-perceptional privacy protection in nilm: a differential privacy approach\.Applied Energy382,pp\. 125233\.Cited by:[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[30\]R\. Zhang, Y\. Sun, and M\. A\. Mustafa\(2024\)Proactive load\-shaping strategies with privacy\-cost trade\-offs in residential households based on deep reinforcement learning\.In2024 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids \(SmartGridComm\),pp\. 160–166\.Cited by:[§E\.1](https://arxiv.org/html/2609.25484#A5.SS1.p1.1),[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.
- \[31\]R\. Zhang, K\. Wu, Y\. Sun, and M\. A\. Mustafa\(2024\)Privacy\-preserving load\-shaping strategies for smart meters using deep reinforcement learning\.In2024 IEEE PES Innovative Smart Grid Technologies Europe \(ISGT EUROPE\),pp\. 1–5\.Cited by:[§E\.1](https://arxiv.org/html/2609.25484#A5.SS1.p1.1),[§1](https://arxiv.org/html/2609.25484#S1.p2.1),[§2](https://arxiv.org/html/2609.25484#S2.SS0.SSS0.Px2.p1.1)\.

Appendix

## Appendix ACost Modeling and Battery Constraints

This appendix provides the battery feasibility constraints and operational cost model used in this work\. The feasibility constraints define the executable action space of the low\-level battery executor, while the cost model quantifies the economic and degradation implications of battery operation\. Unless otherwise specified, the main privacy experiments useλ=1\\lambda=1, corresponding to privacy\-focused optimization, and report electricity and battery degradation costs separately\.

### A\.1Cost Modelling: Battery Degradation and Operational Cost

Battery operation incurs both time\-of\-use electricity cost and battery degradation cost\. These quantities correspond toCtenergyC\_\{t\}^\{\\mathrm\{energy\}\}andCtdegC\_\{t\}^\{\\mathrm\{deg\}\}in Eq\. \([7](https://arxiv.org/html/2609.25484#S5.E7)\)\. In the main privacy experiments,λ=1\\lambda=1, so Eq\. \([7](https://arxiv.org/html/2609.25484#S5.E7)\) reduces to the privacy reward in Eq\. \([6](https://arxiv.org/html/2609.25484#S5.E6)\); the following costs are evaluated and reported separately\.

We adopt a time\-of\-use electricity tariffce​\(t\)c\_\{\\mathrm\{e\}\}\(t\)\. Under the sign conventionPbatt​\(t\)\>0P\_\{\\text\{batt\}\}\(t\)\>0for charging andPbatt​\(t\)<0P\_\{\\text\{batt\}\}\(t\)<0for discharging, the ToU energy cost is defined as

Ctenergy=ce​\(t\)​Δ​t​\{Pbatt​\(t\)ηc,Pbatt​\(t\)\>0\(charging\),ηd​Pbatt​\(t\),Pbatt​\(t\)<0\(discharging\),0,Pbatt​\(t\)=0\.C\_\{t\}^\{\\mathrm\{energy\}\}=c\_\{\\mathrm\{e\}\}\(t\)\\,\\Delta t\\begin\{cases\}\\dfrac\{P\_\{\\text\{batt\}\}\(t\)\}\{\\eta\_\{\\mathrm\{c\}\}\},&P\_\{\\text\{batt\}\}\(t\)\>0\\quad\\text\{\(charging\)\},\\\\\[4\.0pt\] \\eta\_\{\\mathrm\{d\}\}\\,P\_\{\\text\{batt\}\}\(t\),&P\_\{\\text\{batt\}\}\(t\)<0\\quad\\text\{\(discharging\)\},\\\\\[6\.0pt\] 0,&P\_\{\\text\{batt\}\}\(t\)=0\.\\end\{cases\}\(8\)Here,CtenergyC\_\{t\}^\{\\mathrm\{energy\}\}may take negative values, reflecting cost savings when the battery discharges to offset grid consumption during high\-price periods\. This corresponds to temporal energy shifting rather than feed\-in tariffs, as no electricity is sold back to the grid\.

For simplicity and clarity of analysis, we setηc=ηd=1\\eta\_\{\\mathrm\{c\}\}=\\eta\_\{\\mathrm\{d\}\}=1in all experiments\. Under this setting, Eq\. \([8](https://arxiv.org/html/2609.25484#A1.E8)\) simplifies to

Ctenergy=ce​\(t\)​Δ​t​Pbatt​\(t\)\.C\_\{t\}^\{\\mathrm\{energy\}\}=c\_\{\\mathrm\{e\}\}\(t\)\\,\\Delta t\\,P\_\{\\text\{batt\}\}\(t\)\.\(9\)
Battery cycling also induces long\-term degradation\. Following throughput\-based cycle aging models, the degradation cost is modeled as proportional to the processed battery energy:

Ctdeg=cdeg​\|Pbatt​\(t\)\|​Δ​t,C\_\{t\}^\{\\mathrm\{deg\}\}=c\_\{\\mathrm\{deg\}\}\\left\|P\_\{\\text\{batt\}\}\(t\)\\right\|\\Delta t,\(10\)wherecdegc\_\{\\mathrm\{deg\}\}denotes the amortized degradation cost per processed kilowatt\-hour\.

