ABSTRACT As machine learning models continue to advance power consumption forecasting and smart grid analytics, concerns about privacy risks in electricity time‐series data have gained significant attention. Highlighting the unique characteristics of electricity data, such as its high periodicity and direct correlation with sensitive real‐world activities, this paper introduces a novel privacy auditing framework that systematically assesses the vulnerability of electricity forecasting models to gradient‐based data reconstruction attacks, where adversaries exploit model gradients to infer sensitive electricity usage data, posing a serious privacy risk to households, industries, and power operators. This paper introduces a novel privacy auditing framework that systematically assesses the vulnerability of electricity forecasting models to gradient‐based reconstruction attacks. Unlike traditional methods that primarily focus on privacy mitigation through model regularization or noise injection, our framework provides a quantitative evaluation of gradient leakage, allowing us to measure and analyze the extent to which adversaries can reconstruct private energy consumption data. Through experiments on benchmark electricity datasets (ETTh1, ETTh2, and ECL), we demonstrate that, without privacy‐preserving techniques, attackers can accurately reconstruct electricity consumption patterns, as indicated by the rapid decrease in mean squared error (MSE) during reconstruction iterations. However, the application of a standard defense mechanism, differential privacy (DP), significantly disrupts this process, increasing MSE and coefficient variance, thereby limiting an attacker's ability to recover meaningful energy consumption information. By formalizing the connection between gradient similarity and time‐series similarity, our study quantifies privacy risks in electricity forecasting models, and evaluates the effectiveness of DP as a representative defense mechanism. The main contribution is not an improvement to privacy‐preserving algorithms themselves, but rather the auditing framework used to measure their efficacy. Our analysis provides a quantitative framework for navigating the critical tradeoff between privacy preservation and model utility, while also considering the computational overhead of the auditing process. This work provides a systematic approach to privacy auditing, equipping researchers, policymakers, and energy providers with insights into the trade‐offs between model accuracy and data security. Future research should explore additional privacy‐preserving techniques such as homomorphic encryption, federated learning, and adversarial training to further enhance privacy protections in smart grid and energy forecasting applications.

The advanced metering infrastructure AMI is an essential component of the smart grid (SG), providing essential support for two-way communication and real-time data exchange between users and utility providers. However, due to the potential untrustworthiness of the open channel, protecting the confidentiality and integrity of communication data is challenging. Previously, a number of privacy-preserving authentication and key agreement (AKA) schemes have been proposed for securing SGs. However, these solutions either have some security and privacy vulnerabilities or require expensive computational and communication costs that cannot be applied to resource-constrained smart meters. In this work, we propose a novel, lightweight and privacy-preserving AKA scheme for SGs based on the elliptic curve cryptography and physically uncloneable function. The security analysis shows that our construction is secure against several security attacks. In addition, performance comparison with several related works shows the practicality of our design.

Summary Device identity authentication is the first line of defense for edge computing security mechanisms. Many authentication schemes are often accompanied by high communication and computational overhead. In addition, due to the continuous enhancement of network virtualization and dynamics, the security requirements for logical boundaries of many enterprise information systems “cloudification,” and the huge data security challenges faced by enterprise core assets, all make the original "one‐time authentication, all the way" trust model no longer reliable. Therefore, the paper proposes a local identity authentication and roaming identity authentication protocol based on a zero‐trust architecture. First, we propose a revocable group signature scheme, the expiration time is bound to the key of each edge terminal device. According to this solution, since the identity authentication token generated by the expired key is invalid, it does not need to be included in the revocation list, which improves the efficiency of revocation checking. Compared with the current identity authentication protocol, this article not only builds a model based on the zero trust architecture, effectively solves the shortcomings of the network security protection architecture, but also considers the unforgeability of the expiration time, and realizes effective revocation and more efficient identity authentication.