Privacy in Feedback: The Differentially Private LQG

TL;DR

This paper introduces a differentially private approach to control in cyber-physical systems using LQR, ensuring privacy of state trajectories while maintaining optimal control through a cloud-based coordination, with theoretical bounds and simulations.

Contribution

It formulates a differentially private LQR framework, relating it to LQG, and provides bounds on privacy-utility trade-offs in cloud-coordinated CPSs.

Findings

Differential privacy can be integrated into LQR control for CPSs.

Bounds are established on how privacy affects control performance.

Numerical simulations validate the theoretical results.

Abstract

Information communicated within cyber-physical systems (CPSs) is often used in determining the physical states of such systems, and malicious adversaries may intercept these communications in order to infer future states of a CPS or its components. Accordingly, there arises a need to protect the state values of a system. Recently, the notion of differential privacy has been used to protect state trajectories in dynamical systems, and it is this notion of privacy that we use here to protect the state trajectories of CPSs. We incorporate a cloud computer to coordinate the agents comprising the CPSs of interest, and the cloud offers the ability to remotely coordinate many agents, rapidly perform computations, and broadcast the results, making it a natural fit for systems with many interacting agents or components. Striving for broad applicability, we solve infinite-horizon linear-quadratic-regulator (LQR) problems, and each agent protects its own state trajectory by adding noise to its states before they are sent to the cloud. The cloud then uses these state values to generate optimal inputs for the agents. As a result, private data is fed into feedback loops at each iteration, and each noisy term affects every future state of every agent. In this paper, we show that the differentially private LQR problem can be related to the well-studied linear-quadratic-Gaussian (LQG) problem, and we provide bounds on how agents' privacy requirements affect the cloud's ability to generate optimal feedback control values for the agents. These results are illustrated in numerical simulations.