The overall operational cost at timettis therefore

Ctop=Ctenergy\+Ctdeg\.C\_\{t\}^\{\\mathrm\{op\}\}=C\_\{t\}^\{\\mathrm\{energy\}\}\+C\_\{t\}^\{\\mathrm\{deg\}\}\.\(11\)When operational costs are considered during policy optimization,CtopC\_\{t\}^\{\\mathrm\{op\}\}is combined with the privacy reward through the trade\-off coefficientλ\\lambdain Eq\. \([7](https://arxiv.org/html/2609.25484#S5.E7)\)\.

### A\.2Battery Feasibility Constraints

The masked load follows the sign convention:Pbatt​\(t\)\>0P\_\{\\text\{batt\}\}\(t\)\>0denotes battery charging and increases the reported aggregate load, whilePbatt​\(t\)<0P\_\{\\text\{batt\}\}\(t\)<0denotes battery discharging and decreases the reported aggregate load\.

All battery actions generated by the low\-level executor are subject to hard physical constraints\. First, the battery power is bounded by the maximum charging and discharging rates:

−Pmaxdis≤Pbatt​\(t\)≤Pmaxch,\-P\_\{\\max\}^\{\\mathrm\{dis\}\}\\leq P\_\{\\text\{batt\}\}\(t\)\\leq P\_\{\\max\}^\{\\mathrm\{ch\}\},\(12\)wherePmaxchP\_\{\\max\}^\{\\mathrm\{ch\}\}andPmaxdisP\_\{\\max\}^\{\\mathrm\{dis\}\}denote the maximum charging and discharging power, respectively\.

The battery state of charge evolves according to

SoCt\+1=SoCt\+ηc​\[Pbatt​\(t\)\]\+​Δ​tEmax−\[−Pbatt​\(t\)\]\+​Δ​tηd​Emax,\\mathrm\{SoC\}\_\{t\+1\}=\\mathrm\{SoC\}\_\{t\}\+\\frac\{\\eta\_\{\\mathrm\{c\}\}\[P\_\{\\text\{batt\}\}\(t\)\]\_\{\+\}\\Delta t\}\{E\_\{\\max\}\}\-\\frac\{\[\-P\_\{\\text\{batt\}\}\(t\)\]\_\{\+\}\\Delta t\}\{\\eta\_\{\\mathrm\{d\}\}E\_\{\\max\}\},\(13\)whereEmaxE\_\{\\max\}is the battery capacity,ηc\\eta\_\{\\mathrm\{c\}\}andηd\\eta\_\{\\mathrm\{d\}\}are the charging and discharging efficiencies,Δ​t\\Delta tis the sampling interval, and\[x\]\+=max⁡\(x,0\)\[x\]\_\{\+\}=\\max\(x,0\)\.

To avoid unrealistic operation near full depletion or full charge, the battery is constrained to operate within a safe state\-of\-charge range:

0\.1≤SoCt≤0\.9\.0\.1\\leq\\mathrm\{SoC\}\_\{t\}\\leq 0\.9\.\(14\)
When a daily throughput budget is used, the cumulative processed battery energy within one day is additionally constrained by

∑t∈𝒟\|Pbatt​\(t\)\|​Δ​t≤Bday,\\sum\_\{t\\in\\mathcal\{D\}\}\\left\|P\_\{\\text\{batt\}\}\(t\)\\right\|\\Delta t\\leq B\_\{\\mathrm\{day\}\},\(15\)where𝒟\\mathcal\{D\}denotes the set of timesteps within the day andBdayB\_\{\\mathrm\{day\}\}is the daily throughput budget\.

During signature replay, a high\-level action first defines a nominal battery trajectory:

P~batt\(t\+τ\)=σ\(athigh\)pτ\(k\),τ=1,…,Lk,\\tilde\{P\}\_\{\\text\{batt\}\}\(t\+\\tau\)=\\sigma\(a\_\{t\}^\{\\mathrm\{high\}\}\)p^\{\(k\)\}\_\{\\tau\},\\qquad\\tau=1,\\ldots,L\_\{k\},\(16\)whereσ⁡\(athigh\)=\+1\\sigma\(a\_\{t\}^\{\\mathrm\{high\}\}\)=\+1denotes charging andσ⁡\(athigh\)=−1\\sigma\(a\_\{t\}^\{\\mathrm\{high\}\}\)=\-1denotes discharging\. The actually executed battery actionPbatt​\(t\+τ\)P\_\{\\text\{batt\}\}\(t\+\\tau\)is obtained by enforcing the constraints in Eqs\. \([12](https://arxiv.org/html/2609.25484#A1.E12)\)–\([15](https://arxiv.org/html/2609.25484#A1.E15)\)\. If the nominal replay violates the charge/discharge power limits, the state\-of\-charge range, or the remaining throughput budget, the executor clips the action to the feasible range or terminates the replay\.

