Differential Privacy for Power Grid Obfuscation

TL;DR

This paper introduces a novel differential privacy mechanism for power grid data that ensures AC-feasibility and maintains network fidelity, enhancing privacy without compromising operational integrity.

Contribution

It proposes a new DP method tailored for power networks that guarantees AC-feasibility and preserves data utility, addressing limitations of existing mechanisms.

Findings

Obfuscation reduces attacker exploitation risk.

The method maintains network operational feasibility.

Experimental results confirm high data utility.

Abstract

The availability of high-fidelity energy networks brings significant value to academic and commercial research. However, such releases also raise fundamental concerns related to privacy and security as they can reveal sensitive commercial information and expose system vulnerabilities. This paper investigates how to release power networks where the parameters of transmission lines and transformers are obfuscated. It does so by using the framework of Differential Privacy (DP), that provides strong privacy guarantees and has attracted significant attention in recent years. Unfortunately, simple DP mechanisms often result in AC-infeasible networks. To address these concerns, this paper presents a novel differential privacy mechanism that guarantees AC-feasibility and largely preserves the fidelity of the obfuscated network. Experimental results also show that the obfuscation significantly reduces the potential damage of an attacker exploiting the release of the dataset.

Tables

Table 1. TABLE I: Power Network Nomenclature.

$N$	The set of nodes in the network	${\theta }^{\Delta }$	Phase angle difference limits
$E$	The set of from edges in the network	$S^d=p^d+𝒊q^d$	AC power demand
$E^R$	The set of to edges in the network	$S^g=p^g+𝒊q^g$	AC power generation
$𝒊$	Imaginary number constant	$c_0,c_1,c_2$	Generation cost coefficients
$n$, $m$	$\left|E\right|$ and $\left|N\right|$, respectively	$\Re (\cdot )$	Real component of a complex number
$S=p+𝒊q$	AC power	$\Im (\cdot )$	Imaginary component of a complex number
$V=v\angle \theta$	AC voltage	$Y=g+𝒊b$	Line admittance
$|\cdot |$	Magnitude of a complex number	$\angle$	Angle of a complex number
$s^u$	Line apparent power thermal limit	$x^l$, $x^u$	Lower and upper bounds of $x$
${\theta }_{ij}$	Phase angle difference (i.e., ${\theta }_i-{\theta }_j$)	$𝒙$	A constant value
$𝒩$	A network description	$𝐠$	Network’s line conductances
$𝐛$	Network’s line susceptances	${\Delta }_Q$	Query sensitivity
$ϵ$	Privacy budget	$\alpha$	Indistinguishability value
$\beta$	Faithfulness parameter	$\widetilde{𝐱}$	Privacy-preserving version of $𝐱$
$\dot{𝐱}$	Post-processed version of $\widetilde{𝐱}$	${𝐱}^{\ast }$	Complex conjugate of $𝐱$

Table 2. TABLE II: Laplace mechanism feasibility (%)

	$\alpha$
Network instance	0.001	0.01	$\ge$0.1
nesta_case30_ieee	100	80	0
nesta_case39_epri	100	0	0
nesta_case57_ieee	100	61	0
nesta_case118_ieee	100	47	0

Table 3. TABLE III: PLO Computational Runtime

	$\alpha$
Network instance	0.01	0.1	1.0
nesta_case3_lmbd	0.04	0.05	0.07
nesta_case4_gs	0.09	0.14	0.16
nesta_case5_pjm	0.10	0.09	0.15
nesta_case6_c	0.05	0.12	0.19
nesta_case6_ww	0.05	0.26	0.39
nesta_case9_wscc	0.08	0.21	0.29
nesta_case14_ieee	0.10	0.44	0.74
nesta_case24_ieee_rts	0.63	1.04	1.88
nesta_case29_edin	4.23	3.26	4.59
nesta_case30_as	0.38	1.31	1.77
nesta_case30_fsr	0.39	1.43	1.70
nesta_case30_ieee	0.43	1.41	1.63
nesta_case39_epri	1.67	2.00	2.25
nesta_case57_ieee	1.11	3.43	4.81
nesta_case73_ieee_rts	2.86	8.03	13.90
nesta_case89_pegase	33.67	44.96	48.12
nesta_case118_ieee	8.79	8.64	17.73
nesta_case162_ieee_dtc	17.48	38.83	50.43

