Complete a life-cycle inventory without sharing one.
A consortium of smelters and refineries each holds a partial life-cycle inventory (LCI): some elementary flows measured, some missing. Together, by federated learning, they train an estimator of the missing inventory value; each member runs it at home to fill its gap, with an uncertainty band. The environmental footprint is then computed the standard, deterministic way, with the real public EF characterisation factors.
Every number on this page comes from the same fixed setup, so anyone who runs it again gets exactly the same result. It shows how the method works; it is not a real customer's data. The plant inventories are made up (synthetic), but the final footprint is computed with the real, public EF factors that anyone is free to reuse (licence CC BY 4.0).
Each plant sees only part of the picture
Every plant has a holed inventory: it meters some flows continuously and estimates or omits others. No plant may see a competitor's inventory. Yet the missing flows are exactly what a credible footprint needs. A plant on its own is myopic; the collective, together, has metered every flow, but the data cannot be pooled.
An estimator of the missing inventory value, nothing more
The federated model imputes a missing elementary-flow quantity (here fine particulate matter, PM2.5) from the flows a plant does measure. It is a regression (a continuous quantity), so we report RMSE / MAE, never accuracy. The model is made available to members and never retained by Mesh. It only imputes the missing inventory; it does not compute the footprint: that is a separate, deterministic calculation with real EF factors.
Federated beats solo, and approaches full sharing
The imputed flow comes with an uncertainty band
Completed inventory × real EF factors → impact scores
The model travels, inventories stay home
Honesty box — what the demo runs vs. the target architecture
This is a mechanism demonstration, not a client result. Synthetic inventories; a real public EF calculation layer. Everything below is stated the way it actually is.
| Topic | What the demo actually runs | Target architecture / conditional |
|---|---|---|
| Secrecy enclave | Nothing: FedAvg aggregation runs in-process, in the clear, in the back-end. | In production, aggregation runs inside a Secrecy confidential-compute enclave (target architecture). This proof-of-concept does not run inside an enclave. |
| E2EE transport | RSA-OAEP + AES-GCM, actually exercised in a secure context (https/localhost); a labelled clear round-trip otherwise. This is WebCrypto, not Secrecy. | Nothing to overstate — the model-update transport is not "Secrecy". |
| Coordinator | Sees the individual encrypted weight updates; blind to the data, no secure aggregation. | "sees only encrypted model updates, never raw data"; secure aggregation is roadmap. Never "aggregates without seeing anything". |
| Differential privacy | Gradient clipping + small Gaussian noise, deterministic PRNG, no ε guarantee. | "reduces re-identification risk (ε to be set per deployment)". Shown as an illustrative trade-off, not an audited privacy budget. |
| EF scores | Real where flagged: verified public EF characterisation factors, deterministic calculation. Other factors flagged illustrative / to-be-sourced. | Verifiable — can be recomputed by hand from the public EF reference package. |
| The AI model | Imputes only the missing inventory flow (regression). | Never "computes / predicts the footprint". |
| Distributed model | Made available to members, never retained by Mesh. Any public query interface would be hardened. | Affirmed as-is. |
| Figures | Seed 42, reproducible, on synthetic inventories (real-verifiable only for the EF factors). | "mechanism demonstration, not a client result". Magnitude of the gain is chosen by us in a synthetic world; illustrative of the mechanism, not a promised performance. |
How it works
Overview
The proof-of-concept imputes a missing LCI flow by federated regression, then computes the environmental footprint deterministically with real EF characterisation factors. Nothing leaves the plant: only encrypted model updates are exchanged. All computation is seeded (42) and reproducible.