## Appendix BTheoretical Analysis for Proxy\-Guided Signature Manipulation

This appendix provides a sufficient\-condition analysis for the proxy\-guided objective used in Section[4](https://arxiv.org/html/2609.25484#S4)\. The goal is not to establish a universal guarantee for transfer to all possible NILM attackers\. Rather, the analysis formalizes a local condition under which optimizing a surrogate privacy probe can improve the expected inference risk over a heterogeneous attacker family\. This condition can be viewed as a policy\-constrained analogue of surrogate\-target alignment in transfer\-based black\-box adversarial attacks\.

### B\.1Notation and Objective

Let𝒟\\mathcal\{D\}denote the data distribution over aggregate load windows and appliance\-level targets\. For a defense policyπθ\\pi\_\{\\theta\}, let𝐱πθ\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}denote the masked aggregate window induced by feasible battery actions\. For a NILM attackerfϕf\_\{\\phi\}, the inference risk is

R⁡\(fϕ,πθ\)=𝔼\(𝐱,𝐲\)∼𝒟​\[ℒ⁡\(fϕ​\(𝐱πθ\),𝐲\)\],R\(f\_\{\\phi\},\\pi\_\{\\theta\}\)=\\mathbb\{E\}\_\{\(\\mathbf\{x\},\\mathbf\{y\}\)\\sim\\mathcal\{D\}\}\\left\[\\mathcal\{L\}\\left\(f\_\{\\phi\}\(\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\),\\mathbf\{y\}\\right\)\\right\],\(17\)whereℒ\\mathcal\{L\}measures appliance\-level reconstruction error\. The ideal robust objective under attacker uncertainty is

ℛavg​\(πθ\)=𝔼fϕ∼μ​\[R⁡\(fϕ,πθ\)\],\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)=\\mathbb\{E\}\_\{f\_\{\\phi\}\\sim\\mu\}\\left\[R\(f\_\{\\phi\},\\pi\_\{\\theta\}\)\\right\],\(18\)whereμ\\mudenotes the latent distribution over possible NILM attackers\. Sinceμ\\muis unknown during training, the defender instead optimizes the proxy risk induced by the fixed aggregate\-structure privacy probe:

Rp​\(πθ\)=R⁡\(fη,πθ\)\.R\_\{p\}\(\\pi\_\{\\theta\}\)=R\(f\_\{\\eta\},\\pi\_\{\\theta\}\)\.\(19\)
Let

zθ=ψ⁡\(𝐱πθ\)z\_\{\\theta\}=\\psi\(\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\)\(20\)denote the NILM\-relevant representation induced by the current policy\. The representation mapψ⁡\(⋅\)\\psi\(\\cdot\)is used only as an analytical abstraction of task\-level commonality among NILM attackers, rather than as an explicitly learned feature extractor shared by all models\.

For compactness, we write the representation\-level proxy risk and expected attacker\-family risk as

rp​\(zθ\)=Rp​\(πθ\),ravg​\(zθ\)=ℛavg​\(πθ\),r\_\{p\}\(z\_\{\\theta\}\)=R\_\{p\}\(\\pi\_\{\\theta\}\),\\qquad r\_\{\\mathrm\{avg\}\}\(z\_\{\\theta\}\)=\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\),\(21\)where the dependence on𝒟\\mathcal\{D\}is implicit\. The corresponding representation\-level risk gradients are

up=∇zrp​\(zθ\),uavg=∇zravg​\(zθ\)\.u\_\{p\}=\\nabla\_\{z\}r\_\{p\}\(z\_\{\\theta\}\),\\qquad u\_\{\\mathrm\{avg\}\}=\\nabla\_\{z\}r\_\{\\mathrm\{avg\}\}\(z\_\{\\theta\}\)\.\(22\)

### B\.2Policy\-Reachable Representation Directions

The defense policy cannot manipulate arbitrary directions in the representation space\. It can only induce changes through feasible battery actions, subject to capacity, power, state\-of\-charge, throughput, and cost constraints\. Therefore, the relevant transfer condition should be stated only for directions that are locally reachable by the policy\.

