Differential Privacy in Linear Distributed Control Systems: Entropy Minimizing Mechanisms and Performance Tradeoffs

In distributed control systems with shared resources, participating agents can improve the overall performance of the system by sharing data about their personal preferences. In this paper, we formulate and study a natural tradeoff arising in these problems between the privacy of the agent's data and the performance of the control system. We formalize privacy in terms of differential privacy of agents' preference vectors. The overall control system consists of N agents with linear discrete-time coupled dynamics, each controlled to track its preference vector. Performance of the system is measured by the mean squared tracking error. We present a mechanism that achieves differential privacy by adding Laplace noise to the shared information in a way that depends on the sensitivity of the control system to the private data. We show that for stable systems the performance cost of using this type of privacy preserving mechanism grows as O(T³ /Nε²), where T is the time horizon and ε is the privacy parameter. For unstable systems, the cost grows exponentially with time. From an estimation point of view, we establish a lower-bound for the entropy of any unbiased estimator of the private data from any noise-adding mechanism that gives ε-differential privacy. We show that the mechanism achieving this lower-bound is a randomized mechanism that also uses Laplace noise.

I. Introduction

Availability of new sensors and real-time user data have heralded significant performance improvements in distributed control systems. At the same time, sharing information poses a threat to the privacy of the participating individuals. For instance, smartphones and connected vehicles can detect and report on road congestion conditions more accurately [1]–[3]; this has been used to develop crowd-sourced congestion-aware mapping and routing applications such as Google Maps and Waze. These benefits come with the risk of a loss of location-privacy. For example, researchers have shown that Waze can be used to follow a users movements [4]; and even with anonymized data such as Google Maps [5], the inherent structure of location data can lead to deanonymization [6], [7]. Similar risks and benefits arise in two-way coordination between consumers’ demands and electric power utility companies: On one hand, sharing information can prevent over-provisioning through peak-shaving and reduce energy costs [8]–[10], and on the other hand, expose the consumers’ personal habits.