HXAI：分布式能源系统中的分层隐私保护可解释人工智能

# HXAI: Hierarchical Privacy-Preserving Explainable AI in Distributed Energy Systems
Source: [https://arxiv.org/html/2610.02504](https://arxiv.org/html/2610.02504)
Sabita MaharjanFrank EliassenYan Zhang††thanks:Poushali Sengupta, Sabita Maharjan, Frank Eliassen, and Yan Zhang are with the Department of Informatics, University of Oslo, 0316 Oslo, Norway\.

###### Abstract

Balancing electricity demand and supply is increasingly difficult due to the inherent intermittency of renewable power generation and the stochastic power consumption\. Grid operators require fine\-grained, decision\-relevant insights into household energy consumption to manage peak loads and design responsive tariffs, but increased transparency at this level raises significant privacy concerns\. Traditional methods for explainable AI \(XAI\) can reveal sensitive information, while standard privacy techniques often reduce the usefulness of explanations\. To address this issue, we introduce HXAI, a hierarchical framework that preserves privacy while enabling reasonable explainable analysis for grid\-level demand management\. HXAI consists of two main components: \(1\) a local model that generates fine\-grained explanations within a secure, private environment, and \(2\) a zonal model that aggregates these explanations to support grid\-level analysis while enforcing privacy through flexible privacy\-budget management\. We explicitly limit cumulative privacy exposure under repeated operator queries and show that the proposed framework preserves decision\-relevant information without compromising household privacy\. Experiments on both simulated and real\-world energy datasets demonstrate that HXAI provides useful insights for zonal load management while ensuring that appliance\-level consumption remains local and is never transmitted to grid operators\. Our results show that preserving the semantic structure of explanations, rather than minimizing numerical error, is the key to XAI under differential privacy\. This framework provides a way to achieve both privacy and explainability in energy management\.

###### Index Terms:

Explainable AI, Differential Privacy, Grid Load Balancing, Smart Grids, Smart Homes, Zonal Aggregation, Privacy\-Utility Trade\-off\.

## IIntroduction

Electricity grids worldwide are transforming due to the rapid integration of renewable energy, increased household electrification, and widespread use of IoT devices\[faghosh2019iotenergy\]\. This evolution has increased volatility in both supply and demand due to the inherent intermittency associated with renewable energy sources and increasingly dynamic patterns of household electricity consumption\.111Renewable generation introduces natural fluctuations\[[1](https://arxiv.org/html/2610.02504#bib.bib3)\], while household demand variability has intensified due to electric heating and cooling, electric vehicles, and other high\-power appliances\[[2](https://arxiv.org/html/2610.02504#bib.bib4)\]\.As a result, timely insights are critical for understanding demand spikes, since even minor changes in local consumption can lead to voltage instability and increased operational challenges\[[3](https://arxiv.org/html/2610.02504#bib.bib1)\]\.222For example, localized demand surges can trigger voltage drops on low\-voltage feeders, increase transformer loading, and necessitate conservative reserve margins to maintain grid stability\.While individual households may seem inconsequential, collectively, their behaviors can significantly influence the load curve, peak demand timing, and stress on distribution networks\[[4](https://arxiv.org/html/2610.02504#bib.bib5)\]\. Notably, high\-consumption devices such as heaters and appliances contribute to peak demand but are often hidden from grid operators due to privacy concerns of household consumption data\[[5](https://arxiv.org/html/2610.02504#bib.bib6)\]\. This lack of visibility hinders operators’ ability to anticipate surges, implement effective demand\-response programs, and design stability\-focused tariffs\[[6](https://arxiv.org/html/2610.02504#bib.bib7)\]\.

Explainable artificial intelligence \(XAI\) offers a promising way to improve understanding of energy consumption, using techniques such as SHAP and LIME to identify patterns and the contributions of appliances to demand spikes\[[7](https://arxiv.org/html/2610.02504#bib.bib9),[8](https://arxiv.org/html/2610.02504#bib.bib8)\]\. However, applying XAI at the household level is challenging due to privacy concerns, as detailed explanations can reveal sensitive data\[[9](https://arxiv.org/html/2610.02504#bib.bib38)\]\. Simply adding noise for privacy, such as Laplace noise to SHAP values, can undermine the clarity and reliability needed for decision\-making\[[10](https://arxiv.org/html/2610.02504#bib.bib10)\]\. Current privacy\-preserving methods, such as federated learning, often provide only broad statistics without in\-depth, appliance\-level insights and struggle with effective privacy management and complex queries\[[11](https://arxiv.org/html/2610.02504#bib.bib11)\]\.333These approaches typically lack explicit mechanisms for controlling cumulative privacy leakage or supporting fine\-grained explanation queries\.This leads to three key requirements: \(i\) fine\-grained, decision\-relevant explainable signals that do not expose household power consumption behavior, \(ii\) explainable zonal summaries that remain useful under privacy\-preserving noise, and \(iii\) explicit control of cumulative privacy leakage under repeated analytical queries\.

To tackle these challenges, we propose HXAI, a hierarchical framework for privacy\-preserving explainability in distributed energy systems, supporting explainable analysis for grid\-level demand management\. HXAI splits responsibilities into two layers: at the local layer, each household generates SHAP explanations of its device\-level consumption within a secure private\-databox, ensuring no raw data leakage\[[12](https://arxiv.org/html/2610.02504#bib.bib37)\]\. At the zonal layer, an aggregator receives differentially private summaries based on a dynamically negotiated privacy budget between households and the energy provider\[[13](https://arxiv.org/html/2610.02504#bib.bib34)\]\. This dynamic negotiation allows households to control their data exposure while providing operators with meaningful aggregated explanations\.

Existing privacy\-preserving explainability approaches primarily aim to minimize numerical distortion of explanations under differential privacy\. In contrast, HXAI is built around a different principle:*semantic stability of explanations*\. We argue that, under privacy constraints, preserving the*structural invariants*of explanations, such as feature identity, sign, dominance, and rank ordering, is more critical for explainability than preserving exact numerical values\[[14](https://arxiv.org/html/2610.02504#bib.bib36)\]\. HXAI operationalizes this principle through hierarchical aggregation, ensuring that appliance\-level explanations remain noise\-free within secure local environments, while only differentially private, aggregated explanation summaries are shared at the zonal level\.444Unlike federated learning, which focuses on collaborative model training via the aggregation of gradients or parameters while keeping raw data local\[[11](https://arxiv.org/html/2610.02504#bib.bib11)\], HXAI does not perform distributed model optimization but instead governs how explanations are aggregated and disclosed across system layers\.HXAI fundamentally differs in both objective and abstraction: it does not aim to learn a shared global model\. Instead, HXAI treats explanations as first\-class analytical objects\. Local models remain household\-specific, and only differentially private explanation summaries, not parameters, gradients, or predictions, are aggregated\. As a result, HXAI enables appliance\-aware explainability without requiring model alignment, shared representations, or centralized optimization, which are core assumptions in federated learning\.

HXAI also integrates a mechanism for multiple\-query privacy accounting, limiting cumulative leakage when operators issue successive queries\[[15](https://arxiv.org/html/2610.02504#bib.bib35)\]\. Once the privacy threshold is met, households can automatically deny further queries, preventing overexposure\. Theoretical analysis confirms that the aggregated SHAP explanations remain unbiased under differential privacy noise\[[13](https://arxiv.org/html/2610.02504#bib.bib34)\]\. Experimental results show that HXAI maintains explainability and utility\-preserving insights, even under strong privacy constraints, allowing grid operators to monitor behavioral trends and manage peak loads while safeguarding household privacy\.In summary, HXAI provides a principled and privacy\-safe foundation for distributed energy intelligence, addressing the trade\-off between household privacy and decision\-relevant demand analysis for grid operations\. This work makes the following key contributions toward privacy\-safe and explainable grid\-load balancing in distributed energy systems:

1. 1\.Semantic\-Stability–Preserving Explainability under Differential Privacy\.We propose HXAI, a hierarchical explainability framework that provides fine\-grained, decision\-relevant explanations while preserving semantic structure \(feature identity, ranking, and directional influence\) under differential privacy\.
2. 2\.Adaptive, Query\-Aware Privacy Control\.HXAI introduces anInformation Control Agreement \(ICA\)that governs permitted queries, output granularity, and cumulative privacy budgets to control long\-term privacy leakage under repeated analysis\.
3. 3\.Utility\-Preserving Zonal Visibility with Guarantees\.We provide theoretical and empirical evidence that HXAI maintains stable, useful zonal explanations even when individual contributions are protected by privacy\-preserving noise\.

Collectively, these contributions establish HXAI as a practical and theoretically grounded foundation for privacy\-preserving, explainable, and operationally relevant demand analysis for distributed smart\-home environments\.

## IIRelated Work

Since this work lies at the intersection of explainable AI, privacy, and smart energy systems\[[16](https://arxiv.org/html/2610.02504#bib.bib2),[4](https://arxiv.org/html/2610.02504#bib.bib5)\], we organize the related literature into three themes: \(i\) explainable AI for energy systems, \(ii\) privacy\-preserving machine learning, and \(iii\) differential privacy and hierarchical architectures for distributed analytics\. We discuss the limitations of existing approaches and show how they motivate the hierarchical, privacy\-aware design of HXAI\.

Explainable artificial intelligence \(XAI\) has been applied in energy forecasting, home automation, and demand\-response analytics\[[17](https://arxiv.org/html/2610.02504#bib.bib12)\]\. Techniques such as SHAP, LIME, and various feature\-attribution methods offer transparency into the temporal or appliance\-level signals that influence energy consumption\[[7](https://arxiv.org/html/2610.02504#bib.bib9),[8](https://arxiv.org/html/2610.02504#bib.bib8)\]\. Previous studies have utilized these techniques on smart\-meter data or building\-level loads to enhance explainability\[[18](https://arxiv.org/html/2610.02504#bib.bib13)\]\. However, existing XAI implementations face two main structural limitations: \(i\) explanations are typically generated centrally, necessitating access to raw household data; and \(ii\) the resulting explanations are directly influenced by fine\-grained behavioural patterns, potentially revealing occupancy and appliance\-usage routines\[[5](https://arxiv.org/html/2610.02504#bib.bib6)\]\.To the best of our knowledge, there is no prior work that provides fine\-grained, device\-level explainability for high\-impact residential loads while simultaneously ensuring household privacy\. Moreover, existing XAI approaches in smart energy systems are largely disconnected from operational demand\-management needs, where understanding the contribution of major household loads \(e\.g\., heating, cooling, and electric vehicles\) is essential for explaining peak demand, yet cannot be directly exposed due to privacy constraints\.

Privacy\-preserving machine learning has advanced notably through cryptographic and system\-level techniques such as secure multi\-party computation \(SMPC\), homomorphic encryption \(HE\), and trusted execution environments\[[19](https://arxiv.org/html/2610.02504#bib.bib14),[20](https://arxiv.org/html/2610.02504#bib.bib15),[12](https://arxiv.org/html/2610.02504#bib.bib37)\]\. While HE and SMPC provide strong guarantees for protecting raw data during distributed computation, their primary objective is data confidentiality rather than explainability\. Applying HE or SMPC to explanation mechanisms such as SHAP would require encrypted evaluation of high\-dimensional attribution functions across many coalitions, leading to substantial computational and communication overhead\[[21](https://arxiv.org/html/2610.02504#bib.bib16)\]\. This renders such approaches impractical for real\-time or repeated explainability queries in smart\-grid settings\.555More importantly, cryptographic methods do not address explanation\-specific challenges, such as preserving feature identity, rank ordering, and directional influence under repeated queries\. While intermediate values are hidden, these methods provide no mechanism for bounding cumulative information leakage or for negotiating privacy–utility trade\-offs over time\[[13](https://arxiv.org/html/2610.02504#bib.bib34)\]\.HXAI therefore adopts a complementary approach: rather than encrypting all computation, it treats explanations as first\-class analytical objects, generated locally within each household, and enforces privacy at the explanation interface through differential privacy and query\-aware accounting before any aggregated information is shared\.