Data & sources
Real layer: public EF characterisation factors. The footprint scores are computed the standard, deterministic way (inventory × characterisation factors) using factors from the Environmental Footprint (EF) 3.1 reference package published by the European Commission's Joint Research Centre on the EPLCA / Life Cycle Data Network (eplca.jrc.ec.europa.eu/LCDN/developerEF.html). That public package is a vocabulary + calculation layer only (93,993 elementary flows, 25 LCIA methods, zero processes, no company data), and is released under CC BY 4.0 (Commission Decision 2011/833/EU); we reuse it with attribution. Verified factors used here: Climate change, CO2 fossil = 1.0 kg CO2 eq/kg (IPCC AR5 GWP100); Acidification (Accumulated Exceedance), SO2 = 1.31, NOx = 0.74 mol H+ eq/kg (Seppälä 2006 / Posch 2008); Particulate matter, primary PM2.5 ≈ 6.29e-4 disease inc./kg (Fantke et al. 2016, UNEP). Factors we could not fully verify against the JRC supporting information are flagged in the data as illustrative / to-be-sourced (secondary-PM contributions of SO2/NOx; the generic ore proxy for Resource use, minerals & metals, whose real EF ADP factors are element-specific; the AWARE water factor, which is region-dependent; and the USEtox ecotoxicity placeholders). We label them as such rather than present them as official EF values.
No licensed data is used. Real metal-process inventories (Sphera, ecoinvent, EF-compliant datasets) are licensed and excluded; none is ingested, copied, or re-published. Only the openly viewable, aggregated EF/JRC 2014 datasets (secondary data, "no producer approval") were consulted, and solely to set order-of-magnitude medians, never imported.
Elementary flows retained (16). Energy carriers (electricity, natural gas, coke, heavy fuel oil); air emissions (CO2 fossil, SO2, NOx, PM2.5, NMVOC); trace metals (Pb, Cd to air; Zn, Ni to water); water (process intake, net consumption); and metal ore/concentrate input, all per one tonne of metal output. Each flow carries its EF name and compartment; the reference ef_uuid is marked "uuid-to-source" (to be resolved against the EF node by name + compartment; we do not fabricate identifiers).
The imputation target: fine particulate matter (PM2.5). The federated model estimates a single missing flow: PM2.5 to air. It was chosen deliberately. (1) It is genuinely under-metered: continuous fine-PM speciation is rare; plants typically report total dust and estimate the PM2.5 fraction, so the "missing value" is realistic. (2) It feeds a headline impact category (Particulate matter) directly, so the imputation → real-footprint story is tight. (3) It is physically predictable from measured flows (combustion intensity, SO2, NOx, energy, abatement efficiency), giving the federated regressor a real signal to exploit. (4) It is an emission, not a competitively sensitive variable, consistent with the LCI-only scope. PM2.5 is a training label at all six plants, while the predictor flows are measured heterogeneously across plants (non-IID by column), which is where federation helps.
How the synthetic inventories were built. Fully synthetic, seeded (42), six plants (two aluminium, two copper, two zinc), each with its own regime (primary vs secondary route, energy mix, abatement level). Predictor flows are drawn as correlated log-normals from shared latent factors (energy / combustion / abatement), with medians calibrated to public 2014 orders of magnitude. The target is generated as a log-linear function of the other flows plus noise: a plausible co-emission relationship that makes it imputable without being trivial. Each plant measures only a subset of predictor flows; missing predictors are masked to the mean (zero in standardised space) at run time, exactly as in Mesh's reference engine. Every predictor is observed by ≥ 2 plants (guaranteed overlap) and every plant is blind on ≥ 2 strong predictors, so no single plant can do alone what the collective does together.
Standardisation. Because LCI quantities are log-normal, each flow is log-transformed then z-scored; the regression is therefore linear in log-space (well specified). De-standardisation is x_phys = exp(mean + std·z) (not mean + std·z), and the ±1.96·σ prediction band is symmetric in log-space, i.e. multiplicative (asymmetric) in physical units: exp((ẑ ± 1.96·σ)·std + mean). This is the physically correct band for a log-normal quantity.
What the numbers are, and are not. On a fixed seed, imputation error (RMSE, standardised) is lower for the federated model than for the best standalone plant, and approaches the centralised (full-sharing) bound without any inventory being shared; the residual gap to that bound is shown too. These figures are illustrative of the mechanism on synthetic inventories: not a client result, not a measured performance on real European-metals data, and not an official EF database.
