Artificial intelligence-based efficient model for the detection of non-technical losses in smart grids

1 Introduction

Uninterrupted electrical energy and power transmission are a modern day need, but utilities face major non-technical losses (NTLs), mainly from theft, unlike unavoidable technical losses (Carr and Thomson, 2022). Theft (e.g., line tapping, meter tampering, false reporting) is difficult to detect due to irregular and dynamic consumption patterns. Smart grids (SGs) using AMI/smart meters enable two-way communication and energy flow, behavior-based monitoring, instant anomaly detection, and reducing manual inspections (Alkuwari, 2025; Rehman et al., 2026a). Traditional methods, such as physical inspections and rules, are costly, unscalable, and error-prone, so machine learning and deep learning (ML/DL) models are preferred. The convolutional neural networks (CNNs) capture local patterns but miss long-term trends; the transformer model captures long-range/periodic behavior via self-attention (Sreekumar et al., 2024). Still, existing approaches remain fundamentally limited; stand-alone CNN-based models fail to capture long-range temporal dependencies, while transformer-based models are less effective in modeling fine-grained local irregularities and introduce high computational complexity. In this work, a task-driven hybrid architecture, termed transformer-based wide and deep convolutional neural network (TWiDeCNN), is proposed to explicitly address these complementary limitations by jointly modeling local, global, and hierarchical consumption patterns (Calvo et al., 2020).

Electric energy theft detection methods include hardware-based, model/state estimation, and data-driven approaches, varying in cost, scalability, and accuracy, as reported in Türk et al. (2025). Hardware methods use sensors and tamper/feeder monitoring to detect theft but are costly and difficult to scale (Zulu and Dzobo, 2023). Model-based methods compare expected vs. actual power flows but depend on incomplete and changing grid data. Data-driven methods analyze consumption patterns to detect anomalies but rely on handcrafted features and may not generalize well (Khan et al., 2023).

Classical machine learning (ML) (support vector machine (SVM), random forest (RF), naive Bayes (NB), k-nearest neighbors (kNN), and boosting) relies on engineered features and strong baselines but struggles with subtle theft patterns (Kawoosa et al., 2024; Rehman et al., 2026b). Deep learning (CNN, long short-term memory (LSTM), gated recurrent unit (GRU), and hybrids) learns temporal dependencies directly but increases complexity and computation (Afraji et al., 2025). Class imbalance is handled via sampling, synthetic minority oversampling technique (SMOTE) variants, cost-sensitive learning, and thresholding, although with over/underfitting risks (Han et al., 2005). Transformers/attention capture long-range dependencies effectively but are resource-heavy and overfitting-prone (Sheng et al., 2026). Wide and deep network combines feature interaction and nonlinear learning; modern approaches unify short- and long-term patterns via attention-based architectures.

Even with these improvements, data on electricity use still have a multi-scale temporal structure. This means that fraudulent behavior can show up as both localized anomalies (like sudden spikes or drops) and temporally distributed patterns (like gradual manipulation or periodic irregularities). Most existing models are either biased toward local feature extraction or global sequence modeling, which means they cannot capture this dual nature. This constraint requires a cohesive architecture capable of concurrently acquiring both fine-grained and long-range representations in a synchronized fashion.

Electric energy theft detection remains limited despite prior work (Islam Sajol et al., 2024; Kotipalli, 2024): (1) static imbalance methods fail under real-world distribution shifts (Islam Sajol et al., 2024); (2) models cannot jointly capture short- and long-term consumption patterns (Chen et al., 2026); (3) feature representations are incomplete or shallow (Kaur and Gabrijelčič, 2022); (4) evaluations are unrealistic, often ignoring operational constraints and relying on non-utility metrics (Barros et al., 2021); and (5) poor interpret-ability limits decision support in practice (Kotipalli, 2024). These research gaps motivate the need for a task-driven, multi-scale hybrid architecture, leading to the proposed Transformer-based wide and deep convolutional neural network (TWiDeCNN), which is specifically designed to jointly capture local irregularities, long-range dependencies, and hierarchical feature representations for sturdy and practical electricity theft detection.

This article proposes a hybrid TWiDeCNN framework that combines wide memorization, convolutional feature extraction, and self-attention to accurately find non-technical losses for the detection of electric energy theft.

• Multi-scale temporal modeling (CNN–Transformer) CNN finds small, short-term changes in local consumption, such as spikes, drops, and fluctuations. The transformer finds long-term temporal dependencies and patterns that span the globe. This clear separation enables modeling electricity theft behavior at different scales, which is not possible with stand-alone architectures (Gao et al., 2024).
• Wide branch for global feature learning Employs engineered statistical features, including mean, variance, load factor, seasonal and weekly ratios, and trends, to model stable global consumption behavior and infrequent interactions (Gao et al., 2024).
• Unified feature fusion To improve generalization without redundancy, deep and wide representations are combined into one embedding.
• Imbalance-aware learning (no resampling) Employs class-weighted loss, focal-style tuning, threshold optimization, and cost-sensitive learning to address class imbalance while maintaining the original data distribution (Lin et al., 2017).
• Utility-aligned evaluation The area under the receiver operating characteristic curve (AUC-ROC), the harmonic mean of precision and recall (F1-score), precision, and recall are all used to match real-world inspection constraints. Other metrics, like mean absolute precision (MAP) and recall at K, are also used.