Let

Jθ=∂zθ∂θJ\_\{\\theta\}=\\frac\{\\partial z\_\{\\theta\}\}\{\\partial\\theta\}\(23\)denote the local policy\-to\-representation Jacobian\. The local policy\-reachable representation subspace is

𝒯θ=Range⁡\(Jθ\)\.\\mathcal\{T\}\_\{\\theta\}=\\mathrm\{Range\}\(J\_\{\\theta\}\)\.\(24\)LetPθP\_\{\\theta\}denote the orthogonal projection onto𝒯θ\\mathcal\{T\}\_\{\\theta\}\. For any representation\-level gradientuu, define its reachable component as

ureach=Pθ​u\.u^\{\\mathrm\{reach\}\}=P\_\{\\theta\}u\.\(25\)Since directions orthogonal to𝒯θ\\mathcal\{T\}\_\{\\theta\}cannot be induced by local policy changes, they do not affect the policy\-gradient update:

Jθ⊤​u=Jθ⊤​ureach\.J\_\{\\theta\}^\{\\top\}u=J\_\{\\theta\}^\{\\top\}u^\{\\mathrm\{reach\}\}\.\(26\)

### B\.3Local Surrogate\-Target Alignment

We now state a local sufficient condition connecting the proxy risk and the expected attacker\-family risk\. The condition is defined in the metric induced by the policy\-to\-representation mapping\.

Let

Mθ=Jθ​Jθ⊤M\_\{\\theta\}=J\_\{\\theta\}J\_\{\\theta\}^\{\\top\}\(27\)denote the policy\-induced metric on the reachable representation subspace\. For any two reachable representation directionsa,b∈𝒯θa,b\\in\\mathcal\{T\}\_\{\\theta\}, their corresponding policy\-gradient inner product is

⟨Jθ⊤​a,Jθ⊤​b⟩=a⊤​Mθ​b\.\\left\\langle J\_\{\\theta\}^\{\\top\}a,J\_\{\\theta\}^\{\\top\}b\\right\\rangle=a^\{\\top\}M\_\{\\theta\}b\.\(28\)
#### Condition A1: Policy\-induced structure\-to\-risk alignment\.

At the current policy parameterθ\\theta, suppose the reachable proxy\-risk direction and the reachable expected\-risk direction satisfy

\(upreach\)⊤​Mθ​uavgreach≥γ​\(upreach\)⊤​Mθ​upreach−εtr,γ\>0,\\left\(u\_\{p\}^\{\\mathrm\{reach\}\}\\right\)^\{\\top\}M\_\{\\theta\}u\_\{\\mathrm\{avg\}\}^\{\\mathrm\{reach\}\}\\geq\\gamma\\left\(u\_\{p\}^\{\\mathrm\{reach\}\}\\right\)^\{\\top\}M\_\{\\theta\}u\_\{p\}^\{\\mathrm\{reach\}\}\-\\varepsilon\_\{\\mathrm\{tr\}\},\\qquad\\gamma\>0,\(29\)whereεtr≥0\\varepsilon\_\{\\mathrm\{tr\}\}\\geq 0captures residual transfer error\.

This condition states that, after accounting for how feasible signature\-mimicry actions change aggregate structures, the probe\-risk direction is locally aligned with the expected NILM\-risk direction over the attacker family\. It does not require the probe to predict appliance\-level outputs or replicate any deployed NILM attacker\. Instead, it assumes that, within the signature\-reachable action space, aggregate structures that strongly degrade probe reconstruction are also structures that affect downstream NILM disaggregation\.

Because the attacker distributionμ\\muis unknown, this condition cannot be directly verified during training\. Its practical relevance is evaluated empirically by testing whether policies trained againstfηf\_\{\\eta\}degrade unseen NILM attackers\.

### B\.4Policy\-Level Alignment

The following proposition shows that Condition A1 directly induces alignment between the proxy\-gradient direction and the expected\-risk gradient in policy\-parameter space\.

#### Proposition 1: Policy\-level proxy alignment\.

Under Condition A1,

⟨∇θRp​\(πθ\),∇θℛavg​\(πθ\)⟩≥γ​‖∇θRp​\(πθ\)‖2−εtr\.\\left\\langle\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\),\\nabla\_\{\\theta\}\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)\\right\\rangle\\geq\\gamma\\left\\\|\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)\\right\\\|^\{2\}\-\\varepsilon\_\{\\mathrm\{tr\}\}\.\(30\)

#### Proof\.

By the chain rule and Eq\. \([26](https://arxiv.org/html/2609.25484#A2.E26)\),

∇θRp​\(πθ\)=Jθ⊤​upreach,∇θℛavg​\(πθ\)=Jθ⊤​uavgreach\.\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)=J\_\{\\theta\}^\{\\top\}u\_\{p\}^\{\\mathrm\{reach\}\},\\qquad\\nabla\_\{\\theta\}\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)=J\_\{\\theta\}^\{\\top\}u\_\{\\mathrm\{avg\}\}^\{\\mathrm\{reach\}\}\.\(31\)Therefore,