Federated learning approaches ensure that raw data remains on\-site while models are collaboratively trained\[[11](https://arxiv.org/html/2610.02504#bib.bib11)\]\. However, they lack mechanisms for sharing appliance\-level explainable signals with grid operators, and existing explanation methods for federated models remain coarse\-grained and largely disconnected from household\-specific or device\-level operational insights\[[22](https://arxiv.org/html/2610.02504#bib.bib17)\]\. Local differential privacy \(LDP\) provides robust individual privacy by adding noise before data is shared\[[23](https://arxiv.org/html/2610.02504#bib.bib18)\]\. While helpful in obtaining coarse statistics, LDP disrupts the fine\-grained structure necessary for explainability, making it unsuitable for SHAP\-based device attribution\[[24](https://arxiv.org/html/2610.02504#bib.bib19)\]\. Existing privacy\-preserving XAI methods in sectors such as healthcare and finance aim to mask individual contributions\[[25](https://arxiv.org/html/2610.02504#bib.bib20)\]\.666However, none address the unique needs of distributed energy intelligence or the requirement for hierarchical explainability\. These requirements differ from other domains because distributed energy systems must reconcile fine\-grained, device\-level reasoning with strict privacy constraints and multi\-level aggregation across households and grid regions\.

DP has been widely utilised in statistical aggregation, smart meter summarization, and distributed load forecasting\[[26](https://arxiv.org/html/2610.02504#bib.bib29),[27](https://arxiv.org/html/2610.02504#bib.bib30)\]\. However,\(i\) DP aggregation typically yields scalar or coarse\-level summaries, notexplainableoutputs\. \(ii\) DP methods assume static privacy budgets and do not address repeated queries\. \(iii\) No DP framework to date supportsSHAP\-level explainabilitywith controlled leakage across a hierarchy\.Edge\-based and hierarchical architectures\[[28](https://arxiv.org/html/2610.02504#bib.bib31),[29](https://arxiv.org/html/2610.02504#bib.bib32)\]enable privacy\-sensitive processing close to the data source\. Several studies propose smart grid aggregation schemes\[[30](https://arxiv.org/html/2610.02504#bib.bib33)\]and zonal\-level forecasting using HE\. However, these systems: provide no mechanisms forlocal explainability, lackdifferentially private explanation aggregation, assume static privacy constraints, and do not integratedynamic privacy\-budget negotiation\. To the best of our knowledge, existing architectures do not jointly provide \(i\) noise\-free, explainability\-rich household reports and \(ii\) differentially private, appliance\-aware zonal summaries suitable for distributed energy analysis\. Table[I](https://arxiv.org/html/2610.02504#S2.T1)summarizes how existing methods differ from HXAI\.

TABLE I:Comparison of HXAI with Existing Privacy and XAI FrameworksOur research expands the concept of DP into the area of explainability and introduces a new query\-level leakage bound, which is vital for practical applications in grid operations\. The framework, HXAI, offers a unique combination of features: local, noise\-free appliance\-level explainability; differential privacy for zonal explainability; dynamic privacy\-budget negotiation; and cumulative leakage control for multi\-query analytics\. This comprehensive approach enables privacy\-safe and explainable analysis of energy demand in distributed systems, addressing a gap in existing work related to planning, monitoring, and diagnostic decision support, for example, identifying the dominant contributors to recurring evening demand peaks at the neighborhood level without exposing individual household behavior, rather than real\-time grid control\. To formalize the deployment assumptions and the privacy risks considered in this work, we next describe the system architecture and the corresponding threat model\. For clarity, Table[II](https://arxiv.org/html/2610.02504#S2.T2)summarizes the notation used throughout the system model, theoretical analysis, and experimental evaluation\.

TABLE II:Notation used throughout HXAI
## IIISystem Model and Threat Model

We consider a distributed smart\-grid environment composed ofHHhouseholds, a zonal edge server operated by the electricity provider, and an optional cloud backend used only for non\-sensitive aggregation\[[16](https://arxiv.org/html/2610.02504#bib.bib2),[4](https://arxiv.org/html/2610.02504#bib.bib5)\]\. The objective is to enable device\-level explainability for grid\-load balancing while ensuring that no household reveals private behavioural patterns or appliance routines\[[5](https://arxiv.org/html/2610.02504#bib.bib6)\]\. In this section we formalize the data components, entities, communication channels, and privacy assumptions of the HXAI architecture\.

### III\-ASystem Entities and Trust Assumptions

The HXAI framework consists of multiple interacting entities that collectively enforce explainability, privacy preservation, and controlled data access across distributed energy environments\[[32](https://arxiv.org/html/2610.02504#bib.bib25)\]\. We explicitly define each entity, its responsibilities, and the associated trust assumptions\.

##### Querying Entity

A*Querying Entity*u∈\{1,…,U\}u\\in\\\{1,\\dots,U\\\}denotes an authorized external stakeholder, such as an energy service provider, grid operator, electricity provider, or accredited analyst, that issues explainability queries over aggregated household\-level data\[[6](https://arxiv.org/html/2610.02504#bib.bib7),[4](https://arxiv.org/html/2610.02504#bib.bib5)\]\. Querying entities operate in a planning, monitoring, and diagnostic capacity, for example by analyzing contributors to recurring demand peaks, assessing behavioral responses to tariff policies, forecasting localized demand trends, or evaluating appliance\-upgrade programs\. Querying entities do not have direct access to raw consumption data or noise\-free local explanations and interact with the system exclusively through formally specified, ICA\-governed queries\. Queries may be general, yielding zonal summaries, or more specific, requesting appliance\-level signals subject to higher privacy cost\. Querying entities are assumed to be*honest\-but\-curious*: they follow prescribed protocols but may attempt to infer additional information from received outputs\[[19](https://arxiv.org/html/2610.02504#bib.bib14)\]\.

##### Household

A*Household*i∈\{1,…,H\}i\\in\\\{1,\\dots,H\\\}denotes a residential unit equipped with smart energy devices and a local explainability module operating within a private environment\. Households retain full access to their own raw consumption data and noise\-free local explanations, which are never directly exposed outside the household boundary\. Each household specifies privacy constraints governing the release of aggregated or explained information and is treated as a protected entity in the system\. Depending on the application, a household may also act as a querying entity—for example, when requesting explainability summaries over a local neighborhood or community—subject to the same authentication and privacy controls as external querying entities\.

##### Authenticator\.

The*Authenticator*is responsible for identity verification, access control, and session management\[[33](https://arxiv.org/html/2610.02504#bib.bib22)\]\. It validates credentials and ensures that only authorized*querying entities*uumay initiate explainability queries\. The Authenticator does not access private data or explanation outputs; its role is limited to verifying identities and binding authenticated querying entities to their corresponding Information Control Agreements \(ICAs\)\. We assume the Authenticator to be trusted for correctness but not for data confidentiality\.

##### Information Control Agreement \(ICA\)\.

An*Information Control Agreement \(ICA\)*is a formal, machine\-explainable contract that governs the execution of explainability queries issued by an authorized*querying entity*\. Letu∈\{1,…,U\}u\\in\\\{1,\\dots,U\\\}index the set of authorized querying entities\. Each querying entityuuis associated with an ICA, represented as

ICAu=\(𝒬u,εumax,𝒪u,Tu\)\.\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathrm\{ICA\}\_\{u\}=\\big\(\\mathcal\{Q\}\_\{u\},\\;\\varepsilon\_\{u\}^\{\\max\},\\;\\mathcal\{O\}\_\{u\},\\;T\_\{u\}\\big\)\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathrm\{ICA\}\_\{u\}=\\big\(\\mathcal\{Q\}\_\{u\},\\;\\varepsilon\_\{u\}^\{\\max\},\\;\\mathcal\{O\}\_\{u\},\\;T\_\{u\}\\big\)\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\mathrm\{ICA\}\_\{u\}=\\big\(\\mathcal\{Q\}\_\{u\},\\;\\varepsilon\_\{u\}^\{\\max\},\\;\\mathcal\{O\}\_\{u\},\\;T\_\{u\}\\big\)\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\mathrm\{ICA\}\_\{u\}=\\big\(\\mathcal\{Q\}\_\{u\},\\;\\varepsilon\_\{u\}^\{\\max\},\\;\\mathcal\{O\}\_\{u\},\\;T\_\{u\}\\big\)\.$\}\}\}\(1\)
Here,𝒬u\\mathcal\{Q\}\_\{u\}specifies the permitted query types and scope \(e\.g\., general or specific queries\),εumax\\varepsilon\_\{u\}^\{\\max\}denotes the maximum cumulative privacy budget allocated to querying entityuu,𝒪u\\mathcal\{O\}\_\{u\}defines the allowed output granularity, andTuT\_\{u\}is the validity period of the agreement\. The ICA specifies an upper boundεumax\\varepsilon\_\{u\}^\{\\max\}on the cumulative privacy loss that may be incurred through queries issued byuu, where smaller values ofε\\varepsiloncorrespond to stronger privacy guarantees\. Individual queriesq∈𝒬uq\\in\\mathcal\{Q\}\_\{u\}incur a privacy costε⁡\(q\)\\varepsilon\(q\), determined by the query’s granularity and potential information leakage, and are charged against this bound\. In addition, each householdi∈\{1,…,H\}i\\in\\\{1,\\dots,H\\\}is treated as a protected entity that may impose its own privacy constraint by specifying a maximum permissible privacy lossεimax\\varepsilon\_\{i\}^\{\\max\}\. A query is executed only if its cumulative privacy cost satisfies both the querying entity’s privacy constraintεumax\\varepsilon\_\{u\}^\{\\max\}and the privacy constraints of all affected households\. General queries incur lower privacy cost, while specific appliance\-level queries consume a higher privacy budget\[[13](https://arxiv.org/html/2610.02504#bib.bib34)\]\. This structure enables fine\-grained, query\-aware privacy accounting under the ICA\. ICAs are established through an explicit negotiation phase, during which privacy–utility trade\-offs are adjusted within predefined system\-level and household\-level constraints\[[34](https://arxiv.org/html/2610.02504#bib.bib23)\]\. Once finalized, an ICA serves as a binding policy artifact that constrains all subsequent query executions associated with querying entityuuand enables cumulative query\-level privacy accounting\. Each ICA is bound to a unique household–Private Data Box pair, ensuring that privacy budgets are enforced independently for each household\.

##### Data Dealer\.

The*Data Dealer*acts as a policy gatekeeper and compliance authority, analogous to data governance and consent\-management components in privacy\-aware systems\[[35](https://arxiv.org/html/2610.02504#bib.bib24)\]\. It evaluates negotiated Information Control Agreements \(ICAs\) and determines whether they satisfy regulatory, contractual, and system\-level constraints before approval\. The Data Dealer does not execute queries or process household data directly; instead, it ensures that only ICAs conforming to organizational policies and cumulative privacy\-loss constraints are admitted for execution\. We assume the Data Dealer to be trusted for policy enforcement but not for access to private data or explanations\.

##### Private Data Box\.

Each householdi∈\{1,…,H\}i\\in\\\{1,\\dots,H\\\}is equipped with a*Private Data Box*, which hosts local prediction models and explanation mechanisms within a private execution environment\[[32](https://arxiv.org/html/2610.02504#bib.bib25)\]\. The Private Data Box is responsible for local model inference, explanation generation, and enforcement of household\-specific privacy constraints specified by approved ICAs\. In this work, the Private Data Box is treated as a*trusted black\-box component*\. We assume the availability of industry\-standard trusted execution environments \(TEEs\)\[[12](https://arxiv.org/html/2610.02504#bib.bib37),[31](https://arxiv.org/html/2610.02504#bib.bib26),[36](https://arxiv.org/html/2610.02504#bib.bib27),[37](https://arxiv.org/html/2610.02504#bib.bib28)\]that provide confidentiality of household data, integrity of executed code, and controlled release of differentially private outputs\.

