Computer Science Mathematics Engineering
Computer Science-2021.gz:143487
Computer Science Mathematics
8bee93d0ad1f11d93bf4590924a303532479eb4d
Bayesian Differential Privacy for Linear Dynamical Systems

Differential privacy is a privacy measure based on the difficulty of discriminating between similar input data. In differential privacy analysis, similar data usually implies that their distance does not exceed a predetermined threshold. It, consequently, does not take into account the difficulty of distinguishing data sets that are far apart, which often contain highly private information. This problem has been pointed out in the research on differential privacy for static data, and Bayesian differential privacy has been proposed, which provides a privacy protection level even for outlier data by utilizing the prior distribution of the data. In this study, we introduce this Bayesian differential privacy to dynamical systems, and provide privacy guarantees for distant input data pairs and reveal its fundamental property. For example, we design a mechanism that satisfies the desired level of privacy protection, which characterizes the trade-off between privacy and information utility.


I. INTRODUCTION
As the Internet-of-Things (IoT) and cloud computing are attracting more and more attention for their convenience, privacy protection and security have become key technologies in control systems. To cope with privacy threats, many privacy protection methods have been studied so far [1], [2], [3]. Among them, differential privacy [4] has been used to solve many privacy-related problems in areas such as smart grid [5], health management [6], and blockchain [7], because it can mathematically quantify privacy guarantees. Differential privacy has originally been applied to static data, but as shown in the example of power systems above, there is an urgent need to establish privacy protection techniques for dynamical systems. In recent years, the concept of differential privacy has been introduced to dynamical systems [8], and from the viewpoint of control systems theory, the relationship between privacy protection and the observability of systems has been clarified, and methods of controller design with privacy protection in mind have been studied [9], [10], [11].
Conventional differential privacy is a privacy measure based on the difficulty of distinguishing similar data, where x and x ′ are regarded as being similar if |x − x ′ | ≤ c for a prescribed c > 0. To put it conversely, there is no indistinguishability guarantee for x and x ′ if |x − x ′ | > c. This implies there is The authors are with the Graduate School of Informatics, Kyoto University, Kyoto, Japan e-mail: kk@i.kyoto-u.ac.jp.
© 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. a risk of information leakage when there are outliers from normal data as pointed out in [12]. For example, unusual electricity consumption patterns may contain highly private information about the lifestyle. In the literature [13], a new concept called Bayesian Differential Privacy is developed for static data to solve this problem. Bayesian differential privacy considers the underlying probability distribution of the data, and attempts to guarantee privacy for data sets that are far apart.
In this study, we consider a prior distribution for the signal that we want to keep secret and introduce Bayesian differential privacy for linear dynamical systems. Similar to the conventional differential privacy cases [9], we consider a mechanism where stochastic noise is added to the output data. Note that applying a large noise increases the privacy protection level, but decreases the information usefulness [14]. In Theorem 7 below, a lower bound of noise scale to guarantee a prescribed Bayesian differential privacy level will be derived. Other properties including the relation to the conventional case are investigated based on this. The rest of this paper is organized as follows. In Section II, we introduce differential privacy for dynamical systems. In Section III, we propose Bayesian differential privacy for dynamical systems and derive a sufficient condition for added noise to achieve its privacy guarantee. In Section IV, considering the trade-off between privacy and information utility, we derive the Gaussian noise with the minimum energy while guaranteeing the Bayesian differential privacy. In Section V, the usefulness of Bayesian differential privacy is described via a numerical example. Some concluding remarks are given in Section VI.
Notations: The sets of real numbers and nonnegative integers are denoted by R and Z + , respectively. The imaginary unit is denoted by j. For vectors x m ] for the sake of simplicity of description. For a sequence u(t) ∈ R n , t = 0, 1, . . . , T , a collective vector is denoted by U T := [u(0); · · · ; u(T )] ∈ R (T +1)n using a capital alphabet. For a square matrix A ∈ R n×n , its determinant is denoted by det(A), and when its eigenvalues are real, its maximum and minimum eigenvalues are denoted by λ max (A) and λ min (A), respectively. We write A ≻ 0 (resp. A 0) if A is positive definite (resp. semidefinite). For A 0, the principal square root of A is denoted by A 1/2 . The identity matrix of size n is denoted by I n . The subscript n is omitted when it is clear from the context. The Euclidean norm of a vector x ∈ R n is denoted by |x|, and its weighted norm with A ≻ 0 is denoted by |x| A := (x ⊤ Ax) 1/2 . The indicator function of a set S ⊂ R n is denoted by 1 S , i.e., 1 S (x) = 1 if x ∈ S, and 0, otherwise. For a topological space X, the Borel algebra on X is denoted by B(X). Fix some complete probability space (Ω, F , P), and let E be the expectation with respect to P. For an R n -valued random vector w, w ∼ N n (µ, Σ) means that w has a nondegenerate multivariate Gaussian distribution with mean µ ∈ R n and covariance matrix Σ ≻ 0. The so called Q-function is defined by Q(c) where Q(c) < 1/2 for c > 0, and R(ε, δ) := (Q −1 (δ) + (Q −1 (δ)) 2 + 2ε)/2ε. The gamma function is denoted by Γ(·). A random variable z is said to have a χ 2 distribution with k degrees of freedom, denoted by z ∼ χ 2 k , if its distribution has the following probability density:

