Bayesian Differential Privacy for Linear Dynamical Systems

As the Internet-of-Things (IoT) and cloud computing are attracting more and more attention for their convenience, privacy protection and security have become key technologies in control systems. To cope with privacy threats, many privacy protection methods have been studied so far [1, 2, 3]. Among them, differential privacy [4] has been used to solve many privacy-related problems in areas such as smart grid [5], health management [6], and blockchain [7], because it can mathematically quantify privacy guarantees. Differential privacy has originally been applied to static data, but as shown in the example of power systems above, there is an urgent need to establish privacy protection techniques for dynamical systems. In recent years, the concept of differential privacy has been introduced to dynamical systems [8], and from the viewpoint of control systems theory, the relationship between privacy protection and the observability of systems has been clarified, and methods of controller design with privacy protection in mind have been studied [9, 10, 11].

Conventional differential privacy is a privacy measure based on the difficulty of distinguishing similar data, where $x$ and $x^{\prime}$ are regarded as being similar if $|x-x^{\prime}|\leq c$ for a prescribed $c>0$. To put it conversely, there is no indistinguishability guarantee for $x$ and $x^{\prime}$ if $|x-x^{\prime}|>c$. This implies there is a risk of information leakage when there are outliers from normal data as pointed out in [12]. For example, unusual electricity consumption patterns may contain highly private information about the lifestyle. In the literature [13], a new concept called Bayesian Differential Privacy is developed for static data to solve this problem. Bayesian differential privacy considers the underlying probability distribution of the data, and attempts to guarantee privacy for data sets that are far apart.

In this study, we consider a prior distribution for the signal that we want to keep secret and introduce Bayesian differential privacy for linear dynamical systems. Similar to the conventional differential privacy cases [9], we consider a mechanism where stochastic noise is added to the output data. Note that applying a large noise increases the privacy protection level, but decreases the information usefulness [14]. In Theorem 7 below, a lower bound of noise scale to guarantee a prescribed Bayesian differential privacy level will be derived. Other properties including the relation to the conventional case are investigated based on this. The rest of this paper is organized as follows. In Section II, we introduce differential privacy for dynamical systems. In Section III, we propose Bayesian differential privacy for dynamical systems and derive a sufficient condition for added noise to achieve its privacy guarantee. In Section IV, considering the trade-off between privacy and information utility, we derive the Gaussian noise with the minimum energy while guaranteeing the Bayesian differential privacy. In Section V, the usefulness of Bayesian differential privacy is described via a numerical example. Some concluding remarks are given in Section VI.

In this section, we briefly overview fundamental results on differential privacy for dynamical systems. Consider the following discrete-time linear system:

for $t\in{\mathbb{Z}}_{+}$, where $x(t)\in{\mathbb{R}}^{n}$, $u(t)\in{\mathbb{R}}^{m}$, and $y(t)\in{\mathbb{R}}^{q}$ denote the state, input, and output, respectively, and $A\in{\mathbb{R}}^{n\times n}$, $B\in{\mathbb{R}}^{n\times m}$, $C\in{\mathbb{R}}^{q\times n}$, and $D\in{\mathbb{R}}^{q\times m}$. For simplicity, we assume $x(0)=0$ and the information to be kept secret is the input sequence $U_{T}$ up to a finite time $T\in{\mathbb{Z}}_{+}$. For (3), the output sequence $Y_{T}\in{\mathbb{R}}^{(T+1)q}$ is described by

where $N_{T}\in{\mathbb{R}}^{(T+1)q\times(T+1)m}$ is

To proceed with differential privacy analysis, we consider the output $y_{w}(t)\coloneqq y(t)+w(t)$ after adding the noise $w(t)\in{\mathbb{R}}^{q}$; see Fig. 1. From (4), $Y_{w,T}\in{\mathbb{R}}^{(T+1)q}$ can be described by

which defines a mapping ${\mathcal{M}}\colon{\mathbb{R}}^{(T+1)m}\times\Omega\ni(U_{T},\omega)\mapsto Y_{w,T}\in{\mathbb{R}}^{(T+1)q}.$

In differential privacy analysis, this mapping is called a mechanism.

Next, the definition of the differential privacy is given. We begin with the definition of the data similarity:

This $K$-adjacency is an extension of $c$-adjacency, which corresponds to $K=I/c^{2}$, for the $2$-norm in previous work [9]. Next, we describe the definition of $(K,\varepsilon,\delta)$-differential privacy in dynamical systems in the same way as for static data [9, Definition 2.4].

Suppose that the output sequence $Y_{w,T}$ and the state equation (3) are available for an attacker trying to estimate the value of the input sequence $U_{T}$. Differential privacy requires the output sequence statistics are close enough at least for adjacent data pairs. A sufficient condition for the mechanism induced by Gaussian noise to be $(\varepsilon,\delta)$-differentially private under $c$-adjacency is derived in [9, Theorem 2.6]. This result can be straightforwardly extended as follows:

Larger noise $W_{T}$ and lower threshold for the adjacency in the sense of $\Sigma$ and $K$, respectively, make the left-hand side of (15) larger. This implies that differential privacy is ensured for smaller $\varepsilon$ and $\delta$ because ${\mathsf{R}}$ is a decreasing function. Further insight of $K$ will be revealed in Corollary 8 below.