##### Zonal Aggregator\.

The*Zonal Aggregator*collects explanation summaries released by multiple Private Data Boxes and produces aggregated, zonal\-level explanations under differential privacy\[[26](https://arxiv.org/html/2610.02504#bib.bib29)\]\. Aggregation is performed exclusively over privacy\-preserving outputs that comply with the active ICAs, ensuring that raw consumption data and noise\-free household\-level explanations never leave the household boundary\. The Zonal Aggregator is assumed to be untrusted with respect to household data and explanations: it is not granted access to raw data or noise\-free outputs and operates only on differentially private summaries\. Correct noise calibration and privacy enforcement are performed at the household level within the Private Data Boxes, while the Zonal Aggregator is assumed only to execute the specified aggregation\.

### III\-BTrust Boundaries and Threat Model

HXAI enforces a strict separation between trusted and untrusted components\. Household\-level data and noise\-free explanations remain confined within Private Data Boxes, while only differentially private summaries that satisfy household\-imposed constraints and approved ICAs are exposed beyond this boundary\[[38](https://arxiv.org/html/2610.02504#bib.bib21)\]\. Trusted components \(Authenticator, Data Dealer, and Private Data Boxes\) are assumed to execute correctly and never release raw data or noise\-free explanations\. HXAI adopts a semi\-honest \(honest\-but\-curious\) threat model consistent with the differential privacy literature\. Adversaries—including querying entities and aggregators—may observe all differentially private zonal outputs, combine reports across households, and issue repeated queries to infer sensitive household information or re\-identify households through cumulative leakage\. Communication is assumed to be encrypted, and differential privacy noise is applied before any information leaves the household boundary\. Attacks on hardware security primitives and side\-channel leakage are outside the scope of this work\. Under these assumptions, HXAI enforces event\-level differential privacy within households while providing privacy guarantees at the zonal interface\.

Client / Grid Operator\(Issues explainability queries\)Authenticator\(Identity & access verification\)ICA Proposal\(Query scope, privacy budget, purpose\)ICA Negotiation\(Privacy–utility trade\-off\)Revised ICAData Dealer Approval\(Policy & compliance gate\)Private Data Box \(TEE\)Local model inferenceNoise\-free SHAP \(local\)Differential privacy enforcementZonal Aggregator\(Aggregates DP explanations\)Noise\-injected Zonal Report\(Returned to client\)Trusted Execution Boundary

Fig\. 1:End\-to\-end HXAI workflow\. Queries are authorized via an Information Control Agreement \(ICA\) and executed inside a trusted Private Data Box\. Local explanations remain noise\-free, while only differentially private summaries are aggregated at the zonal level\.
### III\-CData Model

We consider a distributed setting in which each householdi∈\{1,…,H\}i\\in\\\{1,\\dots,H\\\}continuously records a multivariate time series of energy measurements from IoT\-enabled devices,

Dlocal,i=\{xi,t∈ℝd∣t=1,…,T\},\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle D\_\{\\mathrm\{local\},i\}=\\\{x\_\{i,t\}\\in\\mathbb\{R\}^\{d\}\\mid t=1,\\dots,T\\\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle D\_\{\\mathrm\{local\},i\}=\\\{x\_\{i,t\}\\in\\mathbb\{R\}^\{d\}\\mid t=1,\\dots,T\\\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle D\_\{\\mathrm\{local\},i\}=\\\{x\_\{i,t\}\\in\\mathbb\{R\}^\{d\}\\mid t=1,\\dots,T\\\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle D\_\{\\mathrm\{local\},i\}=\\\{x\_\{i,t\}\\in\\mathbb\{R\}^\{d\}\\mid t=1,\\dots,T\\\},$\}\}\}\(2\)wheredddenotes the number of device categories andTTthe number of observed time points\. We do not assume that all households possess the same set of devices\. Instead, each household observes a household\-specific subset of appliances\. For notational convenience and to enable aggregation, all local explanations are embedded into a commondd\-dimensional device\-category space, where devices not present in a given household are represented by zeros\. This representation allows heterogeneous households to be aggregated consistently at the zonal level without revealing device ownership\. Using this local data, each household trains a predictive model

Y^local,i=flocal,i​\(Dlocal,i\),\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\widehat\{Y\}\_\{\\mathrm\{local\},i\}=f\_\{\\mathrm\{local\},i\}\(D\_\{\\mathrm\{local\},i\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\widehat\{Y\}\_\{\\mathrm\{local\},i\}=f\_\{\\mathrm\{local\},i\}\(D\_\{\\mathrm\{local\},i\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\widehat\{Y\}\_\{\\mathrm\{local\},i\}=f\_\{\\mathrm\{local\},i\}\(D\_\{\\mathrm\{local\},i\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\widehat\{Y\}\_\{\\mathrm\{local\},i\}=f\_\{\\mathrm\{local\},i\}\(D\_\{\\mathrm\{local\},i\}\),$\}\}\}\(3\)which forecasts short\-term electricity demand, such as next\-hour or next\-day consumption\. To explain these predictions, appliance\-level SHAP attributions are computed locally\. For a given householdiiat timett, the local SHAP explanation is defined as the vector

SHAPlocal,i​\(xi,t\)=\(ϕi,1,t​xi,1,t,…,ϕi,d,t​xi,d,t\)∈ℝd,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)=\\big\(\\phi\_\{i,1,t\}x\_\{i,1,t\},\\dots,\\phi\_\{i,d,t\}x\_\{i,d,t\}\\big\)\\in\\mathbb\{R\}^\{d\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)=\\big\(\\phi\_\{i,1,t\}x\_\{i,1,t\},\\dots,\\phi\_\{i,d,t\}x\_\{i,d,t\}\\big\)\\in\\mathbb\{R\}^\{d\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)=\\big\(\\phi\_\{i,1,t\}x\_\{i,1,t\},\\dots,\\phi\_\{i,d,t\}x\_\{i,d,t\}\\big\)\\in\\mathbb\{R\}^\{d\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)=\\big\(\\phi\_\{i,1,t\}x\_\{i,1,t\},\\dots,\\phi\_\{i,d,t\}x\_\{i,d,t\}\\big\)\\in\\mathbb\{R\}^\{d\},$\}\}\}\(4\)where the termϕi,k,t​xi,k,t\\phi\_\{i,k,t\}x\_\{i,k,t\}represents the model\-weighted explanatory contribution of devicekkto the predicted consumption at timett\. Here,xi,k,tx\_\{i,k,t\}denotes the observed energy usage of devicekk, while the SHAP coefficientϕi,k,t\\phi\_\{i,k,t\}captures the relevance assigned to that device by the predictive model in the given context\. Their product therefore quantifies the explanatory impact of devicekkon the prediction, rather than raw consumption alone\. These explanations remain noise\-free and are accessible only within the household’s Private Data Box\.

We emphasize that raw device\-level consumptionxi,tx\_\{i,t\}and SHAP attributions serve fundamentally different purposes\. Whilexi,tx\_\{i,t\}reports observed energy usage per device, SHAP attributions explain how each device contributes to the model’s prediction at timett, accounting for feature interactions, correlations, and nonlinear model behavior\. As such, SHAP explains the predictive mechanism rather than the measurement itself\.777Local SHAP explanations enable households to understand which appliances actively drive predicted demand peaks or price\-relevant forecasts, as opposed to devices that merely consume energy without influencing the prediction\. For example, a household may observe that a washing machine has lower average energy consumption than electric heating, yet receives a higher SHAP contribution during peak\-price hours because its operation coincides with critical demand periods\. This distinction cannot be inferred from raw consumption alone, but is immediately visible through SHAP\-based explanations\. Such insights allow households to take informed actions, such as rescheduling appliance usage, adjusting operating durations, or prioritizing efficiency upgrades for devices with the highest explanatory impact on demand\- or price\-sensitive forecasts\.Finally, SHAP provides a normalized, additive explanation representation that can be meaningfully aggregated across households\. This property is essential for constructing zonal\-level explanations under differential privacy, whereas raw consumption data cannot be safely or meaningfully aggregated for explainability without revealing sensitive behavioral patterns\.

### III\-DHierarchical Aggregation Model

At the zonal level, individual household explanations are never revealed\. Instead, zonal explanations are constructed by aggregating differentially private local SHAP values,

SHAPzonal=∑i=1H⁡\(∑t=1T⁡SHAPlocal,i​\(xi,t\)\+ηi\),\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathrm\{SHAP\}\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\left\(\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)\+\\eta\_\{i\}\\right\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathrm\{SHAP\}\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\left\(\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)\+\\eta\_\{i\}\\right\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\mathrm\{SHAP\}\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\left\(\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)\+\\eta\_\{i\}\\right\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\mathrm\{SHAP\}\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\left\(\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\mathrm\{SHAP\}\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)\+\\eta\_\{i\}\\right\),$\}\}\}\(5\)whereηi∈ℝd\\eta\_\{i\}\\in\\mathbb\{R\}^\{d\}denotes a Laplace noise vector calibrated according to the household’s negotiated privacy loss parameterεiadjust\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}\. This hierarchical structure ensures that explainability at the household level remains noise\-free, while explainability at the zonal level is protected by differential privacy, and only aggregated explanations contribute to downstream analysis\. Each householdiiselects an initial privacy constraintεiinit\\varepsilon\_\{i\}^\{\\mathrm\{init\}\}and receives a utility–risk estimate derived from the anticipated explainability output\. We distinguish clearly between*households*and*querying entities*\. A householdiidenotes a data owner equipped with a Private Data Box and associated privacy constraints, whereas a querying entityuurefers to an authorized external actor \(e\.g\., an energy service provider\) that issues explainability queries under an Information Control Agreement \(ICA\)\. A negotiation mechanism determines an adjusted household privacy level

εiadjust∈\(εiopt−ℓ,εiopt\),\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}\\in\(\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\-\\ell,\\;\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}\\in\(\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\-\\ell,\\;\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}\\in\(\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\-\\ell,\\;\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}\\in\(\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\-\\ell,\\;\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}\),$\}\}\}\(6\)whereεiopt\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}denotes the household\-specific privacy loss level that maximizes explanation utility subject to declared privacy preferences\. In practice, this value is obtained via bounded search or feedback\-based negotiation, where the household evaluates the utility–risk trade\-off of candidate privacy levels proposed by the querying entity\. The relaxation parameterℓ\\elldefines a small admissible interval aroundεiopt\\varepsilon\_\{i\}^\{\\mathrm\{opt\}\}to allow flexibility under repeated queries and to ensure stable operation over time\. Importantly, participation in the negotiation process is voluntary and bounded by household\-defined privacy limits\. A household is never forced to accept a weaker privacy guarantee than its stated preference; if no agreement is reached, the system defaults to stricter privacy with reduced explanatory utility\.

### III\-EQuery Model

We distinguish between two classes of queries issued by querying entities:General Queries \(qgenq^\{\\mathrm\{gen\}\}\)aggregate zonal summaries \(e\.g\., demand trends, peak shapes, dominant appliance categories\) that incur a lower privacy cost than appliance\-level queries, whileSpecific Queries \(qspecq^\{\\mathrm\{spec\}\}\)perform appliance\-level diagnostics, behavioral elasticity analysis, and evaluation of incentive effects\. Due to their finer granularity, these queries incur a higher privacy costε\\varepsilon\. For a sequence ofnnqueries affecting householdii, the cumulative privacy loss is defined as

Litotal=∑j=1n⁡εi,jadjust\.\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\}\(7\)Once the cumulative privacy lossLitotalL\_\{i\}^\{\\mathrm\{total\}\}reaches or exceeds the negotiated threshold, further queries affecting householdiiare automatically denied by the Private Data Box\.