The learning task
Each plant holds a partial life-cycle inventory: a vector of elementary-flow quantities, some measured, some missing. The consortium trains a regression model that estimates a missing flow quantity from the observed ones. This is imputation of a continuous quantity, not classification, so we report RMSE and MAE, never accuracy. Partitioning is non-IID by column masking: a plant that does not measure a given flow simply does not contribute that column, mirroring the real heterogeneity of industrial metering.
Model & training
The estimator is a linear model ŷ = b + w·x trained to minimise mean squared error. Training is mini-batch SGD; per round, each plant starts from the shared global weights, runs a few local epochs on its own (masked) inventory, and returns a weight update. Updates are combined by FedAvg (weighted by sample count). We run 12 rounds. Two baselines frame the result: a solo model per plant (each plant alone) and a centralised model trained on the pooled inventories (which would violate confidentiality, shown only as an upper bound). The federated model is expected to sit between the two: lower error than any solo model, approaching the centralised one, without any inventory being shared. Hyperparameters (learning rate, local epochs, batch size, L2) are fixed and the run is seeded, so the numbers are reproducible; we verify that global RMSE decreases monotonically across rounds.
Uncertainty
Alongside each estimate we report a prediction band. We take the residuals on a held-out test set, r = y − ŷ, and use their standard deviation σ (equal to the test RMSE up to the residual mean). The band is ŷ ± 1.96·σ, de-standardised into the flow's physical unit. Crucially, we also show the empirically measured coverage (the fraction of test points that actually fall inside the band) next to the nominal 95%, so any departure from the Gaussian/homoscedastic assumption is visible rather than hidden. This band captures residual (aleatoric) noise, not epistemic uncertainty on the weights; a distribution-free split-conformal band is the intended production upgrade.
Deterministic footprint layer
The AI never computes a footprint. Once the inventory is completed (measured flows + the imputed flow), the environmental footprint is computed the standard, deterministic way: inventory × characterisation factors, across the 16 EF impact categories (4 headline categories shown here). The vocabulary of elementary flows and the characterisation factors are taken from the public EF reference package; each verified factor (flagged real CF) can be recomputed by hand against that package, while each flow's reference ef_uuid is still marked uuid-to-source (to be resolved against the EF node, see Data & sources). Because this layer is linear in the flow quantities, the uncertainty on an imputed flow propagates in closed form: σ(impact) = |CF| · σ(flow).
Transport & privacy architecture
Model updates are exchanged with end-to-end encryption (RSA-OAEP wrapping a per-message AES-256-GCM key, via WebCrypto). In a secure context (HTTPS/localhost) this encryption is exercised live; opened as a local file it may be skipped by the browser (WebCrypto is restricted to secure contexts), and the federation maths is identical either way, with the transcript labelled accordingly. The coordinator sees only encrypted model updates, never raw data: it is blind to inventories and, as an option, can be blind to the model itself; all by design. Optional differential privacy (gradient clipping + small Gaussian noise) reduces re-identification risk; it carries no formal ε guarantee here, ε is to be set per deployment.
Reproducibility & code
All computation is seeded (42), so results are deterministic. The learning primitives (PRNG, Gaussian sampler, SGD, FedAvg, the E2EE transport) are faithful copies of Mesh's reference engine, only the model head differs (linear/MSE instead of logistic). The federated regression runs on the password-protected back-end; no inventory data is exposed to the page.
Limitations & roadmap
Single-target imputation (one flow) generalises to multi-target by running the estimator per flow. The uncertainty band is homoscedastic (global) and assumes ~Gaussian residuals; split-conformal is the intended upgrade. The estimator is linear/ridge, whereas real LCI relations can be non-linear. DP is illustrative without an audited ε budget. A single seed is used by default; a multi-seed range is recommended. By design, the aggregation can run inside a Secrecy confidential-compute enclave as an option. Calibrated DP and a pilot on real member inventories (never leaving each member) are the path to production.