DYNAMICAL SYSTEMS
In this section, we briefly overview fundamental results on differential privacy for dynamical systems. Consider the following discrete-time linear system: for t ∈ Z + , where x(t) ∈ R n , u(t) ∈ R m , and y(t) ∈ R q denote the state, input, and output, respectively, and A ∈ R n×n , B ∈ R n×m , C ∈ R q×n , and D ∈ R q×m . For simplicity, we assume x(0) = 0 and the information to be kept secret is the input sequence U T up to a finite time T ∈ Z + . For (1), the output sequence Y T ∈ R (T +1)q is described by where N T ∈ R (T +1)q×(T +1)m is To proceed with differential privacy analysis, we consider the output y w (t) := y(t) + w(t) after adding the noise w(t) ∈ R q ; see Fig. 1. From (2), Y w,T ∈ R (T +1)q can be described by which defines a mapping M : In differential privacy analysis, this mapping is called a mechanism.
Next, the definition of the differential privacy is given. We begin with the definition of the data similarity: The set of all pairs of the input data that are K-adjacent is denoted by Adj K .
This K-adjacency is an extension of c-adjacency, which corresponds to K = I/c 2 , for the 2-norm in previous work [9]. Next, we describe the definition of (K, ε, δ)-differential privacy in dynamical systems in the same way as for static data [9, Definition 2.4].
Definition 2 ((K, ε, δ)-differential privacy). Given ε > 0 and δ ≥ 0, the mechanism (5) is said to be for any (U T , U ′ T ) ∈ Adj K . Suppose that the output sequence Y w,T and the state equation (1) are available for an attacker trying to estimate the value of the input sequence U T . Differential privacy requires the output sequence statistics are close enough at least for adjacent data pairs. A sufficient condition for the mechanism induced by Gaussian noise to be (ε, δ)-differentially private under c-adjacency is derived in [9,Theorem 2.6]. This result can be straightforwardly extended as follows: where Larger noise W T and lower threshold for the adjacency in the sense of Σ and K, respectively, make the left-hand side of (8) larger. This implies that differential privacy is ensured for smaller ε and δ because R is a decreasing function. Further insight of K will be revealed in Corollary 8 below.

A. Formulation
In Definition 2, the difficulty of distinguishing data pairs whose K-weighted distance is larger than a threshold 1 is not taken into account. Note that there is no design guideline for K. In this section, we introduce Bayesian differential privacy for dynamical systems. To this end, we assume the following availability of the prior distribution of the data to be protected, and provide a privacy guarantee that takes into account the discrimination difficulty of data pairs based on the prior. Assumption 4. The input data to the mechanism, U T , is an R (T +1)m -valued random variable with distribution P UT . In addition, one can use the prior P UT to design a mechanism.
The following is a typical example where a private input signal is a realization of a random variable.
Example 5. Suppose that the input data u(t) to be protected is the reference for tracking control; see [14]. In many applications, tracking to the reference signal over specified frequency ranges is required. Such a control objective can be represented by filtering white noise ξ(t).
To be more precise, we assume u(t) = r(t) is generated by where The power spectrum of u(t) is characterized by the frequency transfer function In this case, and the prior distribution is given by Note that the step reference signal whose value obeys r(t) ≡ r ∼ N (0, Σ s ) can be modeled by setting A r = C r = I, B r = D r = 0 with x r (0) ∼ N (0, Σ s ) in (10), (11). This corresponds to the case where the initial state is the private information rather than the input sequence U T as discussed in [9].
Then, based on the Bayesian differential privacy for static data [13], we define (P UT , γ, ε, δ)-Bayesian differential privacy, which is an extension of differential privacy for dynamical systems.
Definition 6 ((P UT , γ, ε, δ)-Bayesian differential privacy). Assume that the random variables U T , U ′ T are independent and both follow the distribution P UT . Given 1 ≥ γ ≥ 0, ε > 0 and δ ≥ 0, the mechanism (5) is said to be (P UT , γ, ε, δ)-Bayesian differentially private ((P UT , γ, ε, δ)-BDP) at a finite time instant T ∈ Z + , if In (17), the outer (resp. inner) P is taken with respect to (U T , U ′ T ) (resp. W T ). Roughly speaking, the definition of BDP is that the probability that the mechanism satisfies (K, ε, δ)-DP is greater than or equal to γ. Note that this definition places no direct restriction on the distance between a pair of input data U T , U ′ T .