The proposed TWiDeCNN is not merely a simple combination of parts like other hybrid models. Instead, it is a task-driven integration, in which each module is clearly linked to a specific feature of electricity consumption data. This study proposes a scalable and deployable framework for efficiently detecting anomalies in electric energy consumption by analyzing multi-resolution temporal patterns, integrating domain knowledge with comprehensive feature representations, and employing attention mechanisms to capture long-term and periodic dependencies. This study creates TWiDeCNN, a high-performance framework for detecting electric energy theft. It combines a wide and deep CNN with a transformer to capture local, global, and long-term temporal consumption patterns while addressing class imbalance in the real world. It checks whether TWiDeCNN can handle imbalanced SG data well and compares its predictive power to CNN, RF, and wide CNN using accuracy, MAP at 100/200, and AUC-ROC. The research suggests a scalable hybrid model that enhances feature representation, captures linear and spatiotemporal dependencies, addresses challenges of imbalance and periodicity, and provides a robust, generalizable, and computationally efficient solution. Experimental results consistently show that it is better than the best methods available today, proving that it can be used in the real world to find stolen SG electric energy.

The remainder of the article is organized as follows: Section 2 reviews the literature in NTL/theft detection methods, including hardware, state estimation, statistical ML, CNN/RNN, and transformer approaches, with evaluation and limitations. Section 3 explains research methodology. Section 4 presents the proposed model. Section 5 analyses and explains the key findings, practical impact, and limitations. Section 6 concludes the article and provides guidance for future work, domain adaptation, and attention-based intelligent systems.

2 Literature review

Studies from the recent literature apply machine learning (ML) and deep learning (DL) algorithms for smart grid (SG) electric energy theft detection. Kabir et al. (2021) use a hybrid multi-layer perceptron (MLP)–gated recurrent unit (GRU) with a synthetic minority oversampling technique (SMOTE) to handle imbalance, but SMOTE may cause overfitting, bias, and is unsuitable for multi-class and temporal consistency. In Javaid (2021), class imbalance and false-positive rate (FPR) are reduced via an adaptive synthetic sampling approach with edited nearest neighbor (ADASYNENN) and locally linear embedding (LLE) with hybrid models (a generative adversarial network convolutional neural network (GANCNN), a self-attention generative adversarial network (SAGAN), a convolutional neural network (CNN), and an ensemble residual network (ERNET)). However, ADASYN ignores time dependency, risking unrealistic synthetic samples. In Shehzad et al. (2021), GRU and GoogLeNet achieve ∼96% accuracy and handle imbalance, although GRU may overfit on unseen data. ConvLSTM in Gao et al. (2022) improves robustness and generalization but is computationally expensive due to high parameter complexity. Pamir et al. (2022) address class imbalance, FPR, and legit–malicious overlap using ML (e.g., support vector machine (SVM)), outperforming ADASYN but struggling with complex temporal patterns. Munawar (2022) uses bidirectional long short-term memory (BiLSTM)/bidirectional gated recurrent unit (BiGRU) for non-technical loss (NTL) detection with strong unseen data performance, while CNN–MLP generalizes poorly. Banga et al. (2022) compare 14 classifiers with six balancing methods; stacking + SMOTEENN performs best, but SMOTEENN ignores temporal structure, risking unrealistic samples. Lepolesa et al. (2022) show frequency-domain features outperform time-domain in deep neural network (DNN)-based classification, highlighting feature-domain importance. Zidi (2023) presents ETD2022, which employs binary classification across multiple ML models; conventional approaches are inadequate for addressing temporal dependencies. For NTL detection with high accuracy, Asif (2022) suggests a hybrid 2D-CNN + BiLSTM model. However, BiLSTM has trouble with long-range temporal gaps. Nawaz (2023) employs CNN-extreme gradient boosting (XGBoost) for one-dimensional data; however, CNN constrains the learning of temporal dependencies, diminishing its efficacy on time-series patterns.

Recent studies have further explored advanced hybrid and deep learning strategies for electricity theft detection. Attention-based wide and deep CNN models with dilated convolutions have been proposed to improve feature extraction under class imbalance conditions. Data-driven stacking frameworks leveraging grey relational analysis have been introduced to enhance classification robustness by combining heterogeneous learners (Xia et al., 2022a). Additionally, convolutional models with joint distribution adaptation have been developed to improve cross-regional generalization by reducing domain shift between different utility regions. Despite these advancements, existing methods remain fragmented, as they primarily address individual challenges such as imbalance handling, feature fusion, or domain adaptation, without jointly modeling multi-scale temporal dependencies within a unified learning framework (Sleiman et al., 2025).