Equations

$$S_i^g-{\mathbf{S}}_i^d=\sum _{\begin{array}{c}(i,j)\in E\cup E^R\end{array}}{S}_{ij}\forall i\in N$$

$$S_{ij}={\mathbf{Y}}_{ij}^{\ast }|V_i{|}^2-{\mathbf{Y}}_{ij}^{\ast }{V}_i{V}_j^{\ast }(i,j)\in E\cup E^R$$

$$S_i^g,V_i\forall i\in N,S_{ij}\forall (i,j)\in E\cup E^R$$

$$\sum _{i\in N}{\mathbf{c}}_{2i}(\Re (S_i^g){)}^2+{\mathbf{c}}_{1i}\Re (S_i^g)+{\mathbf{c}}_{0i}$$

$$\angle V_s=0,$$

$${{\mathbf{v}}^{\mathbf{l}}}_i\le |V_i|\le {{\mathbf{v}}^{\mathbf{u}}}_i\forall i\in N$$

$$-{{\mathbf{\theta }}^{\mathbf{\Delta }}}_{ij}\le \angle (V_i{V}_j^{\ast })\le {{\mathbf{\theta }}^{\mathbf{\Delta }}}_{ij}\forall (i,j)\in E$$

$${{\mathbf{S}}^{\mathbf{gl}}}_i\le S_i^g\le {{\mathbf{S}}^{\mathbf{gu}}}_i\forall i\in N$$

$$|S_{ij}|\le {{\mathbf{s}}^{\mathbf{u}}}_{ij}\forall (i,j)\in E\cup E^R$$

$$S_i^g-{\mathbf{S}}_i^d={\sum }_{(i,j)\in E\cup E^R}{S}_{ij}\forall i\in N$$

$$S_{ij}={\mathbf{Y}}_{ij}^{\ast }|V_i{|}^2-{\mathbf{Y}}_{ij}^{\ast }{V}_i{V}_j^{\ast }\forall (i,j)\in E\cup E^R$$

$$D{\sim }_{\alpha }{D}^{\prime }\iff \exists i\text{ s.t. }|g_i-g_i^{\prime }|\le \alpha \text{ and }{g}_j=g_j^{\prime },\forall j\ne i.$$

$$\frac{Pr[\mathcal{A}(D)\in O]}{Pr[\mathcal{A}(D^{\prime })\in O]}\le \exp (ϵ).$$

$${\Delta }_Q=\underset{D{\sim }_{\alpha }{D}^{\prime }}{\max }{\Vert Q(D)-Q(D^{\prime })\Vert }_1.$$

$$S_i^g,V_i,l_i\forall i\in N,S_{ij}\forall (i,j)\in E\cup E^R$$

$$\sum _{i\in N}{l}_i\Re (S_i^d)$$

$$(\text{ref}eq:a{c}_0)\text{–}(\text{ref}eq:a{c}_4)$$

$$0\le l_i\le 1\forall i\in N$$

$$S_i^g-l_i{\mathbf{S}}_i^d={\sum }_{(i,j)\in E\cup E^R}{S}_{ij}\forall i\in N$$

$$\tilde{\mathbf{g}}=\mathbf{g}+Lap{\left(\frac{3\alpha }{ϵ}\right)}^n,\tilde{\mathbf{b}}=\text{r}\cdot \tilde{\mathbf{g}},$$

$${\tilde{\mu }}_{\mathbf{g}}^v=\left(\frac{1}{n_v}\sum _{(ij)\in E(v)}{g}_{ij}\right)+\text{Lap}\left(\frac{3\alpha }{n_vϵ}\right),$$

$${\tilde{\mu }}_{\mathbf{b}}^v=\left(\frac{1}{n_v}\sum _{(ij)\in E(v)}{b}_{ij}\right)+\text{Lap}\left(\frac{3\alpha }{n_vϵ}\right),$$

$$S_i^g,V_i\forall i\in N$$

$${\dot{Y}}_{ij},S_{ij}\forall (i,j)\in E_k\cup E_k^R$$

$$\Vert \dot{\mathbf{g}}-\tilde{\mathbf{g}}{\Vert }_2^2+\Vert \dot{\mathbf{b}}-\tilde{\mathbf{b}}{\Vert }_2^2$$