To motivate additional analysis in this section, let us consider a feedback interconnection of the plant $\cal P$ and the controller $\cal C$:

where the control objective is to make the tracking error $e(t):=r(t)-y_{p}(t)$ small, and its private information is the reference signal $r(t)$. The attacker, who can access to the output $y_{p}(t)$, attempts to estimate $r(t)$. To prevent this inference, we add noise $v$ to $r$, which leads to the following closed loop dynamics:

where $\bar{x}(t):=[x_{p}(t);x_{c}(t)]$ and

Suppose that the distribution of $V_{T}$ is given by ${\cal N}(0,\Sigma_{v})$. Then, larger noise $v$ fluctuates $e$ more so that the variance of $E_{T}:=[e(0);\cdots;e(T)]$ is given by

with $\Theta_{T}:={\cal T}_{T}(\bar{A},\bar{B},-\bar{C},0)$.

Consider the feedback system in Fig. 4, where the plant and controller in (33) are given by

The integral property of the controller enhances the low-frequency tracking performance. The Bode gain diagram is shown in Fig. 5. Suppose that the reference $r$ is the signals to be protected, and it is public information that its spectrum is concentrated over the frequency range below $3\times 10^{-2}\ {\rm rad/s}$. To represent this prior information, we took the frequency model for $r$ as in Example 5, which is set to be a lowpass filter (generated by lowpass(xi, 3e-2) in MATLAB). Recall that $U_{T}\sim{\mathcal{N}}(0,\Sigma_{U})$ with (22) and (23).

We design input noise to make the system Bayesian differentially private for $\gamma=0.5,\ T=100,\ \varepsilon=100,\ \delta=0.1$. This leads to

In what follows we compare the following three cases:

• •

  noise-free,

• •

  i.i.d. noise: ${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{V}}_{T}\sim{\mathcal{N}}_{(T+1)m}(0,\sigma_{\rm iid}^{2}I)$ with

  	$\displaystyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{{\rm Tr}(\sigma_{\rm iid}^{2}I)}}$	$\displaystyle={\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{c(\gamma,T)^{2}{\mathsf{R}}(\varepsilon,\delta)^{2}\lambda_{\max}(\Sigma_{U})(T+1)m}}$
  		$\displaystyle={\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{121.604}},$		(51)

  where $\sigma_{\rm iid}$ is the minimum $\sigma$ satisfying (42), and

• •

  the minimum noise obtained in Theorem 10: ${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{V}}_{T}\sim{\mathcal{N}}_{(T+1)m}(0,\Sigma_{v}^{*}$), $\Sigma_{v}^{*}:=c(\gamma,T)^{2}{\mathsf{R}}(\varepsilon,\delta)^{2}\Sigma_{U}$ with

  $\displaystyle{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{{\rm Tr}(\Sigma_{v}^{*})=8.2574}}.$

  (52)

Fig. 6 shows the reference signal $r(t)$ and plant output $y_{p}(t)$ for these three cases. It can be seen that the output error for the noise-free case is the smallest. This is because the (realized) trajectory of $r$ is fully utilized allowing for some possibility that information about $r$ may leak from $y_{p}$. On the other hand, the other two cases guarantee the same level of Bayesian differential privacy. Note that the error fluctuation is suppressed in the minimum noise case. Statistically, the output fluctuation caused by the added noise $v$ can be evaluated by (34). The value ${\rm Tr}(\Theta_{T}\Sigma_{v}\Theta_{T}^{\top})/(c(\gamma,T){\mathsf{R}}(\varepsilon,\delta))^{2}$ is given by ${\rm Tr}(\Theta_{T}\Sigma_{U}\Theta_{T}^{\top})={\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{8.1998}}$ for the minimum noise case, which is smaller than $\lambda_{\max}(\Sigma_{U}){\rm Tr}(\Theta_{T}\Theta_{T}^{\top})={\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{55.4202}}$ for the i.i.d. case.

The interpretation is as follows: The i.i.d. noise has uniform frequency distribution, which implies it adds more out-of-band noise than the minimum one. However, this out-of-band component does not contribute to the protection of $r$ since it is easily distinguished from $r$ thanks to its prior information in Fig. 5. Nevertheless, this out-of-band noise largely degrades the tracking performance.

In this study, we introduced Bayesian differential privacy for linear dynamical systems using prior distributions of input data to provide privacy guarantees even for input data pairs with large differences, and gave sufficient conditions to achieve it. Furthermore, we derived the minimum energy Gaussian noise that satisfies the condition. As noticed in Subsection III-C, any finite noise cannot guarantee the Bayesian differential privacy for the infinite horizon case. This issue will be addressed in future work.

This work was supported in part by JSPS KAKENHI under Grant Number JP21H04875.