B. Sufficient condition for noise scale
It is desirable that the added noise w is small to retain the data usefulness; see e.g., Section V. The following theorem gives a sufficient condition for noise scale to guarantee (P UT , γ, ε, δ)-Bayesian differential privacy.
In order to clarify the connection between conventional and Bayesian DP, it is worthwhile comparing Theorems 3 and 7. Bayesian differential privacy with the prior distribution P UT ∼ N (T +1)m (0, Σ) corresponds to differential privacy with an adjacency weight K.
Proof. Let us define Y w,T : since the mechanism satisfies Next, by definition of c(γ, T ), we have

Consequently, we obtain the desired result.
It should be emphasized that such a simple relation is obtained since the prior is Gaussian and the system is linear.

C. Asymptotic analysis
For the conventional DP, it is known that when the system (1) is asymptotically stable, one can design a Gaussian noise which makes the induced mechanism differentially private for any time horizon T [9, Corollary 2.9]. This is because, for an asymptotically stable system, the incremental gain from |U T − U ′ T | to |Y T − Y ′ T | is bounded by its H ∞ -norm for any T , and by the definition of DP, the distance |U T − U ′ T | is also bounded by a predetermined threshold. That is, even when the horizon of the data to be protected becomes longer, the distance between data sets where their indistinguishability is guaranteed is fixed.
On the other hand, for the proposed BDP, as T becomes larger, |U T − U ′ T | tends to take larger values according to the prior P UT . Consequently, to achieve BDP for a large time horizon T , large noise is required. To see this from Theorem 7, c(γ, T ) > 0 is plotted in Fig. 2 as a function of T . As can be seen, as T increases, c(γ, T ) becomes large, and therefore, from (18), the scale parameter Σ w of the noise is required to be large to guarantee BDP. This fact suggests that the privacy requirement of BDP (with fixed ε, γ, δ) for the long (possibly infinite) horizon case is too strong. This issue will be resolved by an appropriate scaling with T to quantify the long-time average privacy.

IV. DESIGN OF MECHANISM
To motivate additional analysis in this section, let us consider a feedback interconnection of the plant P and the controller C: P : C : where the control objective is to make the tracking error e(t) := r(t) − y p (t) small, and its private information is the reference signal r(t). The attacker, who can access to the output y p (t), attempts to estimate r(t). To prevent this inference, we add noise v to r, which leads to the following closed loop dynamics: Suppose that the distribution of V T is given by N (0, Σ v ). Then, larger noise v fluctuates e more so that the variance of E T := [e(0); · · · ; e(T )] is given by with Θ T := T T (Ā,B, −C, 0).

A. Minimization of the noise
The expression (24) motivates us to seek the Gaussian noise with the minimum energy among those satisfying the sufficient condition (18) for Bayesian differential privacy derived by Theorem 7. More specifically, we consider the following optimization problem with the covariance matrix of Gaussian noise Σ w ≻ 0 as the decision variable.
The constraint (26) is an inequality that is equivalent to the inequality (18). Under certain assumptions, this solution can be obtained as follows.
Theorem 10. Assume that N T is full row rank. The optimal solution to problem 9 is Σ * This implies Σ w Σ * w , and consequently Tr(Σ w ) ≥ Tr(Σ * w ).
The obtained optimal solution Σ * w is a constant multiple of the covariance matrix of the distribution of the output data Y T = N T U T when the covariance matrix of the input data U T is Σ. This means that it is possible to efficiently conceal the input data from the output data by applying the noise having the same statistics (up to scaling) as the observed data.