Data-driven methods address high FPR and imbalance issues (Gu, 2022) but suffer from high model complexity and slow particle swarm optimization (PSO) convergence on large time-series datasets. In Almazroi and Ayub (2021), class imbalance and shallow model limits are mitigated, yet SMOTE introduces overfitting and data bridging effects. Deep reinforcement learning (DRL)-based balancing in Lee (2022) improves imbalance handling but reduces generalization on time-series ETD data. Deep learning models in Takiddin (2022) improve detection compared to shallow autoencoders (AEs)/variational autoencoders (VAEs)/adversarial autoencoders (AEAs) but require high computation and poorly capture temporal dependencies. In Cui (2022a), although feature isolation by DL effectively enhances theft detection, it causes majority class bias because of the imbalance. AlexNet/DCNN methods in Fawaz (2019) enhance sequential pattern discovery with a narrow receptive field and poor generalization. In Mercier (2022), differential privacy (DP) and federated learning (FL) enhance privacy and face communication overhead, data imbalance, and scalability limits under differentially private stochastic gradient descent (DP-SGD). Using NearMiss for imbalance and artificial bee colony (ABC) for tuning, AlexNet with Ullah (2022) improves classification. However, AdaBoost does not work well with high-dimensional data and does not capture temporal dependencies. Hybrid Siamese neural networks (SNNs) (Li et al., 2020) address time-series similarity but suffer from weak long-term dependency learning and high computational cost. The STS-D framework (Zhang et al., 2022) enhances reliability via dual subnetworks and supports distributed industrial data. Simple recurrent neural network (SRNN)-based methods (Pei et al., 2016) improve temporal similarity learning but require complex hard negative mining for effective metric learning. Dynamic time warping (DTW)-based augmentation (Yang et al., 2021) mitigates limited labeled data, yet autoencoders lack temporal modeling, leading to overfitting in small, noisy datasets.

Brunel (2019) proposes CNN and Siamese CNN for supernova time-series, but CNNs poorly capture temporal/periodic dependencies. Le Guennec et al. (2016) present t-LeNet with augmentation yet require broader warping and larger datasets. Fawaz et al. (2019) review multiple time-series models, although domain-specific exploration remains limited. Han et al. (2019) show CNN variants suffer from data scarcity and feature overlap, reducing accuracy. Asatani et al. (2020) combine VGG16 with long short-term memory (LSTM) on spectrograms, but performance suffers because of high variability and poor scalogram discrimination. DNN, CNN, recurrent neural network (RNN)–LSTM, SVM, VGG16, and ResNet50 are used in Sharma (2021) for music time-series. Future research should look into humdrum-based sequences and reinforcement learning (RL) strategies. A wide and deep CNN (1D global + 2D irregular features) is used in Zheng et al. (2018), but it does not balance the data and needs big datasets. Liao et al. (2022) propose a graph convolutional network (GCN)–CNN for temporal and latent features; the method has a high training cost. Ahmed (2022) surveys ML/DL methods, showing DL superiority in ETD. Cui (2022b) employs a convolutional autoencoder (CAE) with Tr-AdaBoost/XGBoost for PSE, but it fails on long-term dependencies. Sun (2023) uses a VAE–generative adversarial network (GAN) for imbalance, increasing complexity. Zhu and Niu (2025) introduce p2Detect for privacy, but it cannot handle dynamic cyber-attacks. Traditional single or homogeneous ensemble models reach a performance limit. The work in Xia et al. (2022b) proposes a heterogeneous stacking model to improve detection. Grey relation analysis (GRA) is used to select strong base learners (LG, LSTM, and KNN). An SVM is used as the meta-model in the stacking structure. The model is tested on real State Grid Corporation of China (SGCC) electricity consumption data. Results show improved performance with an AUC of 0.98675, outperforming existing methods.

3 Research methodology

3.1 Data cleaning and transformation

Electric energy consumption data often contains missing or inaccurate records due to smart meter failures, transmission instability, maintenance issues, and storage limitations (Genes et al., 2016). These missing values are typically estimated and reconstructed using interpolation methods, as described in Equation 1.Here, x t represents electricity consumption at time index t, and x ̂ t denotes the reconstructed value. Missing values are denoted as not a number (NaN). In addition, consumption data may contain outliers due to improper measurements. To handle these anomalies, values are corrected using the three-sigma rule of thumb (Wang et al., 2017), as given in Equation 2.Here, μ x and σ x denote the mean and standard deviation of the consumption vector x = { x t }. Only positive deviations are considered in Equation 2, as consumption patterns over 1,035 days show generally stable usage behavior, reducing the influence of extreme outliers.

x ̂ t = x t , x t ∉ NaN , x t + 1 + x t − 1 2 , x t ∈ NaN , x t + 1 ∉ NaN , x t − 1 ∉ NaN , 0 , x t ∈ NaN , x t + 1 ∈ NaN , x t − 1 ∈ NaN . (1)

x ̃ t = μ x + 2 σ x , x t > μ x + 2 σ x , x t , otherwise . (2)

After handling missing and anomalous data, Min–Max normalization is applied to scale all values uniformly, ensuring consistent ranges and stable neural network training. The normalization is defined in Equation 3.

x t norm = x t − min x max x − min x . (3)

In Equation 3, min ( x ) and max ( x ) represent the minimum and maximum values of the dataset, respectively.