## IVMethodology and Theoretical Foundations

HXAI integrates household\-level explainability, differentially private zonal aggregation, and multi\-query privacy accounting into a unified hierarchical architecture\. This section formalizes the computational pipeline, introduces theoretical guarantees for privacy\-preserving explainability, and describes the differential privacy mechanisms, aggregation rules, and privacy\-budget negotiation strategy used to enable explainable and privacy\-safe analysis of distributed energy demand\. Throughout the analysis, we assume bounded SHAP attribution vectors with finiteℓ1\\ell\_\{1\}norm and non\-degenerate zonal explanations \(‖Strue‖2≥c\>0\\\|S\_\{\\mathrm\{true\}\}\\\|\_\{2\}\\geq c\>0\)\. This non\-degeneracy assumption excludes trivial cases in which all appliance\-level contributions vanish at the zonal level and holds whenever at least one appliance exhibits non\-negligible explanatory influence on aggregate demand, which is typical in realistic energy systems\. All expectations are taken with respect to the randomness of the Laplace mechanism, conditioned on the observed household datasets\. We begin at the household level, where each householdii, fori∈\{1,…,H\}i\\in\\\{1,\\dots,H\\\}, models and explains its own energy consumption using local data and computation within its Private Data Box\.

###### Definition 1\(Local Explainability\)\.

Letflocal,if\_\{\\mathrm\{local\},i\}denote the prediction model of householdiiand let

Y^i,t=flocal,i​\(xi,t\),\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\widehat\{Y\}\_\{i,t\}=f\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\widehat\{Y\}\_\{i,t\}=f\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\widehat\{Y\}\_\{i,t\}=f\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\widehat\{Y\}\_\{i,t\}=f\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\),$\}\}\}\(8\)wherexi,t∈ℝdx\_\{i,t\}\\in\\mathbb\{R\}^\{d\}represents appliance\-level readings at timett\. Local explainability is achieved by computing SHAP attributions

ϕi,k,t=SHAPflocal,i​\(xi,k,t\),\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\phi\_\{i,k,t\}=\\mathrm\{SHAP\}\_\{f\_\{\\mathrm\{local\},i\}\}\(x\_\{i,k,t\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\phi\_\{i,k,t\}=\\mathrm\{SHAP\}\_\{f\_\{\\mathrm\{local\},i\}\}\(x\_\{i,k,t\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\phi\_\{i,k,t\}=\\mathrm\{SHAP\}\_\{f\_\{\\mathrm\{local\},i\}\}\(x\_\{i,k,t\}\),$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\phi\_\{i,k,t\}=\\mathrm\{SHAP\}\_\{f\_\{\\mathrm\{local\},i\}\}\(x\_\{i,k,t\}\),$\}\}\}\(9\)whereϕi,k,t\\phi\_\{i,k,t\}captures how strongly the predictive model attributes relevance to appliancekkat timett, accounting for feature interactions and temporal context\. Multiplying by the observed consumption yields the model\-weighted explanatory contribution of appliancekkto the prediction\. The model\-weighted explanation at timettis given by,

Ei,t=∑k=1d⁡ϕi,k,t​xi,k,t\.\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle E\_\{i,t\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{k=1\}^\{d\}\\phi\_\{i,k,t\}\\,x\_\{i,k,t\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle E\_\{i,t\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{k=1\}^\{d\}\\phi\_\{i,k,t\}\\,x\_\{i,k,t\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle E\_\{i,t\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{k=1\}^\{d\}\\phi\_\{i,k,t\}\\,x\_\{i,k,t\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle E\_\{i,t\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{k=1\}^\{d\}\\phi\_\{i,k,t\}\\,x\_\{i,k,t\}\.$\}\}\}\(10\)

Thus,Ei,tE\_\{i,t\}provides an additive decomposition of the*predicted*consumption at timettinto appliance\-level*explanatory contributions*, answering the question: which appliances most strongly influenced the model’s demand prediction, and by how much\. Importantly, these contributions reflect model attribution rather than raw energy usage\. All explanations remain noise\-free and confined within the household’s Private Data Box, supporting local interpretability while enabling downstream privacy\-preserving aggregation\. The additive structure of the explanation is crucial: it allows appliance\-level attributions to be meaningfully aggregated across households under differential privacy, whereas raw consumption values lack a compositional, model\-aware explanation\. All computations in Definition 1 are executed locally under the constraints of the approved ICA\. Throughout the remainder of this paper, and with slight abuse of notation,ϕi,k,t\\phi\_\{i,k,t\}denotes the model\-weighted contributionϕi,k,t​xi,k,t\\phi\_\{i,k,t\}\\,x\_\{i,k,t\}whenever aggregation is performed\.

###### Definition 2\(Differentially Private Household Explanation\)\.

Letϕi,t=\(ϕi,1,t,…,ϕi,d,t\)\\phi\_\{i,t\}=\(\\phi\_\{i,1,t\},\\ldots,\\phi\_\{i,d,t\}\)denote the appliance\-level SHAP attribution vector of householdiiat timett\. The household summary statistic is defined as

Si=∑t=1T⁡ϕi,t,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle S\_\{i\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\phi\_\{i,t\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle S\_\{i\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\phi\_\{i,t\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle S\_\{i\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\phi\_\{i,t\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle S\_\{i\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\phi\_\{i,t\},$\}\}\}\(11\)whereSi∈ℝdS\_\{i\}\\in\\mathbb\{R\}^\{d\}summarizes the cumulative explanatory influence of each appliance over time\. A differentially private household explanation is obtained via the Laplace mechanism,

S~i=Si\+ηi,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\widetilde\{S\}\_\{i\}=S\_\{i\}\+\\eta\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\widetilde\{S\}\_\{i\}=S\_\{i\}\+\\eta\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\widetilde\{S\}\_\{i\}=S\_\{i\}\+\\eta\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\widetilde\{S\}\_\{i\}=S\_\{i\}\+\\eta\_\{i\},$\}\}\}\(12\)whereηi∈ℝd\\eta\_\{i\}\\in\\mathbb\{R\}^\{d\}is a noise vector with independent components

ηi,k∼Lap\(Δ​Sεiadjust\),k=1,…,d\.\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\eta\_\{i,k\}\\sim\\mathrm\{Lap\}\\\!\\left\(\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\\right\),\\qquad k=1,\\ldots,d\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\eta\_\{i,k\}\\sim\\mathrm\{Lap\}\\\!\\left\(\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\\right\),\\qquad k=1,\\ldots,d\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\eta\_\{i,k\}\\sim\\mathrm\{Lap\}\\\!\\left\(\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\\right\),\\qquad k=1,\\ldots,d\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\eta\_\{i,k\}\\sim\\mathrm\{Lap\}\\\!\\left\(\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\\right\),\\hskip 16\.38895ptk=1,\\ldots,d\.$\}\}\}\(13\)Here,Δ​S\\Delta Sdenotes theℓ1\\ell\_\{1\}\-sensitivity of the household summary, andεiadjust\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}is the negotiated and ICA\-approved privacy budget enforced locally by the Private Data Box\.

For notational simplicity,ϕi,t\\phi\_\{i,t\}is used to denote the model\-weighted appliance\-level explanation vector, absorbing the multiplication byxi,k,tx\_\{i,k,t\}\. The vectorSiS\_\{i\}encodes which appliances systematically influence the household’s predicted demand, whileS~i\\widetilde\{S\}\_\{i\}ensures this information can be shared externally without violating household privacy\. Having established household\-level explainability, we now formalize how explanations from multiple households are combined to produce privacy\-preserving insights at the zonal level\. The formal derivation of theℓ1\\ell\_\{1\}\-sensitivityΔ​S\\Delta Sand its dependence on bounded SHAP attributions is provided in Appendix\.

###### Definition 3\(Privacy–Utility Negotiation Objective\)\.

For each householdii, privacy\-budget negotiation is modeled as the scalarized optimization problem

maxεi⁡U⁡\(εi\)−λi​εi,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\max\_\{\\varepsilon\_\{i\}\}\\;U\(\\varepsilon\_\{i\}\)\-\\lambda\_\{i\}\\varepsilon\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\max\_\{\\varepsilon\_\{i\}\}\\;U\(\\varepsilon\_\{i\}\)\-\\lambda\_\{i\}\\varepsilon\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\max\_\{\\varepsilon\_\{i\}\}\\;U\(\\varepsilon\_\{i\}\)\-\\lambda\_\{i\}\\varepsilon\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\max\_\{\\varepsilon\_\{i\}\}\\;U\(\\varepsilon\_\{i\}\)\-\\lambda\_\{i\}\\varepsilon\_\{i\},$\}\}\}\(14\)whereU⁡\(εi\)U\(\\varepsilon\_\{i\}\)denotes explanation utility at privacy levelεi\\varepsilon\_\{i\}, andλi\\lambda\_\{i\}captures household\-specific privacy preference\. In practice, this objective is solved heuristically through bounded search and feedback, but the formulation provides a principled basis for negotiation\.

###### Definition 4\(Zonal Explanation\)\.

LetS~i\\widetilde\{S\}\_\{i\}denote the differentially private explanation vector released by householdii\. The zonal explanation is defined as

Szonal=∑i=1H⁡S~i,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\},$\}\}\}\(15\)yielding an appliance\-aware, differentially private summary of regional demand behavior\.

The Zonal Aggregator operates exclusively on differentially private household summaries and never accesses raw data or noise\-free local explanations\. While differential privacy does not preclude all forms of inference, it provides a formal bound on the information that can be inferred about any individual household\. In HXAI, this risk is further mitigated by \(i\) aggregation across multiple independently perturbed households and \(ii\) strict query\-aware privacy\-budget enforcement, which prevents adversaries from averaging out noise through repeated queries\. Consequently, any attempted reverse inference remains provably bounded and cannot exceed the negotiated privacy guarantees\.

###### Theorem IV\.1\(Unbiasedness of Aggregated DP Explanations\)\.

LetS~i\\widetilde\{S\}\_\{i\}be differentially private household summaries generated using the Laplace mechanism\. Then

Szonal=∑i=1H⁡S~i\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\}$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\}$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\}$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle S\_\{\\mathrm\{zonal\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\}$\}\}\}\(16\)is an unbiased estimator of the true zonal SHAP contribution∑i=1H⁡Si\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\}\.

###### Proof\.

Each summary is released asS~i=Si\+ηi\\widetilde\{S\}\_\{i\}=S\_\{i\}\+\\eta\_\{i\}, whereηi\\eta\_\{i\}has zero mean\. Taking expectation,

𝔼⁡\[Szonal\]=∑i=1H⁡𝔼⁡\[Si\+ηi\]=∑i=1H⁡Si,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\[S\_\{\\mathrm\{zonal\}\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathbb\{E\}\[S\_\{i\}\+\\eta\_\{i\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\[S\_\{\\mathrm\{zonal\}\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathbb\{E\}\[S\_\{i\}\+\\eta\_\{i\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\mathbb\{E\}\[S\_\{\\mathrm\{zonal\}\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathbb\{E\}\[S\_\{i\}\+\\eta\_\{i\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\mathbb\{E\}\[S\_\{\\mathrm\{zonal\}\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathbb\{E\}\[S\_\{i\}\+\\eta\_\{i\}\]=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\},$\}\}\}\(17\)which establishes unbiasedness\. ∎

Although privacy noise perturbs individual household summaries, zonal explanations remain correct in expectation, ensuring that planning, monitoring, and diagnostic decisions based on aggregated explanations are not systematically biased by differential privacy\.

###### Theorem IV\.2\(Error Bound of Aggregated DP\-SHAP\)\.

The mean absolute deviation \(MAD\) of the zonal explanation from the true zonal SHAP sum satisfies

𝔼⁡\[‖Szonal−∑i=1H⁡Si‖1\]≤∑i=1H⁡d​Δ​Sεiadjust,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\\\!\\left\[\\left\\\|S\_\{\\mathrm\{zonal\}\}\-\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\}\\right\\\|\_\{1\}\\right\]\\leq\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\\\!\\left\[\\left\\\|S\_\{\\mathrm\{zonal\}\}\-\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\}\\right\\\|\_\{1\}\\right\]\\leq\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\mathbb\{E\}\\\!\\left\[\\left\\\|S\_\{\\mathrm\{zonal\}\}\-\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\}\\right\\\|\_\{1\}\\right\]\\leq\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\mathbb\{E\}\\\!\\left\[\\left\\\|S\_\{\\mathrm\{zonal\}\}\-\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\}\\right\\\|\_\{1\}\\right\]\\leq\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d \\, \\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\}\(18\)whereddis the number of appliances,Δ​S\\Delta Sis theℓ1\\ell\_\{1\}\-sensitivity of the household summary, andεiadjust\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}is the negotiated privacy budget of householdii\.

