Defending lithium-ion battery state of health estimation against transfer attacks using adversarial training and ensemble learning

Cloud-edge collaboration has emerged as a promising paradigm for state of health estimation in lithium-ion batteries. However, its intrinsic dependence on shared data makes it susceptible to transfer adversarial attacks, where adversaries employ surrogate models to craft perturbations capable of bypassing conventional white-box defenses. To address this threat, this paper presents a defense paradigm integrating adversarial training and stacking ensemble learning (AT-SE). Heterogeneous base models are selected considering adversarial robustness, gradient diversity, and estimation error diversity. The long short-term memory (LSTM) captures temporal dependencies, random forest provides immunity through discrete boundaries, and eXtreme Gradient Boosting captures nonlinear relationships. Adversarial samples generated using projected gradient descent and fast gradient sign method are employed for base model adversarial training. Finally, a stacking meta-learner fuses their diversified outputs through an error-compensation mechanism to mitigate perturbations. Experiments show transfer attacks increase benchmark estimation errors by more than eightfold. In contrast, the AT-SE framework exhibits outstanding defensive capability. Under high-intensity attacks, when root mean square error values of LSTM and stacking ensemble learning soar to 0.1254 and 0.0520, AT-SE suppresses the error to 0.0279. In the cross-chemistry validation on nickel cobalt manganese batteries, AT-SE maintains a mean absolute error below 0.02.