3.2 Hybrid wide-deep convolutional neural network

Figure 1 shows a block diagram of our proposed model. Figure 2 shows the deep CNN and transformer model; the wide part is a fully connected layer that extracts the global pattern of 1D electric energy usage. Because consumption follows periodic trends, deviations may indicate theft. Treating usage as a 1D time series, the wide part “memorizes” co-occurring feature patterns to model user behavior (Chandola et al., 2009). Each neuron computes its output from the input usage vector as defined below.where y j denotes the output of the (j) neuron in a fully connected layer, where (n) is the input length,w i , j is the weight between input (i) and neuron (j), and (b) is the bias. The computed output is then passed through an activation function, which controls its influence on subsequent predictions.

y j ≔ ∑ i = 1 n x i w i , j + b j , (4)

u j ≔ f y j = max 0 , y j . (5)

After activation, the output is denoted as u j. This study uses rectified linear unit (ReLU) for nonlinear transformation, allowing only positive values to pass and helping reduce overfitting (Cheng, 2016). The forward pass propagates inputs through the network, while backpropagation updates the weights based on the output error.

3.3 CNN component (deep)

Electric energy theft exhibits irregular, non-intermittent patterns that are difficult to detect from noisy 1D daily consumption data. Converting data into 2D weekly representations improves pattern detection and feature learning using deep models (Wang et al., 2017). Accordingly, 1D data are reorganized into a weekly 2D form and processed by a deep CNN.

The CNN consists of convolutional, pooling, and fully connected layers, enabling effective feature extraction from the transformed data.

3.4 Multiple convolutional layers

Dense connections in fully connected networks limit scalability, while CNNs overcome this using local receptive fields (Cheng, 2016), where each neuron connects only to a small region of the input. Convolutional layers apply multiple filters to 2D data to extract hierarchical features.

In this work, (R) sequential CNN layers generate 2D feature maps using ( γ ) filters, adjusted experimentally, and handcrafted kernels are introduced to capture periodicity in electric energy consumption patterns.

The 2D convolutional layer identifies periodic components in weekly electric energy usage. Let ( v p ∈ R d ) represent a customer’s consumption in the ( p t h ) week, where (d = 7) corresponds to daily readings. For (m) weeks, the total consumption sequence ( v 1 : m ) is expressed as follows in Equation 6:

v 1 : m = v 1 v 2 ⋯ v m . (6)

Let m = ⌊ n / 7 ⌋. We define v p : p + k as feature fusion via direct concatenation of weekly energy values v p , v p + 1 , … , v p + k. Classical CNNs apply a filter w ̂ over a 3 × 3 window for feature extraction, which is effective in image recognition tasks. However, electric energy consumption data in 2D form differs structurally from images, requiring domain-specific kernels. Therefore, we design custom 2D convolution kernels tailored to consumption patterns for more meaningful feature extraction. The element c p + 1,1 + q is computed from the local window v p : 2 + p ; q : 2 + q using the following relation:

c p + 1 , q + 1 ≔ f w ⊤ g 1 v p : 2 + p ; q : 2 + q + g 2 v p : 2 + p ; q : 2 + q + b 2 . (7)

In this case, b 2 ∈ R is the bias term, and f ( ⋅ ) is a nonlinear activation function, like the hyperbolic tangent function (Yu and Koltun, 2016). The kernel functions g 1 ( ⋅ ) and g 2 ( ⋅ ) are specifically designed to handle two-dimensional electric energy usage data. In particular, the function g 1 ( ⋅ ) is defined as in Equation 8

g 1 v p : p + 2 , q : q + 2 = 2 v p , q : q + 2 − v p + 1 , q : q + 2 − v p + 2 , q : q + 2 2 v p + 1 , q : q + 2 − v p , q : q + 2 − v p + 2 , q : q + 2 2 v p + 2 , q : q + 2 − v p , q : q + 2 − v p + 1 , q : q + 2 . (8)

The function g 1 ( ⋅ ) enhances row-wise variations by subtracting neighboring row values, enabling the extraction of temporal trends and fluctuations. The function g 2 ( ⋅ ) is defined as in Equation 9

g 2 v p : p + 2 , q : q + 2 = g 1 v p : p + 2 , q : q + 2 T T . (9)

The function g 2 ( ⋅ ) captures column-wise variations by applying g 1 ( ⋅ ) on the transposed input and then transposing the result back. These operations are applied to sliding blocks v ( 1 : 3,1 : 3 ) , v ( 1 : 3,2 : 4 ) , … , v ( m − 2 : m , n − 2 : n ) to generate the feature map, as shown below in Equation 10.

C = c 1,1 ⋯ c 1,7 ⋮ ⋱ ⋮ c m , 1 ⋯ c m , 7 . (10)

In this context, c represents the output feature map, which maintains the same dimensionality as the original input matrix because a zero-padding of size 1 has been applied.