###### Proof\.

Each coordinate ofS~i\\widetilde\{S\}\_\{i\}is perturbed by independent Laplace noise with scaleΔ​S/εiadjust\\Delta S/\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}\. For Laplace noise, the mean absolute deviation satisfies

𝔼⁡\[\|η\|\]=Δ​Sεiadjust\.\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\[\|\\eta\|\]=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\[\|\\eta\|\]=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\mathbb\{E\}\[\|\\eta\|\]=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\mathbb\{E\}\[\|\\eta\|\]=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\.$\}\}\}\(19\)Summing overddcoordinates andHHhouseholds yields the stated bound\. ∎

We assume that the household explanation summarySiS\_\{i\}has boundedℓ1\\ell\_\{1\}\-sensitivityΔ​S\\Delta Swith respect to a single time\-step change\. This result explicitly characterizes the privacy–utility trade\-off: tighter privacy budgets increase noise, while higherεiadjust\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}values preserve explanation fidelity\. Importantly, the bound scales linearly and remains predictable, ensuring that zonal explanations remain actionable for grid\-level diagnostics and planning\.

###### Definition 5\(Zonal Explanation Utility\)\.

LetStrue=∑i=1H⁡SiS\_\{\\mathrm\{true\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}S\_\{i\}denote the noiseless zonal SHAP explanation and letSzonalS\_\{\\mathrm\{zonal\}\}be its differentially private counterpart\. The utility of the zonal explanation is defined as the cosine similarity

U=Strue⊤​Szonal‖Strue‖2​‖Szonal‖2\.\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle U=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle U=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle U=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle U=\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{ S\_\{\\mathrm\{true\}\}^\\top S\_\{\\mathrm\{zonal\}\} \}\{ \\\| S\_\{\\mathrm\{true\}\} \\\|\_2 \\, \\\| S\_\{\\mathrm\{zonal\}\} \\\|\_2 \}\}\.$\}\}\}\(20\)

This definition captures how well the relative importance of appliances is preserved under privacy noise\. Cosine similarity is chosen because it captures directional alignment and relative feature importance while being invariant to scale, making it well suited for evaluating semantic stability under additive noise\.

###### Theorem IV\.3\(Utility degradation under differential privacy\)\.

Assume that zonal explanation vectors have bounded norm, i\.e\.,‖Strue‖2≥c\>0\\\|S\_\{\\mathrm\{true\}\}\\\|\_\{2\}\\geq c\>0, and that each household summary has boundedℓ1\\ell\_\{1\}\-sensitivityΔ​S\\Delta S\. Under the Laplace mechanism, the expected cosine similarity between the private zonal explanationSzonalS\_\{\\mathrm\{zonal\}\}and the true explanationStrueS\_\{\\mathrm\{true\}\}satisfies

𝔼⁡\[U\]≥1−C‖Strue‖2​∑i=1H⁡d​Δ​Sεiadjust,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\[U\]\\geq 1\-\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\mathbb\{E\}\[U\]\\geq 1\-\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\mathbb\{E\}\[U\]\\geq 1\-\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\mathbb\{E\}\[U\]\\geq 1\-\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{C\}\{\\\|S\_\{\\mathrm\{true\}\}\\\|\_2\}\}\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\mathchoice\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{0\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{1\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\}\{\\genfrac\{\}\{\}\{\}\{2\}\{d\\,\\Delta S\}\{\\varepsilon\_i^\{\\mathrm\{adjust\}\}\}\},$\}\}\}\(21\)for a constantC\>0C\>0\.

###### Proof\.

From Theorem 1 and Theorem 2, the expected deviation betweenSzonalS\_\{\\mathrm\{zonal\}\}andStrueS\_\{\\mathrm\{true\}\}scales linearly with the magnitude of aggregated Laplace noise\. Since cosine similarity is stable under small additive perturbations, the expected reduction in similarity is proportional to the relative noise magnitude, yielding the stated bound\. We assume non\-degenerate zonal explanations with bounded norm, which holds in practice when aggregating over multiple households\. ∎

The above results justify HXAI’s architectural choice to aggregate explanations prior to privacy injection\. Unbiasedness ensures no systematic distortion, while linear error growth enables predictable privacy–utility negotiation\. Crucially, cosine stability explains the empirical preservation of semantic structure \(rank, sign, dominance\) observed in Section V, even under strong privacy constraints\. As privacy budgets increase, the relative impact of noise diminishes, and zonal explanations increasingly align with the true explanation\. Hence, the expected zonal explanation utility𝔼⁡\[U\]\\mathbb\{E\}\[U\]is monotone non\-decreasing in eachεiadjust\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}\.

In operational settings, grid operators may issue multiple explanation queries over time\. We therefore formalize how privacy leakage accumulates and how overexposure is prevented\. By Lemma\(Appendix\) and Theorem[IV\.2](https://arxiv.org/html/2610.02504#S4.Thmtheorem2), the expected perturbation norm is bounded by∑i⁡d​Δ​S/εiadjust\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i\}d\\Delta S/\\varepsilon\_\{i\}^\{\\mathrm\{adjust\}\}, yielding the stated result\.

LetQ=\{q1,q2,…,qn\}Q=\\\{q\_\{1\},q\_\{2\},\\dots,q\_\{n\}\\\}denote a sequence of queries issued to householdii, where each queryqjq\_\{j\}consumes a negotiated privacy budgetεi,jadjust\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\. We use privacy leakage and cumulative privacy budget interchangeably, withLitotal≡εitotalL\_\{i\}^\{\\mathrm\{total\}\}\\equiv\\varepsilon\_\{i\}^\{\\mathrm\{total\}\}andLimax≡εimaxL\_\{i\}^\{\\max\}\\equiv\\varepsilon\_\{i\}^\{\\max\}\.

###### Definition 6\(Cumulative Privacy Leakage\)\.

The total privacy leakage incurred by householdiiafternnqueries is

Litotal=∑j=1n⁡εi,jadjust\.\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle L\_\{i\}^\{\\mathrm\{total\}\}=\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{j=1\}^\{n\}\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\.$\}\}\}\(22\)

###### Definition 7\(Leakage Threshold Enforcement\)\.

A householdiidenies any further query once

Litotal≥Limax,\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle L\_\{i\}^\{\\mathrm\{total\}\}\\geq L\_\{i\}^\{\\mathrm\{max\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle L\_\{i\}^\{\\mathrm\{total\}\}\\geq L\_\{i\}^\{\\mathrm\{max\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle L\_\{i\}^\{\\mathrm\{total\}\}\\geq L\_\{i\}^\{\\mathrm\{max\}\},$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle L\_\{i\}^\{\\mathrm\{total\}\}\\geq L\_\{i\}^\{\\mathrm\{max\}\},$\}\}\}\(23\)whereLimaxL\_\{i\}^\{\\mathrm\{max\}\}is the household’s negotiated leakage threshold\.

###### Theorem IV\.4\(Leakage Upper Bound for Arbitrary Query Sequences\)\.

For any \(possibly adaptive\) sequence of queriesQQ, the total privacy leakage from householdiiis bounded by the negotiated thresholdLimaxL\_\{i\}^\{\\mathrm\{max\}\}\. No additional leakage occurs beyond this point\.

###### Proof\.

By the sequential composition property of differential privacy, privacy loss accumulates linearly with each query\. Since the household databox halts all responses onceLitotal=LimaxL\_\{i\}^\{\\mathrm\{total\}\}=L\_\{i\}^\{\\mathrm\{max\}\}, no further information is released, and no additional leakage is possible\. ∎

This result follows directly from the standard sequential composition property of differential privacy; for completeness, a formal statement is provided in Appendixand Appendix\. Together, the system model and theoretical framework establish HXAI as a query\-aware, explanation\-centric architecture in which privacy guarantees are enforced structurally rather than through post hoc noise injection\. Algorithm[1](https://arxiv.org/html/2610.02504#alg1)summarizes the end\-to\-end HXAI execution pipeline\.

Algorithm 1HXAI: Hierarchical Privacy\-Preserving Explainability1:Local household data

Dlocal,iD\_\{\\mathrm\{local\},i\}, approved ICA

ICAu=\(𝒬u,εumax,𝒪u,Tu\)\\mathrm\{ICA\}\_\{u\}=\(\\mathcal\{Q\}\_\{u\},\\varepsilon\_\{u\}^\{\\max\},\\mathcal\{O\}\_\{u\},T\_\{u\}\), query sequence

Q=\{q1,…,qn\}Q=\\\{q\_\{1\},\\dots,q\_\{n\}\\\}
2:/\* Executed inside Private Data Box \(TEE\) \*/

3:Compute local predictions:

Y^i,t←flocal,i​\(xi,t\)\\widehat\{Y\}\_\{i,t\}\\leftarrow f\_\{\\mathrm\{local\},i\}\(x\_\{i,t\}\)
4:Compute SHAP explanations:

ϕi,k,t←SHAPflocal,i​\(xi,k,t\)\\phi\_\{i,k,t\}\\leftarrow\\mathrm\{SHAP\}\_\{f\_\{\\mathrm\{local\},i\}\}\(x\_\{i,k,t\}\)
5:Aggregate household summary:

Si←∑t=1T⁡ϕi,tS\_\{i\}\\leftarrow\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{t=1\}^\{T\}\\phi\_\{i,t\}
6:Initialize cumulative leakage:

εitotal←0\\varepsilon\_\{i\}^\{\\mathrm\{total\}\}\\leftarrow 0
7:foreach query

qj∈Qq\_\{j\}\\in Qdo

8:if

qj∉𝒬uq\_\{j\}\\notin\\mathcal\{Q\}\_\{u\}then

9:deny query

10:continue

11:endif

12:Determine privacy cost:

εi,jadjust←ε⁡\(qj\)\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\\leftarrow\\varepsilon\(q\_\{j\}\)
13:if

εitotal\+εi,jadjust\>Limax\\varepsilon\_\{i\}^\{\\mathrm\{total\}\}\+\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\>L\_\{i\}^\{\\mathrm\{max\}\}then

14:deny query

15:continue

16:endif

17:Sample noise:

ηi∼Lap⁡\(Δ​S/εi,jadjust\)\\eta\_\{i\}\\sim\\mathrm\{Lap\}\\\!\\left\(\\Delta S/\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}\\right\)
18:Release DP summary:

S~i←Si\+ηi\\widetilde\{S\}\_\{i\}\\leftarrow S\_\{i\}\+\\eta\_\{i\}
19:Update leakage:

εitotal←εitotal\+εi,jadjust\\varepsilon\_\{i\}^\{\\mathrm\{total\}\}\\leftarrow\\varepsilon\_\{i\}^\{\\mathrm\{total\}\}\+\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}
20:endfor

21:/\* Executed by Zonal Aggregator \*/

22:Zonal aggregation:

Szonal←∑i=1H⁡S~iS\_\{\\mathrm\{zonal\}\}\\leftarrow\\mathop\{\\mathord\{\\mathchoice\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\displaystyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\textstyle\\sum$\}\}\{\\raise 0\.49991pt\\hbox\{$\\scriptstyle\\sum$\}\}\}\}\\displaylimits\_\{i=1\}^\{H\}\\widetilde\{S\}\_\{i\}
23:return

SzonalS\_\{\\mathrm\{zonal\}\}

## VExperimental Evaluation and Results

In this section we evaluates the HXAI framework on synthetic and real\-world datasets under differential privacy \(DP\) constraints\. We aim to see if HXAI can maintain the*semantic structure*of explanations, such as feature importance, consistency, and explainability, while ensuring privacy\. We distinguish between*primary results*, which establish the core claims of HXAI, and*supporting analyses*, which provide deeper insight into explanation behavior under privacy\. Our focus is on explanation robustness and faithfulness, analyzing how privacy allocation strategies affect \(i\) deviation from non\-private explanations, \(ii\) feature ranking stability, and \(iii\) overall utility\. Results are presented as mean values with standard deviations across multiple random seeds to ensure robustness and reproducibility\.888These results focus on explanation quality and semantic stability under controlled, dataset\-level conditions, isolating the behavior of HXAI’s aggregation and privacy mechanisms independent of deployment considerations\.In contrast, the following Section[VI](https://arxiv.org/html/2610.02504#S6)evaluates HXAI as an end\-to\-end system, examining how these explanation properties translate into actionable insights, privacy negotiation, and decision\-making dynamics in realistic multi\-stakeholder settings\.