B. Input noise mechanism
In this subsection, we study the case where noise is added to the input channel; see Fig. 3. Consider the following system with input noise: As in the aforementioned section, we assume x(0) = 0. The output sequence Y v,T = [y v (0); · · · ; y v (T )] can be described as For the system in (1), adding noise V T to the input channel is equivalent to adding noise W T = N T V T to the output channel. For simplicity, we assume that N T is square and nonsingular; this can be relaxed as in [9,Corollary 2.16]. From Theorem 7, we obtain the following corollary.
Corollary 11. Suppose that the prior distribution P UT of U T is N (T +1)m (0, Σ). The Gaussian mechanism (29) induced by with c(γ, T ) > 0 defined in Theorem 7.
Proof. The desired result is a straightforward consequence of Theorem 7.
In [9, Corollary 2.16], a sufficient condition for (ε, δ)differential privacy in the sense of Definition 2 is given. The result concludes that the differential privacy level for the input noise mechanism does not depend on the system itself. Similarly, (30) does not depend on the system matrices in (1) either. The difference for the Bayesian case is that (30) depends on the covariance Σ of the prior distribution of the signals to be protected.
Remark 12. It is clear from Corollary 11 and Theorem 10 that the minimum energy Gaussian noise that satisfies the sufficient condition for privacy guarantee (30) for the input noise mechanism can be easily obtained by This characterization allows the natural interpretation that large noise is needed to protect large inputs; see also the next section.
V. NUMERICAL EXAMPLE Consider the feedback system in Fig. 4, where the plant and controller in (23) are given by The integral property of the controller enhances the lowfrequency tracking performance. The Bode gain diagram is shown in Fig. 5. Suppose that the reference r is the signals to be protected, and it is public information that its spectrum is concentrated over the frequency range below 3 × 10 −2 rad/s. To represent this prior information, we took the frequency model for r as in Example 5, which is set to be a lowpass filter (generated by lowpass(xi, 3e-2) in MATLAB).
Recall that U T ∼ N (0, Σ U ) with (15) and (16). We design input noise to make the system Bayesian differentially private for γ = 0.5, T = 100, ε = 100, δ = 0.1.  In what follows we compare the following three cases: where σ iid is the minimum σ satisfying (30), and • the minimum noise obtained in Theorem 10: Fig. 6 shows the reference signal r(t) and plant output y p (t) for these three cases. It can be seen that the output error for the noise-free case is the smallest. This is because the (realized) trajectory of r is fully utilized allowing for some possibility that information about r may leak from y p . On the other hand, the other two cases guarantee the same level of Bayesian differential privacy. Note that the error fluctuation is suppressed in the minimum noise case. Statistically, the output fluctuation caused by the added noise v can be evaluated by (24). The value Tr(Θ T Σ v Θ ⊤ T )/(c(γ, T )R(ε, δ)) 2 is given by Tr(Θ T Σ U Θ ⊤ T ) = 8.1998 for the minimum noise case, which is smaller than λ max (Σ U )Tr(Θ T Θ ⊤ T ) = 55.4202 for the i.i.d. case.
The interpretation is as follows: The i.i.d. noise has uniform frequency distribution, which implies it adds more out-ofband noise than the minimum one. However, this out-of-band component does not contribute to the protection of r since it is easily distinguished from r thanks to its prior information in Fig. 5. Nevertheless, this out-of-band noise largely degrades the tracking performance.
Remark 13. The out-of-band noise as in the i.i.d. case is effective when the prior distribution of the signals to be protected is not public information. That is, this noise can prevent the attacker from inferring the prior distribution e.g., via the empirical Bayes.
Remark 14. Lastly, we would like to note that for the Gaussian prior N (0, Σ U ) in the numerical example, a reference signal U ′ T that deviates significantly from mean 0 in the sense of |0 − U ′ T | Σ −1 U can be seen as an outlier. Therefore, out-ofband signals having large values |U ′ T | Σ −1 U can be regarded as outliers. Bayesian differentially private mechanism provides privacy guarantees not only for in-band signals but also for out-of-band ones. In particular, the parameter γ for Bayesian differential privacy determines the extent to which privacy guarantees can be provided for out-of-band signals.

VI. CONCLUSION
In this study, we introduced Bayesian differential privacy for linear dynamical systems using prior distributions of input data to provide privacy guarantees even for input data pairs with large differences, and gave sufficient conditions to achieve it. Furthermore, we derived the minimum energy Gaussian noise that satisfies the condition. As noticed in Subsection III-C, any finite noise cannot guarantee the Bayesian differential privacy for the infinite horizon case. This issue will be addressed in future work.