3.5 Pooling layer

Pooling layers in CNNs reduce model complexity by decreasing the number of parameters and removing redundant information. They also improve convergence and help mitigate overfitting. Max pooling is a widely used technique that selects the maximum value within a pooling region (Collobert et al., 2011). In this work, max pooling is defined as c − max ( c ), where c is the feature map from Equation 7.

In forward propagation, max pooling selects the highest value in each region. In backpropagation, gradients are passed only to the locations that produced these maximum values.

3.6 Dense layer (fully connected)

The deep CNN layer integrates extracted features and performs estimation analogous to the wide component but within a different feature representation space. The wide component is defined with size α, while the deep CNN branch maintains a fixed dimension of 8. This layer focuses on selecting the most informative features derived from convolution and pooling operations. It behaves similarly to a fully connected layer in the wide branch, as described in Equation 4 and Equation 5.

Finally, the outputs from the wide and deep CNN branches are combined through a weighted summation to form a unified representation, which is then fed into a logistic loss function for joint optimization and prediction (Cui, 2022a). Both branches are trained simultaneously in an end-to-end manner using backpropagation, and the final prediction is expressed as in Equation 11

P Y = 1 ∣ x ≔ δ W X wide , X CNN + b . (11)

In this formulation, Y represents the multi-class target label, while δ ( ⋅ ) denotes the sigmoid activation function. X wide and X CNN correspond to the inputs of the wide and CNN branches, respectively. W indicates the learned weights, and b is the bias term. CNNs effectively learn local spatiotemporal features but have limitations in capturing long-range dependencies due to constrained receptive fields. The wide component models statistical relationships but lacks strong generalization capability. Although a wide and deep convolutional neural network (W-DCNN) integrates both, it does not explicitly capture long-term temporal dependencies. To address this limitation, a transformer encoder is incorporated to model long-range interactions using self-attention, enabling improved learning of complex temporal patterns in electric energy consumption data.

4 Proposed wide-deep CNN–transformer model

The proposed TWiDeCNN framework integrates a wide neural network, a deep CNN, and a transformer encoder to jointly learn structured, spatial, and temporal representations for electric energy theft detection, as shown in Figure 2.

4.1 Deep CNN-Based feature extraction and sequence transformation

To effectively capture the complex spatiotemporal characteristics of electricity consumption data, the proposed framework first employs a deep convolutional neural network (CNN) to learn hierarchical feature representations. The raw input is modeled as a three-dimensional tensor:where in Equation 12 X denotes the input tensor, H and W represent the spatial (or temporal-windowed) dimensions, and C corresponds to the number of feature channels (e.g., historical load, voltage, or derived statistical features). With this definition, it is possible to encode the evolution of consumption in a systematic, multidimensional fashion.

X ∈ R H × W × C , (12)

Feature extraction is carried out by stacking convolutional layers, in which each layer consists of a filter (learning) followed by a nonlinear activation in Equation 13:where X ( l ) is the feature map at layer l, Θ ( l ) is the convolutional kernel parameters, and R e L U ( ⋅ ) is the activation function that introduces non-linearity to increase representation ability. The dimension is reduced by spatial down-sampling, which is called pooling as shown in Equation 14:where s p denotes the pooling stride. This operation enhances translational invariance and mitigates overfitting by retaining the most salient activations.

X l = R e L U C o n v 2 D X l − 1 ; Θ l , (13)

X l = M a x P o o l X l ; s p , (14)

After R convolutional blocks, the resulting high-level feature representation is expressed as in Equation 15 where H ′ and W ′ denote the reduced spatial dimensions, and γ represents the number of learned feature channels. This tensor encapsulates compact yet semantically rich representations of consumption patterns.

X cnn ∈ R H ′ × W ′ × γ , (15)

To enable temporal dependency modeling via attention mechanisms, the CNN output is reshaped into a sequential representation in Equation 16:where T = H ′ × W ′ defines the sequence length, and d = γ is the embedding dimension. This transformation facilitates compatibility with transformer-based architectures.

X seq ∈ R T × d , (16)

4.2 Transformer encoding and global feature learning

To capture long-range temporal dependencies and global contextual relationships, the sequence representation is processed using a transformer encoder. The core attention mechanism is defined as in Equation 17 where Q, K, and V denote the query, key, and value matrices derived from linear projections of X seq, and d k is the dimensionality of the key vectors used for scaling to stabilize gradients. The transformer encoder layer consists of a multi-head self-attention (MHA) mechanism followed by residual connections and normalization given in Equation 18:where M H A ( ⋅ ) aggregates information across multiple attention heads, enabling the model to jointly attend to information from different representation subspaces. Subsequently, a position-wise feed-forward network (FFN) refines the learned representations as in Equation 19:where W 1, W 2, b 1, and b 2 are learnable parameters, and σ ( ⋅ ) is a nonlinear activation function (e.g., GELU or ReLU). This structure enhances feature abstraction and expressiveness. To obtain a fixed-length representation, global temporal aggregation is performed using Equation 20:where max pooling selects the most discriminative features across the temporal dimension, producing a compact deep feature vector.