⟨∇θRp​\(πθ\),∇θℛavg​\(πθ\)⟩\\displaystyle\\left\\langle\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\),\\nabla\_\{\\theta\}\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)\\right\\rangle=⟨Jθ⊤​upreach,Jθ⊤​uavgreach⟩\\displaystyle=\\left\\langle J\_\{\\theta\}^\{\\top\}u\_\{p\}^\{\\mathrm\{reach\}\},J\_\{\\theta\}^\{\\top\}u\_\{\\mathrm\{avg\}\}^\{\\mathrm\{reach\}\}\\right\\rangle=\(upreach\)⊤​Jθ​Jθ⊤​uavgreach\\displaystyle=\\left\(u\_\{p\}^\{\\mathrm\{reach\}\}\\right\)^\{\\top\}J\_\{\\theta\}J\_\{\\theta\}^\{\\top\}u\_\{\\mathrm\{avg\}\}^\{\\mathrm\{reach\}\}=\(upreach\)⊤​Mθ​uavgreach\.\\displaystyle=\\left\(u\_\{p\}^\{\\mathrm\{reach\}\}\\right\)^\{\\top\}M\_\{\\theta\}u\_\{\\mathrm\{avg\}\}^\{\\mathrm\{reach\}\}\.\(32\)Applying Condition A1 gives

⟨∇θRp​\(πθ\),∇θℛavg​\(πθ\)⟩\\displaystyle\\left\\langle\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\),\\nabla\_\{\\theta\}\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)\\right\\rangle≥γ​\(upreach\)⊤​Mθ​upreach−εtr\\displaystyle\\geq\\gamma\\left\(u\_\{p\}^\{\\mathrm\{reach\}\}\\right\)^\{\\top\}M\_\{\\theta\}u\_\{p\}^\{\\mathrm\{reach\}\}\-\\varepsilon\_\{\\mathrm\{tr\}\}=γ​‖Jθ⊤​upreach‖2−εtr\\displaystyle=\\gamma\\left\\\|J\_\{\\theta\}^\{\\top\}u\_\{p\}^\{\\mathrm\{reach\}\}\\right\\\|^\{2\}\-\\varepsilon\_\{\\mathrm\{tr\}\}=γ​‖∇θRp​\(πθ\)‖2−εtr\.\\displaystyle=\\gamma\\left\\\|\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)\\right\\\|^\{2\}\-\\varepsilon\_\{\\mathrm\{tr\}\}\.\(33\)This proves Eq\. \([30](https://arxiv.org/html/2609.25484#A2.E30)\)\.□\\square

### B\.5Local Improvement of the Robust Objective

The previous proposition establishes policy\-level alignment\. We next state a local improvement result for a small proxy\-gradient ascent step\.

#### Condition A2: Local smoothness\.

Assume thatℛavg​\(πθ\)\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)is locallyLL\-smooth as a function ofθ\\theta\. That is, for a sufficiently small updateΔ​θ\\Delta\\theta,

ℛavg​\(πθ\+Δ​θ\)≥ℛavg​\(πθ\)\+⟨∇θℛavg​\(πθ\),Δ​θ⟩−L2​‖Δ​θ‖2\.\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\+\\Delta\\theta\}\)\\geq\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)\+\\left\\langle\\nabla\_\{\\theta\}\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\),\\Delta\\theta\\right\\rangle\-\\frac\{L\}\{2\}\\\|\\Delta\\theta\\\|^\{2\}\.\(34\)

#### Proposition 2: Proxy\-guided local improvement\.

Let the policy be updated by a small proxy\-gradient ascent step:

θ\+=θ\+η​∇θRp​\(πθ\),\\theta^\{\+\}=\\theta\+\\eta\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\),\(35\)whereη\>0\\eta\>0is the step size\. Under Conditions A1 and A2,

ℛavg​\(πθ\+\)−ℛavg​\(πθ\)≥η⁡\[γ​‖∇θRp​\(πθ\)‖2−εtr\]−L​η22​‖∇θRp​\(πθ\)‖2\.\\displaystyle\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta^\{\+\}\}\)\-\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)\\geq\\eta\\left\[\\gamma\\left\\\|\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)\\right\\\|^\{2\}\-\\varepsilon\_\{\\mathrm\{tr\}\}\\right\]\-\\frac\{L\\eta^\{2\}\}\{2\}\\left\\\|\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)\\right\\\|^\{2\}\.\(36\)Thus, for sufficiently smallη\\eta, the proxy\-guided update improves the expected attacker\-family risk whenever the surrogate\-target alignment term dominates the residual transfer error\.

#### Proof\.

Set

Δ​θ=η​∇θRp​\(πθ\)\.\\Delta\\theta=\\eta\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)\.\(37\)Substituting this update into Eq\. \([34](https://arxiv.org/html/2609.25484#A2.E34)\) gives

ℛavg​\(πθ\+\)−ℛavg​\(πθ\)\\displaystyle\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta^\{\+\}\}\)\-\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\)≥η⁡⟨∇θℛavg​\(πθ\),∇θRp​\(πθ\)⟩−L​η22​‖∇θRp​\(πθ\)‖2\.\\displaystyle\\geq\\eta\\left\\langle\\nabla\_\{\\theta\}\\mathcal\{R\}\_\{\\mathrm\{avg\}\}\(\\pi\_\{\\theta\}\),\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)\\right\\rangle\-\\frac\{L\\eta^\{2\}\}\{2\}\\left\\\|\\nabla\_\{\\theta\}R\_\{p\}\(\\pi\_\{\\theta\}\)\\right\\\|^\{2\}\.\(38\)Applying Proposition 1 yields Eq\. \([36](https://arxiv.org/html/2609.25484#A2.E36)\)\.□\\square