### V\-ADatasets

We evaluate HXAI using three datasets that showcase different attribution regimes\. The UCI Appliances \(also commonly referred to as ‘‘Appliances Energy Prediction’’ from the UCI Machine Learning Repository\)999The dataset contains 19,735 observations of hourly residential energy usage and features a consistent attribution structure, making it smooth and rich in redundancy\.dataset contains 19,735 observations of hourly residential energy usage and features a consistent attribution, making it smooth and rich in redundancy\. The UCI Household Power dataset provides approximately 2 million minute\-level electricity records collected over several years\. It exhibits strong non\-stationarity and diverse feature importance, which presents challenges for uniform privacy allocation\. Lastly, the UCI Bike Sharing \(Hourly\) dataset includes 17,379 hourly bike rental counts and features moderate correlation among its 12 variables\. Together, these datasets contrast homogeneous attribution, in which importance is evenly distributed, with heterogeneous regimes, in which certain features exert a dominant influence\.

### V\-BModels, Baselines, and Metrics

We train gradient\-boosted tree regression models on lagged time\-series data to capture temporal dependencies across various datasets, ensuring a fair comparison through consistent model architectures\. Feature attributions are calculated using TreeSHAP101010We employ tree\-based models with TreeSHAP as they provide exact Shapley attributions, ensuring that observed distortions arise solely from privacy mechanisms rather than approximation error\.for exact Shapley\-value\-based explanations, with non\-private explanations serving as a reference\. We explore three explanation mechanisms: the Central DP\-SHAP, which adds Laplace111111We focus on Laplace\-based DP\-SHAP as it represents the dominant baseline for explanation\-level differential privacy\. Extensions to Gaussian mechanisms and smooth sensitivity primarily affect noise calibration rather than the structural limitations addressed by HXAI\.noise to aggregated explanations for global privacy; HXAI \(fixedϵ\\epsilon\), that computes local explanations independently and aggregates them under a uniform privacy budget; and HXAI \(negotiatedϵ\\epsilon\), which adapts privacy budgets based on user preferences, the needs of electricity companies, attribution mass, and other factors\. This approach allows more important features to receive higher privacy allocations while still adhering to an overall constraint\. The performance of the explanations is evaluated using three metrics: Mean Absolute Error \(MAE\) measures the average absolute deviation between private zonal explanations and the non\-private oracle; Spearman Rank Correlation assesses the stability of feature importance ordering under privacy noise; and Cosine Similarity quantifies the directional alignment between private and oracle explanations, reflecting overall utility\. All metrics are evaluated over a logarithmically spaced grid of privacy budgetsϵ∈\[0\.1,20\]\\epsilon\\in\[0\.1,20\], covering both strict and relaxed privacy regimes\.

\(a\) UCI Appliances

\(b\) UCI Bike Sharing \(Hourly\)

\(c\) UCI Household Power

Fig\. 2:Explanation quality as a function of the privacy budgetϵ\\epsilonacross three real\-world datasets\. Each panel reports mean absolute error \(MAE\), ranking stability \(Spearman\), and cosine utility\. Shaded regions indicate one standard deviation across random seeds\.
### V\-CResults

#### V\-C1Quantitative Results

Figure[2](https://arxiv.org/html/2610.02504#S5.F2)show the evolution of explanation quality with the privacy budgetϵ\\epsilonacross three datasets\. We assess mean absolute error \(MAE\), Spearman rank correlation, and cosine similarity, measuring numerical deviation, ranking stability, and directional utility, respectively\. The shaded areas indicate one standard deviation, showing robustness to variance\.

\(a\) UCI Appliances

\(b\) UCI Household Power

Fig\. 3:Comparison of oracle, local\-DP, and zonal\-DP SHAP bar plots at moderate privacy \(ϵ≈1\.05\\epsilon\\approx 1\.05\)\. Local explanations suffer from sign flips and unstable ordering, while zonal HXAI explanations preserve dominant features and semantic structure\.For the UCI Appliances and UCI Bike Sharing datasets, both HXAI variants quickly converge to the non\-private oracle asϵ\\epsilonincreases \(Fig\.[2](https://arxiv.org/html/2610.02504#S5.F2)\(a\) and Fig\.[2](https://arxiv.org/html/2610.02504#S5.F2)\(b\)\), with uniform privacy allocation consistently outperforming negotiated allocation across all metrics\. In contrast, the UCI Household Power dataset shows significant variability in feature importance\. Fig\.[2](https://arxiv.org/html/2610.02504#S5.F2)\(c\) reveals that HXAI with negotiated privacy budgets outperforms uniform allocation, particularly at moderate privacy levels \(ϵ≤2\\epsilon\\leq 2\), showcasing better cosine similarity and ranking stability\. This highlights the importance of rank preservation for explainability under differential privacy\. Across all datasets, Central DP\-SHAP underperforms compared to HXAI variants\. Although cosine similarity may improve at highϵ\\epsilon, the low ranking stability indicates central noise can distort relative importance\. Table[III](https://arxiv.org/html/2610.02504#S5.T3)summarizes top configurations, showing HXAI’s consistent superiority\. Uniform allocation is optimal for homogeneous settings, while negotiated allocation excels in heterogeneous contexts\. Overall, HXAI enhances numerical fidelity while preserving the semantic structure of explanations\. We will follow this with a qualitative analysis of how local and zonal explanations evolve under privacy noise\.

TABLE III:Best explanation quality achieved per dataset and method \(mean±\\pmstd over seeds\)\.
#### V\-C2Qualitative Robustness Analysis

While quantitative metrics measure numerical similarity and ranking stability, they do not fully capture whether explanations are explainable for human analysts\. Small numerical changes can cause sign flips or reordering among top features, leading to misleading explanations\. Therefore, we conduct a qualitative robustness analysis to visualize how explanations change under privacy noise\. Figures[3](https://arxiv.org/html/2610.02504#S5.F3)and[4](https://arxiv.org/html/2610.02504#S5.F4)illustrate the qualitative behavior of various explanation methods across datasets\. Figures[3](https://arxiv.org/html/2610.02504#S5.F3)and[4](https://arxiv.org/html/2610.02504#S5.F4)illustrate the qualitative behavior of explanation methods across datasets\. Figure[3](https://arxiv.org/html/2610.02504#S5.F3)compares oracle \(no privacy\), local\-DP, and zonal\-DP SHAP explanations at two privacy levels, using the oracle as a reference for true feature importance and direction\.

\(a\) UCI Appliances

\(b\) UCI Household Power

Fig\. 4:Top\-10 feature rank\-flow trajectories under increasing privacy noise for HXAI\. Near\-diagonal trajectories indicate stable semantic ordering\. Negotiated privacy allocation yields tighter rank trajectories in heterogeneous attribution regimes\.In contrast, zonal HXAI explanations exhibit substantially greater structural stability under privacy noise\. Although differential privacy attenuates the absolute magnitudes of feature attributions, dominant features remain visually identifiable and comparatively well ordered, preserving a clear explanatory signal\. For example, in Fig\.[3](https://arxiv.org/html/2610.02504#S5.F3)\(a\) \(UCI Appliances\), features such asPress\_mm\_hg\_lag6andRH\_1\_lag1remain among the top\-ranked contributors in the zonal HXAI output despite noise\-induced attenuation, without disappearing or changing sign\. By contrast, local\-DP explanations degrade rapidly as privacy increases: important features become obscured, less relevant features are exaggerated, and rankings fluctuate, leading to sign instability and loss of meaningful ordering\. A similar pattern is observed in Fig\.[3](https://arxiv.org/html/2610.02504#S5.F3)\(b\) for UCI Household Power, whereGlobal\_intensity\_lag1andSub\_metering\_3\_lag1dominate the oracle explanation and retain their relative ordering and direction under zonal HXAI\. Local\-DP explanations instead distort this structure, inflating minor features and suppressing dominant ones, which obscures the primary drivers of demand\. Together, these results indicate that zonal HXAI preserves semantic structure, feature identity, approximate dominance, and directional consistency, rather than exact numerical fidelity, yielding explanations that remain interpretable under strong privacy constraints\.

These observations demonstrate that HXAI preserves the semantic structure of explanations, feature identity, relative ranking, and directional influence, rather than precise numerical values\. While quantitative metrics capture average deviations \(Section[V\-C1](https://arxiv.org/html/2610.02504#S5.SS3.SSS1)\), they do not by themselves guarantee explainability\. Local\-DP may yield numerically bounded but semantically unstable explanations, whereas zonal HXAI maintains stable rankings and directions, enabling analysts to reliably identify what matters most and why under strict privacy constraints\. Figure[4](https://arxiv.org/html/2610.02504#S5.F4)shows how the importance of the top ten features shifts as privacy noise increases for two HXAI variants: fixed\-ϵ\\epsilonallocation \(Fig\.[4](https://arxiv.org/html/2610.02504#S5.F4)\(a\)\) and negotiated\-ϵ\\epsilonallocation \(Fig\.[4](https://arxiv.org/html/2610.02504#S5.F4)\(b\)\)\. Despite increased privacy noise, the most important features remain in the top ranks, indicating that HXAI preserves the overall importance structure of explanations\. In the fixed\-ϵ\\epsilonsetting, feature ranks show minor fluctuations, suggesting uniform privacy allocation is adequate\. Conversely, the negotiated\-ϵ\\epsilonsetting exhibits tighter and more stable rank trajectories, especially for the Household Power dataset, indicating that adaptive privacy allocation better stabilizes explanations\. Both panels show rank trajectories close to diagonal with few crossings, confirming that HXAI retains the relative importance of features under differential privacy while providing reliable explanations\. Figure[5](https://arxiv.org/html/2610.02504#S5.F5)\(a\)\-[5](https://arxiv.org/html/2610.02504#S5.F5)\(b\) shows how the importance of the top ten features in the UCI Appliances dataset evolves with increasing privacy noise, comparing Central DP\-SHAP and HXAI\. Under Central DP\-SHAP, feature rankings become unstable as noise increases, leading to frequent rank changes where dominant features may lose importance\. This instability makes it difficult to identify key influences on model predictions\. In contrast, HXAI maintains a stable rank structure across the privacy spectrum, with trajectories close to diagonal\. This consistency, attributed to HXAI’s hierarchical aggregation mechanism, highlights a limitation of centralized noise injection: while providing differential privacy, it disrupts the semantic integrity of explanations, resulting in unstable interpretations\.

\(a\) Central DP\-SHAP

\(b\) HXAI \(negotiatedϵ\\epsilon\)

Fig\. 5:Comparison of Top\-10 feature rank\-flow trajectories under increasing privacy noise for the UCI Appliances dataset\. Central DP\-SHAP exhibits unstable and crossing rank trajectories even in a homogeneous attribution regime, while HXAI preserves near\-diagonal, stable rank structure\.Across all datasets, HXAI consistently preserves semantic explanation structure under differential privacy, outperforming centralized DP\-SHAP in ranking stability and directional consistency\. Uniform privacy allocation is sufficient in homogeneous attribution regimes, while negotiated allocation provides clear benefits under heterogeneous feature importance\. These results validate semantic stability, not numerical precision, as the key criterion for explainable explanations under privacy\.