A t t e n t i o n Q , K , V = s o f t m a x Q K ⊤ d k V , (17)

X 1 = L a y e r N o r m X seq + M H A X seq , (18)

X 2 = L a y e r N o r m X 1 + W 2 σ W 1 X 1 + b 1 + b 2 , (19)

X deep = max t ∈ 1 , … , T X 2 , (20)

4.3 Wide component and feature fusion

In parallel to the deep feature extraction, a wide component is employed to explicitly model low-order feature interactions and domain-specific attributes given in Equation 21:where X wide denotes manually engineered or statistical features (e.g., load variance, peak usage), W and b are learnable parameters, and ϕ ( ⋅ ) is a nonlinear activation function. The final representation is obtained by fusing deep and wide features represented in Equation 22:where ‖ denotes concatenation, enabling the integration of both implicit (deep) and explicit (wide) feature representations.

X wide ′ = ϕ W X wide + b , (21)

X fusion = X wide ′ ‖ X deep , (22)

4.4 Output layer and optimization objective

The fused feature vector is mapped to the output space using a fully connected layer given in Equation 23:where y ̂ ∈ [ 0,1 ] represents the predicted probability of electricity theft, W f and b f are trainable parameters, and σ ( ⋅ ) is the sigmoid activation function. The model is trained by minimizing the binary cross-entropy loss defined in Equation 23:where N denotes the number of samples, and y i ∈ { 0,1 } represents the ground-truth label. This objective function penalizes misclassifications and ensures probabilistic consistency during optimization.

y ̂ = σ W f X fusion + b f , (23)

L = − 1 N ∑ i = 1 N y i ⁡ log y ̂ i + 1 − y i log 1 − y ̂ i , (24)

5 Experimental findings

The State Grid Corporation of China (SGCC) electric energy consumption dataset was used for the experiments, ensuring a realistic evaluation. The dataset comprises 42,372 customers over 1,035 days (January 2014 to October 2016), sourced from Zheng et al. (2018). It contains missing and noisy records, which were addressed using the preprocessing methods outlined in Section 3.1.

5.1 Case study and data

SGCC reported 3,615 cases of electricity theft in China, which is approximately 9% of all customers (see Table 1). These confirmed cases show how widespread electric energy theft is in the area and provide a basis for testing the proposed method and other similar ones.

TABLE 1. Dataset description with numbers.

5.2 Evaluation metrics in this study

The area under the curve (AUC) and the mean average precision (MAP) are two ways to measure how well the model works. They are explained below.

AUC is a common method of measuring how well classification and ranking work. It measures how likely it is that a randomly chosen positive instance will get a higher rank than a randomly chosen negative instance. The approximate formula for AUC is given by Zheng et al. (2018):where R a n k i indicates the rank of the i-th instance, M denotes the number of positive samples, and N denotes the number of negative samples. The ranking is performed in ascending order based on the predicted scores.

A U C = ∑ i ∈ P R a n k i − M 1 + M 2 M × N , (25)

Ranking performance is further evaluated using MAP. In this work, MAP measures how effectively the model orders labels in the test set according to predicted scores, with emphasis on the top-N results. For this purpose, precision at position k (P@k) is defined following Zheng et al. (2018) in Equation 26:where y k denotes the number of correctly identified electric energy theft cases up to rank k. The average of these precision values is computed as MAP@N (considering the top N predictions), defined as:where r represents the number of correctly identified electric energy theft labels within the top N, and k i ( i = 1 to r ) denotes the rank position of each correctly identified label.

P @ k = y k k , (26)

M A P @ N = ∑ i = 1 r P @ k i r , (27)

5.3 Comparison of model performance

5.3.1 Threshold sigma rule (TSR)

TSR is an old-fashioned anomaly detector. In this article, we utilize it as a reference point in identifying electric energy theft regardless of the preprocessing of the process of identifying it. The detection of electric energy theft in terms of the TSR formulation can be expressed as in Equation 28 where I ( x i , X , θ ) is an indicator function defined as in Equation 29

T S R θ = 1 n ∑ i = 1 n I x i , X , θ , (28)

I x i , X , θ = 1 , if x i > μ X + θ ⋅ σ X , 0 , otherwise . (29)

In this formulation, x i denotes the i-th element of the vector X, and n is the total number of elements. The parameter θ specifies the threshold for outlier detection and is typically chosen within the range [ 1,4 ], where μ X and σ X represent the mean and standard deviation of X, respectively.

5.3.2 Logistic regression (LR)

Logistic regression (LR) is a widely used approach for binary classification. It can be interpreted as a single-layer neural model that applies a sigmoid activation function to estimate the probability distribution of class labels.

5.3.3 GRU

A gated recurrent unit is a simplified recurrent neural network architecture that uses update and reset gates to control information flow and capture temporal dependencies efficiently with fewer parameters than an LSTM.

5.3.4 LSTM

Long short-term memory is an advanced recurrent neural network designed to learn long-term dependencies using memory cells and three gates: input, forget, and output gates, which help mitigate the vanishing gradient problem.

5.3.5 RF

Decision tree models have previously been used for power quality disturbance detection (Pei et al., 2016). This extends to random forest (RF), which ensembles multiple binary decision trees, improving predictive performance and reducing overfitting compared to a single decision tree.