### B\.6Empirical evidence of Condition A1\.

Although Condition A1 cannot be directly verified at training time, its empirical implication is testable: a policy trained againstfηf\_\{\\eta\}should degrade unseen NILM attackers inℱ\\mathcal\{F\}\. The cross\-attacker transfer results in Section[6](https://arxiv.org/html/2609.25484#S6.SS0.SSS0.Px2)\(Table[1](https://arxiv.org/html/2609.25484#S6.T1)\) provide consistent evidence: across 24 attacker–appliance pairs on UK\-DALE and 30 on REDD, the proxy\-guided policy increases attacker reconstruction error by over 100% on average and reduces F1 by 80%\. This is the empirical signature ofγ\>0\\gamma\>0holding broadly across the attacker family\.

### B\.7Signature Mimic as a Structured Perturbation Class

The main text motivates signature mimic as a task\-aligned perturbation mechanism\. Here we formalize this design choice at the level of feasible perturbation classes\.

LetΔbatt\\Delta\_\{\\mathrm\{batt\}\}denote the set of perturbations that can be physically realized by the battery under capacity, power, state\-of\-charge, throughput, and cost constraints\. A generic battery\-induced perturbation satisfies

δπθ∈Δbatt\.\\delta\_\{\\pi\_\{\\theta\}\}\\in\\Delta\_\{\\mathrm\{batt\}\}\.\(39\)Signature mimic restricts this feasible set to perturbations generated by replaying trajectories from a real appliance\-signature library𝒮\\mathcal\{S\}:

Δsig=\{δ∈Δbatt:δ​is induced by replaying a selected signature​s∈𝒮\}\.\\Delta\_\{\\mathrm\{sig\}\}=\\left\\\{\\delta\\in\\Delta\_\{\\mathrm\{batt\}\}:\\delta\\text\{ is induced by replaying a selected signature \}s\\in\\mathcal\{S\}\\right\\\}\.\(40\)Thus,

Δsig⊆Δbatt\.\\Delta\_\{\\mathrm\{sig\}\}\\subseteq\\Delta\_\{\\mathrm\{batt\}\}\.\(41\)
This restriction does not make the perturbation class more general\. Instead, it makes the perturbations more task\-aligned\. The goal is not to maximize arbitrary distortion of the aggregate signal, but to introduce plausible appliance\-like decoys that interfere with NILM disaggregation\. Compared with unstructured random perturbations sampled fromΔbatt\\Delta\_\{\\mathrm\{batt\}\}, perturbations inΔsig\\Delta\_\{\\mathrm\{sig\}\}are constructed from real appliance trajectories and therefore retain appliance\-like temporal structure\.

This provides a formal interpretation of signature mimic as a structured adversarial perturbation class tailored to NILM inference\. The effectiveness of this design choice is evaluated empirically through comparisons with random or unstructured perturbation baselines and through ablations over the signature library\.

## Appendix CAlgorithm

The full training procedure is summarized in Algorithm[1](https://arxiv.org/html/2609.25484#alg1)\.

Algorithm 1Proxy\-Guided HRL Training for Signature MimicryInput:Fixed privacy probefηf\_\{\\eta\}, signature library𝒮\\mathcal\{S\}, battery environmentℰ\\mathcal\{E\} Output:Trained manager policyπθ\\pi\_\{\\theta\}

1:Initialize manager policy

πθ\\pi\_\{\\theta\}
2:foreach training episodedo

3:Reset environment and battery state

4:whileepisode not finisheddo

5:Observe state

sts\_\{t\}
6:Sample high\-level action

athigh∼πθ\(⋅\|st\)a\_\{t\}^\{\\mathrm\{high\}\}\\sim\\pi\_\{\\theta\}\(\\cdot\|s\_\{t\}\)
7:if

athigh=0a\_\{t\}^\{\\mathrm\{high\}\}=0then

8:Apply no mimic action and advance one step

9:else

10:Select the signature and replay direction from

athigha\_\{t\}^\{\\mathrm\{high\}\}
11:Replay the selected signature using the deterministic executor subject to hard battery constraints

12:endif

13:Construct the resulting masked window

𝐱tπθ\\mathbf\{x\}^\{\\pi\_\{\\theta\}\}\_\{t\}
14:Construct the corresponding unmodified window

𝐱t0\\mathbf\{x\}^\{0\}\_\{t\}
15:Compute privacy reward using Eq\. \([6](https://arxiv.org/html/2609.25484#S5.E6)\)

16:Store transition in the rollout buffer

17:endwhile

18:Update manager policy

πθ\\pi\_\{\\theta\}using PPO

19:endfor

20:Return trained policy

πθ\\pi\_\{\\theta\}

## Appendix DBroader Impact

This work develops a privacy defense for smart meter users against appliance\-level inference attacks, aiming to restore user control over fine\-grained behavioral information that smart meter deployments would otherwise expose\. The intended societal benefit is improved residential energy privacy without requiring changes to the metering infrastructure or assumptions about the deployed inference model\.