## VISystem\-Level Experimental Evaluation

In this section we shift focus to validating HXAI as a deployable framework for smart energy management\. Rather than competing against baseline models using static datasets, we demonstrate how HXAI functions end\-to\-end in realistic settings involving households, zones, and energy providers, while satisfying differential privacy constraints\. The experiments aim to answer questions unaddressed by offline datasets, such as the use of local explanations by households, the impact of zonal aggregation on utility under privacy constraints, the negotiation of privacy budgets, and how explainability leads to actionable interventions, such as pricing schemes and appliance upgrade incentives\. The following system\-level experiments demonstrate feasibility and end\-to\-end behavior under controlled conditions rather than field\-deployed validation\. In real DSO deployments, data volume, regulatory constraints, and heterogeneous household participation affect parameter calibration but not the hierarchical design of HXAI\. HXAI does not require centralized model training, gradient exchange, or synchronized updates\. Its computational cost scales linearly with the number of participating households and queries, making it suitable for large\-scale zonal and city\-level deployments\.

![Refer to caption](https://arxiv.org/html/2610.02504v1/shaplocal.png)Fig\. 6:Noise\-free local SHAP explanation for an individual household\. The plot shows how different appliances contribute to energy consumption over time\. This report is computed and consumed locally within the household’s Private Data Box and is never shared externally\.### VI\-AExperimental Setup

All experiments were conducted on a MacBook Air \(Apple M1 chip\) with 8 CPU cores and 8 GB RAM, running macOS 14\.4\.1 and Python 3\.9 in a Jupyter Notebook, with privacy protections enabled\. We generated energy consumption data for 50 households, each with seven IoT appliances: Heating, Fridge, Fan, Oven, Washing Machine, Dryer, and Cooler, observed at 100 time points for consistency\. This design allows us to isolate system\-level phenomena, like privacy budget negotiation and intervention feedback loops, that are difficult to measure in observational datasets, focusing on decision support and explainability within formal privacy guarantees\.

### VI\-BLocal and Zonal Analysis

HXAI delivers stakeholder\-specific explainability: households receive detailed, noise\-free local insights, while providers access aggregated, privacy\-preserving zonal explanations\. We evaluate whether explanations remain actionable and meaningful at both levels while enforcing strict privacy guarantees\.

#### VI\-B1Local \(End\) Level Analysis

![Refer to caption](https://arxiv.org/html/2610.02504v1/zonalcompare.png)Fig\. 7:Zonal SHAP explanations before and after privacy\-preserving noise application\. While noise introduces small numerical variability, the relative importance and ordering of dominant appliances remain stable\.At the local level, HXAI provides households with full\-resolution, noise\-free explanations computed entirely within the Private Data Box\. These explanations are never shared externally\. While households already have access to raw appliance\-level consumption dataDlocal,iD\_\{\\mathrm\{local\},i\}, such data only reports how much energy each device consumes\. In contrast, local SHAP explanations quantify how individual appliances influence the model’s predictions, which is a fundamentally different and model\-dependent signal\. In particular, SHAP distinguishes appliances that actively drive predicted demand peaks or price\-relevant forecasts from those that merely consume energy without significantly affecting predictions, information that cannot be reliably inferred from raw consumption alone\.

![Refer to caption](https://arxiv.org/html/2610.02504v1/wwout.png)Fig\. 8:Zonal energy consumption report with and without privacy noise\. Aggregation suppresses noise while preserving overall demand patterns relevant for grid operation\.Figure[6](https://arxiv.org/html/2610.02504#S6.F6)presents a detailed local SHAP report for an individual household, illustrating appliance\-level explanatory contributions over time\. The washing machine exhibits the widest SHAP value distribution, indicating that its influence on predicted demand varies strongly with usage timing, cycle duration, and interaction with other appliances\. Although heating may consume more energy on average, its SHAP distribution is more balanced, reflecting a comparatively stable and less peak\-driving role in the prediction\. Appliances such as ovens and fans display smaller SHAP values, indicating limited predictive relevance, even when their instantaneous energy usage is non\-negligible\.

![Refer to caption](https://arxiv.org/html/2610.02504v1/new1.png)Fig\. 9:Privacy budget negotiation for an individual household: \(a\) initial strict privacy budget resulting in low utility, \(b\) negotiated privacy–utility trade\-off with stabilized utility atϵ=6\.73\\epsilon=6\.73, and \(c\) corresponding local SHAP explanation at the negotiated budget, preserving semantic structure\.Crucially, this distinction cannot be inferred from raw consumption data alone\. Raw measurements do not reveal whether an appliance causally drives predicted demand peaks, whether its effect is redundant with other devices, or how its influence varies with temporal context and feature interactions\. Local SHAP explanations therefore move households from descriptive monitoring to actionable understanding\. For instance, identifying the washing machine as a dominant explanatory driver enables off\-peak rescheduling to reduce costs, even if it is not the largest energy consumer\. More broadly, SHAP surfaces latent effects—such as efficiency, usage patterns, and program settings—that are invisible in raw data\. Importantly, this local explainability provides the semantic foundation for zonal aggregation: only predictive influence, rather than raw usage, can be meaningfully aggregated under differential privacy, while detailed behavioral insights remain private\.

#### VI\-B2Zonal \(Edge\) Level Analysis

HXAI aggregates local explanations at the zonal level and applies differential privacy to protect household data while enabling grid insights\. Despite Laplace noise, overall consumption patterns and peak\-demand signals remain consistent \(Fig\.[8](https://arxiv.org/html/2610.02504#S6.F8)\), and the relative importance of key appliances such as washing machines is preserved \(Fig\.[7](https://arxiv.org/html/2610.02504#S6.F7)\)\. Although noise reduces precision, semantic stability is maintained, allowing energy providers to identify actionable patterns without compromising household confidentiality\.

![Refer to caption](https://arxiv.org/html/2610.02504v1/pricedrop.png)Fig\. 10:Predicted hourly electricity prices before and after an appliance upgrade intervention informed by zonal HXAI explanations\. Peak prices are significantly reduced, resulting in a smoother and more stable price curve\.![Refer to caption](https://arxiv.org/html/2610.02504v1/utilityq.png)Fig\. 11:Utility comparison between specific \(appliance\-level\) and general \(aggregate\) queries under differential privacy\. Specific queries provide higher utility but consume more privacy budget\.

### VI\-CPrivacy\-Utility Trade\-off and Budget Negotiation

A key aspect of privacy\-preserving explainability is balancing household privacy with energy provider utility needs\. Unlike static differential privacy mechanisms with fixed budgets, HXAI allows dynamic negotiation of privacy budgets at the explanation level\. Figure[9](https://arxiv.org/html/2610.02504#S6.F9)\(a\) depicts the initial negotiation for a household, proposing a strict privacy budget \(ϵ=0\.16\\epsilon=0\.16\)\. While this maximizes privacy, it distorts explanations due to noise, diminishing their utility for tasks like demand forecasting and pricing analysis\. This level of privacy may satisfy the household but provides limited value to the energy provider\.

Figure[9](https://arxiv.org/html/2610.02504#S6.F9)\(b\) shows the outcome of the negotiation process, revealingϵ=6\.73\\epsilon=6\.73as an optimized point at which explanation utility stabilizes while privacy remains acceptable to the household\. This optimized point represents a voluntary compromise: lower noise preserves the semantic structure of explanations, while sufficient noise prevents leakage of sensitive behavioral patterns\. Importantly, acceptance of this privacy level is household\-driven and contingent on perceived benefit, such as improved tariffs, discounts, or other economic incentives associated with higher\-quality explanations\. Figure[9](https://arxiv.org/html/2610.02504#S6.F9)\(c\) confirms that at this negotiated privacy budget, local SHAP explanations retain their essential structure: dominant features remain dominant, signs are consistent, and relative ordering is stable\. Similar negotiation dynamics and operating points are observed across households, indicating that HXAI supports adaptive, incentive\-aligned privacy management without requiring manual tuning or dataset\-specific heuristics\. If a household is unwilling to relax its privacy preference, the system defaults to stricter privacy guarantees, resulting in noisier or more coarse\-grained explanations without penalizing the household\.

![Refer to caption](https://arxiv.org/html/2610.02504v1/total.png)Fig\. 12:Accumulated privacy leakage and utility over repeated queries\. Once the negotiated privacy budget is exhausted, households automatically deny further queries\.
### VI\-DExplainability\-Driven Intervention and Grid Management

HXAI provides actionable grid insights while preserving household privacy\. Zonal SHAP reports \(Fig\.[7](https://arxiv.org/html/2610.02504#S6.F7)\) identify washing machines as major peak\-demand contributors using privacy\-preserving aggregation\. We simulate a 20% bill discount for households upgrading to energy\-efficient models \(20/50 participate\)\. The 24\-hour price forecast \(Fig\.[10](https://arxiv.org/html/2610.02504#S6.F10)\) shows lower peaks and a smoother curve compared to baseline, reflecting reduced aggregate demand\. This demonstrates that HXAI enables explainability\-driven interventions that stabilize load and reduce prices without exposing household\-level data\.

Specific Queryqspec​\(hi\)q\_\{\\mathrm\{spec\}\}\(h\_\{i\}\)General Queryqgen​\(hi\)q\_\{\\mathrm\{gen\}\}\(h\_\{i\}\)Compare Privacy BudgetsTotal Privacy LeakageCheck Privacy ThresholdFurther Queries Denied

Fig\. 13:Query handling and privacy accounting workflow in HXAI\.
### VI\-EQuery Mechanisms and Accumulated Privacy Leakage

In operational settings, HXAI supports repeated explainability queries by differentiating query types and enforcing cumulative privacy\-budget control through the Information Control Agreement \(ICA\)\.

#### VI\-E1General and specific queries\.

HXAI supports two query types\.*General queries*provide aggregated, coarse\-grained insights \(e\.g\., zonal trends\) with lower privacy cost\.*Specific queries*target fine\-grained, appliance\-level or temporal details and therefore consume a larger privacy budget\. As shown in Fig\.[11](https://arxiv.org/html/2610.02504#S6.F11), specific queries yield higher explanation utility \(83%\) than general queries \(67%\), but at increased privacy cost\. This trade\-off follows the query\-aware pricing mechanism in the ICA, where each queryqqincurs a privacy costε⁡\(q\)\\varepsilon\(q\)\.

#### VI\-E2Multiple queries and cumulative privacy leakage\.

To assess long\-term privacy effects, we simulate repeated queries to a household’s Private Data Box under a fixed ICA\. Each query consumes a negotiated privacy budgetεi,jadjust\\varepsilon\_\{i,j\}^\{\\mathrm\{adjust\}\}, and cumulative leakage follows sequential composition\. As shown in Fig\.[12](https://arxiv.org/html/2610.02504#S6.F12), leakage increases gradually until the household\-specific threshold \(e\.g\.,εimax=6\.73\\varepsilon\_\{i\}^\{\\max\}=6\.73\) is reached, after which further queries are denied\. This prevents unbounded privacy erosion and enforces household preferences over time\. By treating privacy as a consumable, trackable resource, HXAI enables sustainable long\-term explainability under formal differential privacy guarantees\.

### VI\-FDiscussion

This work evaluates whether explanations remain meaningful under differential privacy\. HXAI preserves feature identity, ranking, and directional influence across privacy regimes, whereas centralized DP\-SHAP often causes rank instability and sign inversions\. Unlike methods that depend on larger privacy budgets for numerical fidelity, HXAI maintains structural stability by design and supports local interpretability, privacy\-preserving aggregation, and bounded long\-term privacy leakage\. Although evaluated on smart grids, HXAI generalizes to other privacy\-sensitive domains where local interpretability and aggregate insights must coexist under formal privacy guarantees\.

Key takeaways:

- •Explainability under DP requires semantic stability, not only numerical accuracy\.
- •Centralized DP explanations disrupt feature meaning and ordering\.
- •HXAI preserves stable, decision\-relevant explanations via hierarchical aggregation\.
- •Adaptive privacy allocation and query\-aware accounting enable practical, long\-term deployment\.