5.3.6 SVM

The extensive use of support vector machines (SVMs) in previous research has helped to identify and surmise the presence of electric energy theft because of their strong generalization features in classification programs.

5.3.7 Wide exclusive

This type of presented wide CNN model does not involve the deep module. It is trained on single-dimensional electric energy consumption data, which corresponds to the deep component in the complete model.

5.3.8 CNN-exclusive: parameter configuration for baseline approaches

In the configuration detailed in Table 2, only the CNN portion of the W-DCNN framework is employed, with the wide branch omitted, and training is performed using two-dimensional energy usage data, preserving its capability to capture hierarchical spatial and temporal patterns.

TABLE 2. Dataset description with methods, features, and values.

Table 3 compares the TWiDeCNN against benchmark models. Experiments use random consumption subsets under 70% training splits with fixed parameters (α = 90, β = 60, γ = 15). Performance is evaluated using AUC (Equation 24) and MAP@100,200 (Equation 26). Results show TWiDeCNN consistently outperforms LR, RF, SVM, CNN, GRU, LSTM, wide, and W-DCNN across all splits.

TABLE 3. A comparative analysis with conventional approaches was performed using fixed parameter values ( α = 90 , β = 60 , γ = 15 ) to ensure a consistent and unbiased evaluation.

5.4 Parametric influence and effect in our study

This subsection analyzes the effect of parameter settings on the performance of the proposed TWiDeCNN model using 70% training splits. These ratios provide a balance between learning capacity and generalization by ensuring sufficient data for deep feature extraction and transformer-based temporal modeling, while maintaining a reliable evaluation set. Experimental results show that at 70% splits, AUC and MAP exhibit higher stability and consistency, indicating improved convergence and robustness compared to lower training ratios. Therefore, a 70% split is selected as the optimal training configuration.

5.5 Transformer hyperparameters

The transformer encoder was configured with four multi-head attention heads and a feed-forward network dimension of 64 to balance feature extraction capability and computational efficiency.

5.5.1 Influence of α in our proposed model

The parameter α controls the number of neurons in the fully connected layer of the wide branch. To assess its impact, α ∈ [ 10,120 ] (step = 1) was varied, while β and γ 64 and 10 were kept fixed, respectively. Influence of α using β = 64 and γ = 15 over a range of 10–120 neurons.

Figure 3 shows that increasing neurons α in the wide branch improves MAP and AUC by enhancing feature extraction from 1D electric energy consumption sequences, but only up to an optimum; beyond this, performance degrades, with the best AUC at α = 20. A similar trend is observed for MAP; however, optimal α varies by model and metric: MAP@N is maximized for TWiDeCNN at α = 20 (Figure 3), indicating metric- and architecture-dependent optimal width.

The confusion matrix shown in Figure 4 indicates that the model achieves a recall of approximately 12.5% for the theft class (138 true positives out of 1103 actual cases), implying that many theft instances are missed at the current decision threshold. The few false positives also point to a conservative operating point that puts more weight on precision than recall. It is important to note that evaluation metrics like MAP@100, MAP@200, and AUC show how well the model ranks and how well it can tell the difference between different things, not how well it does at a set threshold. The high scores in these metrics show that theft-related cases usually get higher scores than non-theft cases, even if this is not shown in recall at the default threshold. This behavior is largely driven by threshold selection: lowering the threshold can substantially improve recall, albeit with reduced precision. Such trade-offs are typical in imbalanced settings and suggest that the model’s underlying capability is better captured by threshold-independent metrics like AUC.

The ROC curve in Figure 5 shows that the transformer-based, wide-and-deep CNN achieves strong class separability for electric energy theft detection, with a curve well above the random baseline. The high AUC (Equation 24) indicates a robust balance between true positive and false-positive rates, confirming effective discrimination of theft vs. normal consumption patterns.

AUC, as shown in Figure 6 increases rapidly in early epochs and then stabilizes, indicating fast convergence and stable learning. This trend confirms effective feature learning from temporal-spatial patterns with no significant overfitting, leading to consistent and reliable performance.

5.5.2 Influence of β in our proposed model

The parameter β is used as the number of neurons in the fully connected layer that follows the CNN pooling layer. To analyze its impact, β ∈ [ 10,140 ] (step = 1) is varied, while α = 60 and γ = 15 are fixed. Experiments are conducted using 70% training splits to evaluate robustness. The influence of β using α = 60 and γ = 15 over a range of 10–140 neurons is examined.

Figure 7 shows that TWiDeCNN achieves optimal performance at β = 126, where both AUC (Equation 24) and MAP (Equation 26) (100, 200) are maximized, indicating the best balance between feature capacity and generalization. Overall, TWiDeCNN consistently outperforms across all metrics, confirming that the transformer integration enhances ranking quality and improves discrimination of electric energy consumption patterns.

The model has a high specificity (96.37%) but a low recall (30.28%), as shown in Figure 8. This is a design choice that aims to reduce false positives, which is important for finding electricity thieves in real life when there are not many resources to check. We also use MAP@100 and MAP@200 to see how well the model works at ranking high-risk customers for inspection, in addition to metrics based on confusion matrices. This shows that the model works well to prioritize theft cases among the top-ranked candidates, even though global recall is limited.

