A privacy-aware system reported ERP anomaly detection close to a centralised model, with a gap of 2.7 percentage points in its F1 score, a single measure based on precision and recall. On an enriched, expert-annotated ERP evaluation, APEW-Fed achieved 93.5% F1, with precision of 0.942, recall of 0.928 and an AUC of 0.971. The paper also reports 94% lower total communication than FedAvg.
The result came from a 50,000-transaction stratified random subsample of a real-world ERP dataset containing 243,531 transactions. After preprocessing, 47 features were retained. Experts annotated 5,000 transactions, including 612 confirmed anomalies and 4,388 normal transactions. The 50,000-transaction and 5,000-annotation figures are nested parts of the evaluation, so they should not be added together.
Privacy was built into the pipeline
APEW-Fed combines adaptive privacy-aware ensemble weighting, feature-sensitivity-calibrated differential privacy and federated anomaly-score calibration. Its four detectors were Isolation Forest, a DP-SGD autoencoder, adaptive DBSCAN and gradient boosting.
Before modelling, the architecture applied k-anonymity, grouping records in sets of five, and SHA-256 hashing. It divided the 47 engineered features into three sensitivity tiers, assigning weights of 3, 2 and 1.
In its formal privacy accounting, the paper reports a total RDP budget of 1.0 at order 8, converted to differential privacy parameters of 1.43 and 0.00001. That is a formal accounting result for the stated configuration, not an empirical estimate of attack risk.
APEW-Fed was compared with nine baselines. Federated comparisons used the same splits, three clients and a total privacy budget of 1.0. Each experiment was repeated 10 times with different random seeds, and the paper reports means with 95% confidence intervals.
A sampling check produced a similar score
To check whether the enriched ERP evaluation skewed the result, the authors examined an unbiased uniform-only subset of 2,500 transactions. F1 was 92.1% there. The IPW-corrected estimate was 0.918 and the uniform-only estimate was 0.921, agreeing within 0.3 points.
On two public benchmarks, APEW-Fed reported 91.4% F1 on IEEE-CIS Fraud Detection and 92.3% on NSL-KDD. Those scores were 2.6 and 2.4 points below the respective centralised baselines, but 4.3 and 4.5 points above FedIsolation. The tests added results from data beyond the ERP evaluation, but they remain benchmark results.
Attack tests were close to random, within limits
Privacy testing produced a more qualified result. In simulated membership-inference tests, which ask whether an attacker can tell whether a transaction appeared in the training set, a shadow-model attack succeeded 51.2% of the time under full APEW-Fed, while LiRA succeeded 53.8%, close to the 50% random baseline. Without privacy, the reported success rates were 73.2% and 81.4%. The paper also reports a formal worst-case attacker-accuracy bound of 88.1%.
The empirical attack rates and the formal privacy guarantee should not be treated as interchangeable measures. The tested configurations also leave model inversion, property inference, backdoor and other advanced attacks unevaluated. Near-random results in the reported tests therefore do not establish protection against attacks that were not examined.
Efficiency came with a narrow evidence base
On system performance, total communication was 6.6 MB for APEW-Fed and 105.0 MB for FedAvg. Single-transaction inference took 75.5 milliseconds on a CPU and 2.3 milliseconds on a GPU. As the client count rose from three to 20, F1 rose from 0.935 to 0.943, while training time rose from 293 to 421 seconds.
The ablation was mixed. The full system's F1 was 0.935, compared with 0.924 without adaptive weighting, 0.920 without feature-sensitivity-calibrated privacy and 0.928 without federated anomaly-score calibration. Uniform tier weights produced 0.938, slightly above the full system, while Isolation Forest alone produced 0.869.
The main constraints are the boundaries of the evaluation. It covered one proprietary ERP dataset and two public benchmarks, with expert labels for an ERP subset and simulated privacy attacks; no prospective deployment or randomized intervention was reported. The analysed datasets are not publicly available because of confidentiality and privacy requirements, although the corresponding author may provide them on reasonable request. Synthetic-data results are planned for Zenodo upon acceptance.
The study therefore offers a benchmark performance profile, not evidence that the system reduces real-world fraud, financial loss or improves human decision-making. The authors state that they received no funding and declare no competing interests.
Paper data and sources
Original title: APEW-Fed: adaptive privacy-aware ensemble weighting for federated anomaly detection in enterprise resource planning systems.
Authors: Adiah Qazi, Ammad Ali Khan Jadoon, Sadiqa Arshad
Journal/Repository: Scientific reports
Status: Peer-reviewed
First online: 2026-08-20
DOI: 10.1038/s41598-026-60574-y
Original paper · Full text