We acknowledge two potential concerns\.*Misuse risk\.*The same proxy\-guided framework that learns to inject misleading appliance signatures could in principle be repurposed to obscure malicious load patterns, such as energy theft, from utility\-side monitoring\. We note that the framework operates under hard battery feasibility constraints and does not alter the user’s actual energy consumption—only the reported aggregate trajectory\. Distinguishing legitimate privacy protection from concealment of misuse requires utility\-side detection mechanisms and is a policy\-level question beyond the scope of this work\.*Grid\-level effects\.*Wide\-scale deployment of battery\-based load shaping interacts with grid demand forecasting and could affect distribution\-network operations if adopted at scale\. Coordinated deployment protocols and forecasting\-aware extensions are an important direction for practical adoption\.

## Appendix EExperiment Settings

### E\.1Dataset Description

We evaluate our method on the UK\-DALE dataset\[[12](https://arxiv.org/html/2609.25484#bib.bib3)\], a widely used public dataset for NILM research\. It contains appliance\-level and aggregate power readings from multiple UK households\. We use data from House 1, downsampled to 1\-minute resolution, following prior works\[[30](https://arxiv.org/html/2609.25484#bib.bib12),[31](https://arxiv.org/html/2609.25484#bib.bib11)\]\. We extract 10 days of user load data \(from March 19 to March 29, 2013\) as the training set, and reserve a separate day \(March 18, 2013\) as the test set\. During attacker training, the 10\-day data is further split into a training and a cross\-validation subset \(80:20\)\. The test day is only used to evaluate the performance of the learned defender policy\.

To assess cross\-dataset applicability, we additionally conduct experiments on the REDD dataset\[[14](https://arxiv.org/html/2609.25484#bib.bib9)\]\. REDD contains aggregate and appliance\-level power measurements from multiple residential buildings in the United States\. Similar to the UK\-DALE setup, we use continuous data from Building 2, downsampled to 1\-minute resolution\. We select 11 consecutive days, using the first 10 days \(from April 19 to April 29, 2011\) for training and the 11th day \(April 30, 2011\) for testing\. The REDD dataset is used to evaluate how well the proposed defense framework performs when facing a range of mainstream NILM attackers under a different data distribution\.

### E\.2Appliance Signature Selection

We construct a trajectory\-level appliance signature library𝒮\\mathcal\{S\}from the UK\-DALE House 1 dataset, which contains power traces of 37 labeled household appliances\. All candidate and selected signatures are extracted exclusively from the UK\-DALE House 1 training period, with no temporal overlap with any evaluation day\. Once constructed, the library is frozen and reused without target\-specific adaptation\. The purpose of this library is to provide realistic appliance\-level usage patterns that can be replayed by the battery controller during mimicry\. Since NILM attackers often rely on distinctive appliance activation patterns in the aggregate load, we focus on intermittent high\-power appliances whose signatures are visually and statistically salient, such as kettles, toasters, microwaves, ovens, washer–dryers, and dishwashers\.

#### Candidate event extraction\.

We first identify the top\-6 energy\-consuming intermittent high\-power appliances and extract candidate usage trajectories from a 10\-day period\. For each appliance, we apply a threshold\-based event segmentation scheme\. A device\-specific activation threshold is used to determine whether the appliance is operating\. The appliance\-level power sequence is scanned sequentially: when the power first exceeds the threshold, a new event is initiated and its start time is recorded\. Consecutive samples above the threshold are grouped into the same event, forming a continuous usage trajectory\. The event is terminated once the power falls below the threshold\. To remove noise and spurious activations, events shorter than a predefined minimum duration are discarded\. This process yields 188 candidate appliance usage trajectories\.

#### Filtering and ranking\.

To keep the mimic actions physically meaningful and to simplify the reinforcement learning action space, we further filter the candidate trajectories by duration and power magnitude\. Specifically, we retain events whose duration is between 5 and 35 minutes and whose median power lies between 300 and 2500 W\. These constraints remove extremely short, low\-power, or unusually long events that are less suitable for battery\-based replay\.

The remaining candidates are ranked according to two criteria\. First, we prioritize trajectories with larger standard deviation, as they exhibit stronger temporal variation and therefore provide more distinctive usage patterns\. Second, we rank by median power, since higher\-power events are more visible in the aggregate load and are more likely to affect NILM inference\. To avoid the final library being dominated by a single appliance type, we impose a balancing constraint and retain at most two signatures per appliance category\. Signatures are then selected greedily from the ordered candidate list until the final library contains 10 representative trajectories\.