The ROC curve (Figure 9) demonstrates that the proposed transformer-based wide and deep CNN model achieves an AUC of 0.79 (Equation 24), indicating strong discriminative capability in distinguishing electric energy theft from legitimate consumption patterns. The curve lies significantly above the random classifier baseline, confirming the effectiveness of the proposed architecture in SG anomaly detection.

The AUC progression across epochs (Figure 10) demonstrates stable learning behavior, in which the proposed transformer-based wide and deep CNN gradually improves its discriminative capability and converges to an AUC of approximately 0.79, indicating consistent model optimization during training.

5.5.3 Influence and effect of γ in our proposed model

In the wide and deep CNN, γ denotes the number of convolutional filters. To study its effect on performance, γ ∈ [ 1,20 ] is varied, while α and β = 60. Experiments are conducted under 70% training splits to evaluate robustness. The influence of γ using α = 60 and β = 60 over a range of 1–20 filters is examined. Figure 11 shows that TWiDeCNN reaches its peak performance at γ = 15, where the AUC (Equation 24) reaches its peak. Figure 12 show the AUC as a function of γ for both models, where an optimal range progressively improves model performance until more complex feature representations lead to overfitting beyond the best value. In conclusion, selecting a suitable γ allows us to balance model capacity and generalization, enabling TWiDeCNN to achieve optimal detection performance.

The model has a very high specificity (99.47%) and precision (70.90%), which means it is very good at not giving false alarms, as shown in Figure 13. However, the recall (13.69%) is low, which means that many theft cases go unnoticed at the chosen operating point. This shows a cautious approach to detection aimed at reducing false positives.

The ROC curve (Figure 14) (AUC = 0.7804) shows moderate discriminative ability, with performance clearly better than random but with room for improvement in class separation.

AUC steadily improves across epochs (Figure 12) and converges at approximately ∼0.78, indicating stable learning and good generalization without significant overfitting.

5.6 Influence and effect of R in our proposed model

The parameter R controls the number of layers in the deep learning component. To analyze its effect, R ∈ [ 1,5 ] (step = 1) is evaluated under an 80% training ratio. The results in Table 4 show that AUC depends on R, with TWiDeCNN performance improving as depth increases.

TABLE 4. Effect of R, number of control layers.

Both AUC (Equation 24) and MAP@N (Equation 26) exhibit a consistent upward trend with deeper architectures, indicating that increased layer depth enhances predictive accuracy in W-DCNN-based models.

6 Conclusion

In this article, we proposed an electric energy theft detection framework, TWiDeCNN. TWiDeCNN captures global features, extracts spatial patterns, models temporal dependency, and is designed as an end-to-end architecture to efficiently combine the power of wide learning, deep CNN feature extraction, and transformer-based sequence modeling. It is focused on describing complex consumption behavior with good accuracy. In-depth simulation results on the SGCC dataset demonstrate that TWiDeCNN performed better than the original wide model. In addition, it outperforms deep CNN, and the other benchmarks in terms of ranking capability and detection performance with the MAP@100 of 96.00 % and MAP@200 of 93.58 %. In addition, parameter sensitivity analysis shows that proper tuning of parameters α, β, γ, and R would help the model build a deep feature-based, powerful representation and a better adaptation ability, resulting in an effective model for long-range dependence in the consumption series due to the proposed transformer module. TWiDeCNN could provide an efficient, scalable, and practical method for intelligent anomaly detection for smart grids and could be utilized in an electric energy monitor and supervision system. However, the model shows low recall in detecting theft cases (approximately 12.5 %), which limits its effectiveness in identifying all fraudulent activities. TWiDeCNN could provide an efficient, scalable, and practical method for intelligent anomaly and suspicious activity detection in smart grids.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. Generative AI tools were utilized to refine syntax and improve readability. However, AI-assisted changes were reviewed and approved by the authors to ensure technical accuracy and integrity.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Nomenclature

X Input data tensor X cnn CNN feature representation X seq Sequential input to transformer X deep Deep feature vector after transformer X wide Input to wide component X wide ′ Output of wide component X fusion Fused feature vector y , y ̂ True and predicted labels α Number of neurons in the wide layer β Number of neurons after CNN pooling γ Number of convolutional filters R Number of CNN layers H , W , C Height, width, and channels of input T , d Sequence length and feature dimension Q , K , V Query, key, and value matrices W , b Weights and bias σ Sigmoid activation function ϕ Activation function in the wide layer L Loss function (binary cross-entropy) AUC Area under the curve MAP Mean average precision TSR Threshold-based statistical rule LR Logistic regression RF Random forest SVM Support vector machine SGCC State Grid Corporation of China

Footnotes

Edited by: Mosè Rossi, Marche Polytechnic University, Italy

Reviewed by: Jiangzhao Wang, East China Jiaotong University, China

Kavin Rajagopal, Sri Krishna College of Engineering and Technology, India