### VI\-GEthics and Reproducibility

HXAI uses only simulated or publicly available datasets and introduces no new data collection or personally identifiable information\. Household data are private by design, and differential privacy bounds leakage under repeated queries\. The study poses no additional ethical risks beyond standard energy forecasting and XAI research\. All datasets, code, and scripts are available in an anonymous repository:[https://anonymous\.4open\.science/r/HXAI\-E3F2/README\.md](https://anonymous.4open.science/r/HXAI-E3F2/README.md)\.

## VIIConclusion

In this paper, We introduce HXAI, a framework for explainable and privacy\-preserving AI in distributed energy systems\. By separating local explanation from data aggregation, HXAI protects household privacy while enabling intelligent grid management\. Unlike traditional methods that degrade feature consistency under differential privacy, HXAI preserves feature identity and importance across datasets and privacy levels\. The framework supports dynamic privacy budget negotiation and practical decision\-making without exposing sensitive data\. Overall, HXAI demonstrates that transparency and privacy can be achieved simultaneously in energy systems and other sensitive domains\.

## References

- \[1\]T\. Morstyn, N\. Farrell, S\. J\. Darby, and M\. D\. McCulloch\(2018\)Using peer\-to\-peer energy\-trading platforms to incentivize prosumers\.Nature Energy3\(2\),pp\. 94–101\.Cited by:[footnote 1](https://arxiv.org/html/2610.02504#footnote1)\.
- \[2\]R\. Li and M\. Shahidehpour\(2021\)Future framework for Electric Vehicle charging impacts on power systems\.IEEE Transactions on Smart Grid12\(1\),pp\. 587–599\.Cited by:[footnote 1](https://arxiv.org/html/2610.02504#footnote1)\.
- \[3\]P\. Kundur\(1994\)Power system stability and control\.McGraw\-Hill,New York, NY\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p1.1)\.
- \[4\]P\. Palensky and D\. Dietrich\(2011\)Demand side management: demand response, intelligent energy systems, and smart loads\.IEEE Transactions on Industrial Informatics7\(3\),pp\. 381–388\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p1.1),[§II](https://arxiv.org/html/2610.02504#S2.p1.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px1.p1.1),[§III](https://arxiv.org/html/2610.02504#S3.p1.1)\.
- \[5\]C\. Efthymiou and G\. Kalogridis\(2010\)Smart grid privacy via anonymization of smart metering data\.InProceedings of the First IEEE International Conference on Smart Grid Communications \(SmartGridComm\),pp\. 238–243\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p1.1),[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.6.1),[§II](https://arxiv.org/html/2610.02504#S2.p2.1),[§III](https://arxiv.org/html/2610.02504#S3.p1.1)\.
- \[6\]M\. H\. Albadi and E\. F\. El\-Saadany\(2007\)Demand response in electricity markets\.In2007 IEEE Power Engineering Society General Meeting,pp\. 1–5\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p1.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px1.p1.1)\.
- \[7\]S\. M\. Lundberg and S\. Lee\(2017\)A unified approach to interpreting model predictions\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Vol\.30\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p2.1),[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.3.1),[§II](https://arxiv.org/html/2610.02504#S2.p2.1)\.
- \[8\]M\. T\. Ribeiro, S\. Singh, and C\. Guestrin\(2016\)”Why should I trust you?”: explaining the predictions of any classifier\.InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,pp\. 1135–1144\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p2.1),[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.3.1),[§II](https://arxiv.org/html/2610.02504#S2.p2.1)\.
- \[9\]C\. Molnar\(2019\)Interpretable machine learning: a guide for making black box models explainable\.Leanpub\.Note:Online book, accessed 2019External Links:[Link](https://christophm.github.io/interpretable-ml-book/)Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p2.1)\.
- \[10\]M\. Abadi, A\. Chu, I\. Goodfellow, H\. B\. McMahan, I\. Mironov, K\. Talwar, and L\. Zhang\(2016\)Deep learning with differential privacy\.InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security \(CCS\),pp\. 308–318\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p2.1)\.
- \[11\]B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InProceedings of the 20th International Conference on Artificial Intelligence and Statistics \(AISTATS\),pp\. 1273–1282\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p2.1),[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.4.1),[§II](https://arxiv.org/html/2610.02504#S2.p4.1),[footnote 4](https://arxiv.org/html/2610.02504#footnote4)\.
- \[12\]V\. Costan and S\. Devadas\(2016\)Intel SGX explained\.Technical reportCryptology ePrint Archive, Report 2016/086\.External Links:[Link](https://eprint.iacr.org/2016/086)Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p3.1),[§II](https://arxiv.org/html/2610.02504#S2.p3.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px6.p1.1)\.
- \[13\]C\. Dwork and A\. Roth\(2014\)The algorithmic foundations of differential privacy\.Foundations and Trends in Theoretical Computer Science,Now Publishers\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p3.1),[§I](https://arxiv.org/html/2610.02504#S1.p5.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px4.p2.1),[footnote 5](https://arxiv.org/html/2610.02504#footnote5)\.
- \[14\]Z\. C\. Lipton\(2018\)The mythos of model interpretability: in machine learning, the concept of interpretability is both important and slippery\.Communications of the ACM61\(10\),pp\. 36–43\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p4.1)\.
- \[15\]C\. Dwork, G\. N\. Rothblum, and S\. Vadhan\(2010\)Boosting and differential privacy\.In51st Annual IEEE Symposium on Foundations of Computer Science \(FOCS\),pp\. 51–60\.Cited by:[§I](https://arxiv.org/html/2610.02504#S1.p5.1)\.
- \[16\]X\. Fang, S\. Misra, G\. Xue, and D\. Yang\(2012\)Smart grid — the new and improved power grid: a survey\.IEEE Communications Surveys & Tutorials14\(4\),pp\. 944–980\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p1.1),[§III](https://arxiv.org/html/2610.02504#S3.p1.1)\.
- \[17\]T\. Ahmad and H\. Chen\(2018\)A review on applications of ANN and SVM for building real\-time load forecasting\.Applied Energy211,pp\. 110–122\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p2.1)\.
- \[18\]Y\. Zhang T\. Chenet al\.\(2019\)Explainable deep learning for Smart Grid situational awareness\.IEEE Transactions on Smart Grid10\(6\),pp\. 6452–6462\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p2.1)\.
- \[19\]O\. Goldreich\(1998\)Secure multi\-party computation\.Manuscript\. Preliminary version78,pp\. 110\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p3.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px1.p1.1)\.
- \[20\]C\. Gentry\(2009\)Fully homomorphic encryption using ideal lattices\.InProceedings of the 41st Annual ACM Symposium on Theory of Computing \(STOC\),pp\. 169–178\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p3.1)\.
- \[21\]R\. Bost, R\. A\. Popa, S\. Tu, and S\. Goldwasser\(2015\)Machine learning classification over encrypted data\.InProceedings of the 22nd Network and Distributed System Security Symposium \(NDSS\),Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p3.1)\.
- \[22\]T\. Li, A\. K\. Sahu, A\. Talwalkar, and V\. Smith\(2020\)Federated learning: challenges, methods, and future directions\.IEEE Signal Processing Magazine37\(3\),pp\. 50–60\.Cited by:[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.4.1),[§II](https://arxiv.org/html/2610.02504#S2.p4.1)\.
- \[23\]J\. C\. Duchi, M\. I\. Jordan, and M\. J\. Wainwright\(2013\)Local privacy and statistical minimax rates\.In54th Annual IEEE Symposium on Foundations of Computer Science \(FOCS\),pp\. 429–438\.Cited by:[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.5.1),[§II](https://arxiv.org/html/2610.02504#S2.p4.1)\.
- \[24\]N\. Wang, X\. Xiao, Y\. Yang, J\. Zhao, P\. Hui, H\. Shin, J\. Shin, and G\. Yu\(2019\)Collecting and analyzing multidimensional data with local differential privacy\.In2019 IEEE 35th International Conference on Data Engineering \(ICDE\),pp\. 638–649\.Cited by:[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.5.1),[§II](https://arxiv.org/html/2610.02504#S2.p4.1)\.
- \[25\]D\. Slack, S\. Hilgard, E\. Jia, S\. Singh, and H\. Lakkaraju\(2020\)Fooling LIME and SHAP: adversarial attacks on post hoc explanation methods\.InProceedings of the AAAI/ACM Conference on AI, Ethics, and Society \(AIES\),pp\. 180–186\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p4.1)\.
- \[26\]Ú\. Erlingsson, V\. Pihur, and A\. Korolova\(2014\)RAPPOR: randomized aggregatable privacy\-preserving ordinal response\.InProceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security \(CCS\),pp\. 1054–1067\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p5.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px7.p1.1)\.
- \[27\]G\. Ács and C\. Castelluccia\(2011\)Have you got nothing to hide? Privacy\-preserving smart metering with user\-side load moderation\.InProceedings of the 10th Annual ACM Workshop on Privacy in the Electronic Society \(WPES\),pp\. 13–24\.Cited by:[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.6.1),[§II](https://arxiv.org/html/2610.02504#S2.p5.1)\.
- \[28\]Y\. Zhanget al\.\(2018\)EdgeBox: a lightweight and localized solution for IDPS in IoT\.IEEE Internet of Things Journal5\(6\),pp\. 4961–4969\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p5.1)\.
- \[29\]R\. Mortieret al\.\(2016\)Databox: Privacy\-preserving IoT data management\.ACM SIGCOMM Computer Communication Review46\(2\),pp\. 16–22\.Cited by:[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.7.1),[§II](https://arxiv.org/html/2610.02504#S2.p5.1)\.
- \[30\]I\. Stojmenovic\(2014\)Fog computing for smart grid applications\.IEEE Communications Magazine52\(11\),pp\. 142–149\.Cited by:[§II](https://arxiv.org/html/2610.02504#S2.p5.1)\.
- \[31\]M\. Schneider, R\. Jayaram Masti, S\. Shinde, S\. Capkun, and R\. Perez\(2022\)SoK: hardware\-supported Trusted Execution Environments\.arXiv preprint arXiv:2205\.12742\.Cited by:[TABLE I](https://arxiv.org/html/2610.02504#S2.T1.2.1.1.1.7.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px6.p1.1)\.
- \[32\]R\. Mortier, J\. Zhao, J\. Crowcroft, L\. Wang, Q\. Li, H\. Haddadi, Y\. Amar, A\. Crabtree, J\. Colley, T\. Lodge,et al\.\(2016\)Personal data management with the Databox: what’s inside the box?\.InProceedings of the 2016 ACM Workshop on Cloud\-Assisted Networking,pp\. 49–54\.Cited by:[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px6.p1.1),[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.p1.1)\.
- \[33\]D\. F\. Ferraiolo, D\. R\. Kuhn, and R\. Chandramouli\(2001\)Proposed NIST standard for role\-based access control\.ACM Transactions on Information and System Security \(TISSEC\)4\(3\),pp\. 224–274\.Cited by:[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px3.p1.1)\.
- \[34\]N\. Li, W\. Qardaji, and D\. Su\(2017\)Privacy–utility tradeoff in data publication\.IEEE Security & Privacy15\(2\),pp\. 90–93\.Cited by:[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px4.p2.1)\.
- \[35\]S\. Spiekermann\(2015\)Ethical it innovation: a value\-based system design approach\.Business & Information Systems Engineering57,pp\. 269–277\.Cited by:[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px5.p1.1)\.
- \[36\]M\. Boubakri and B\. Zouari\(2025\)A survey of RISC\-V secure enclaves and Trusted Execution Environments\.Electronics14\(21\),pp\. 4171\.Cited by:[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px6.p1.1)\.
- \[37\]J\. Ménétreyet al\.\(2022\)Attestation mechanisms for Trusted Execution Environments\.arXiv preprint arXiv:2206\.03780\.Cited by:[§III\-A](https://arxiv.org/html/2610.02504#S3.SS1.SSS0.Px6.p1.1)\.
- \[38\]C\. Dwork, F\. McSherry, K\. Nissim, and A\. Smith\(2006\)Calibrating noise to sensitivity in private data analysis\.InTheory of Cryptography Conference \(TCC\),pp\. 265–284\.Cited by:[§III\-B](https://arxiv.org/html/2610.02504#S3.SS2.p1.1)\.