#### Final signature library\.

The resulting library𝒮\\mathcal\{S\}contains 10 appliance signatures covering short high\-power bursts and medium\-duration usage patterns\. Typical examples include kettle, toaster, microwave, washer\-dryer, and dishwasher signatures\. All selected signatures have durations between 5 and 35 minutes, with most concentrated in the 5–10 minute range\. In terms of power magnitude, most signatures fall between 1500 and 2500 W, corresponding to common high\-power intermittent household appliances\.

![Refer to caption](https://arxiv.org/html/2609.25484v1/figs/signature.png)Figure 5:Representative signature trajectories in the constructed signature library\. All trajectories are padded to a unified length of 35 minutes for visualization\. The signatures exhibit diverse temporal lengths, power magnitudes, and usage patterns, illustrating the diversity and realism of the signature library used for mimicry\.Figure[5](https://arxiv.org/html/2609.25484#A5.F5)visualizes representative trajectories from the final mimic library\. The selected signatures exhibit diverse temporal lengths, power magnitudes, and usage patterns, supporting realistic appliance\-level mimicry under battery control\.

### E\.3Privacy Probe Training

The architecture of the Transformer\-based Seq2Seq privacy probe model consists of a linear embedding layer projecting input to a 64\-dimensional latent space, followed by sinusoidal positional encoding\. The encoder comprises 3 Transformer layers with 4 attention heads and a dropout rate of 0\.1\. A final linear projection maps each hidden state to a 1D power prediction\.

The LSTM probe uses a two\-layer LSTM encoder with a hidden size of 64\. A single\-channel input sequence is first processed by the stacked recurrent layers, which output a 64\-dimensional hidden representation at each time step\. A final linear projection maps each hidden state to a scalar power estimate\.

The 1D\-CNN probe is built with three temporal convolutional layers\. After reshaping the input to channel\-first format, the model applies two hidden Conv1D blocks \(64 channels, kernel size 3\), each followed by ReLU activation, and a final Conv1D layer that maps features to a single output channel\. Symmetric padding is used to preserve sequence length throughout the network, and the output is reshaped back to time\-first format\.

We first generate candidate 60\-minute segments via repeated sliding\-window passes \(stride = 30 minutes\) over the 14,400\-minute \(10\-day\) period, with each pass beginning at a randomly sampled starting offset uniformly drawn from \[0, 1439\] and proceeding to the end of the sequence\. Within each pass, the first 80% of generated segments \(by temporal order\) are tentatively tagged as the training set and the last 20% as the validation set\. To eliminate leakage arising from the randomized offsets, we discard any training\-tagged segment whose end time extends into the final two validation days\(i\.e\., exceeds 11,520 minutes\), and any validation\-tagged segment whose start time extends into the first eight training days \(i\.e\., precedes 11,520 minutes\)\. This guarantees strict non\-overlap in absolute time between the training and validation sets\. The procedure repeats across independently sampled offsets until 5,000 segments are collected for each set\. The remaining one\-day data is reserved exclusively for evaluation\. The model is trained using mean squared error \(MSE\) loss as loss function\.

### E\.4Defender Training Parameters and SM environment Settings

The PPO defender training proceeds for 300 PPO episodes, with 1,440 time steps per episode \(corresponding to one full day\)\. The PPO optimizer uses a learning rate of2×10−52\\times 10^\{\-5\}, a discount factorγ=0\.99\\gamma=0\.99, GAE parameterλ=0\.95\\lambda=0\.95\. We adopt a rollout horizon of 4,096 steps, 4 optimization epochs per update, a minibatch size of 2,048, and a clipping range of 0\.1\. Entropy regularization is enabled with a coefficient of 0\.01 to encourage early exploration, and a target KL divergence of 0\.01 is used to stabilize policy updates\.

The defender operates within a simulated battery and SM environment with the following constraints: a maximum capacity of 8 kWh, peak charge/discharge power of 4 kW, and a SoC constraint between 10% and 90%\. The SoC is initialized to 50% at the beginning of each episode\. All actions are applied at 1\-minute resolution\.

### E\.5Computational resources\.

All experiments were conducted on a single NVIDIA RTX 3050 Ti GPU\. Defender training takes approximately 1\.2 hours per run; full reproduction of the main results \(both datasets, five seeds, six attackers\) requires roughly 30 GPU\-hours\.

## Appendix FOriginal Experiment results

### F\.1Detailed Main Results

Table 8:Detailed Raw, Masked, Delta, and p\-value results on UK\-DALE over five random seeds\.Table 9:Detailed Raw, Masked, Delta, and p\-value results on REDD over five random seeds\.Tables[8](https://arxiv.org/html/2609.25484#A6.T8)and[9](https://arxiv.org/html/2609.25484#A6.T9)report the detailed Raw, Masked, Delta, and p\-value results used to generate Fig\.[3](https://arxiv.org/html/2609.25484#S6.F3)\.