$$\text{eqref}eq:a{c}_0\text{–}\text{eqref}eq:a{c}_3$$

$$\displaystyle\frac{\big{|}\sum_{i\in N}\bm{cost}(S_{i}^{g})-{\mathcal{O}}^{*}\big{|}}{{\mathcal{O}}^{*}}\leq\beta$$

$$S_{ij}={\dot{Y}}_{ij}^{\ast }|V_i{|}^2-{\dot{Y}}_{ij}^{\ast }{V}_i{V}_j^{\ast }\forall (i,j)\in E\cup E^R$$

$$\forall (i,j)\in E(v)\cup E^R(v),\forall v\in \text{textsl}VL(\mathcal{N}):$$

$$\frac{1}{\lambda }{\mu }_{\mathbf{g}}^v\le {\dot{g}}_{ij}\le \lambda {\mu }_{\mathbf{g}}^v$$

$$\frac{1}{\lambda }{\mu }_{\mathbf{b}}^v\le {\dot{b}}_{ij}\le \lambda {\mu }_{\mathbf{b}}^v$$

$$|Q_A(D)-Q_A(D^{\prime })|$$

$$=\frac{1}{n}|x_i-x_i^{\prime }|$$

$$\le \frac{1}{n}\alpha .$$

$$S_i^g(t),V_i(t)\forall i\in N,t\in [h]$$

$${\dot{Y}}_{ij},S_{ij}(t)\forall (i,j)\in E_k\cup E_k^R,\forall t\in [h]$$

$$\Vert \dot{\mathbf{g}}-\tilde{\mathbf{g}}{\Vert }_2^2+\Vert \dot{\mathbf{b}}-\tilde{\mathbf{b}}{\Vert }_2^2$$

$$\forall v\in \text{textsl}VL({\mathcal{N}}_1),\forall (i,j)\in E_k(v)\cup E_k^R(v):$$

$$\frac{1}{\lambda }{\mu }_{\mathbf{g}}^v\le {\dot{g}}_{ij}\le \lambda {\mu }_{\mathbf{g}}^v$$

$$\frac{1}{\lambda }{\mu }_{\mathbf{b}}^v\le {\dot{b}}_{ij}\le \lambda {\mu }_{\mathbf{b}}^v$$

$$\forall t\in [h]:$$

$$\displaystyle\frac{\big{|}\sum_{i\in\mathcal{N}_{t}}\bm{cost}(S^{g}_{i}(t))-{\mathcal{O}}^{*}(t)\big{|}}{{\mathcal{O}}^{*}(t)}\leq\beta$$

$$\angle V_s(t)=0$$

$$\forall i\in {\mathcal{N}}_t:$$

$${{\mathbf{v}}^{\mathbf{l}}}_i\le |V_i(t)|\le {{\mathbf{v}}^{\mathbf{u}}}_i$$

$${{\mathbf{S}}^{\mathbf{gl}}}_i\le S_i^g(t)\le {{\mathbf{S}}^{\mathbf{gu}}}_i$$

$$S_i^g(t)-{\mathbf{S}}_i^d(t)={\sum }_{(i,j)\in E_k\cup E_k^R}{S}_{ij}(t)$$

$$\forall (i,j)\in E_k\cup E_k^R:$$

Full text

I Introduction

The availability of test cases representing high-fidelity power system networks is fundamental to foster research in optimal power flow, unit commitment, and transmission planning, to name only a few challenging problems. This need was recognized by ARPA-E when it initiated the Grid Data Program in 2015. However, the release of such rich datasets is challenging due to legal issues related to privacy and national security. For instance, the electrical load of an industrial customer indirectly exposes sensitive information on its production levels and strategic investments, and the value parameters of lines and generators may reveal how transmission operators operate their networks. Furthermore, this data could be exploited by an attacker to inflict targeted damages on the network infrastructure.

This paper explores whether differential privacy can help to mitigate these concerns. Differential Privacy (DP) [1] is an algorithmic property that measures and bounds the privacy risks associated with answering sensitive queries or releasing a privacy-preserving dataset. It introduces carefully calibrated noise to the data to prevent the disclosure of sensitive information. An algorithm satisfying DP offers privacy protection regardless of the external knowledge of an attacker. In particular, the definition of DP adopted in this paper ensures that an attacker obtaining access to a differentially private output, cannot detect (with high probability) how close is the privacy-preserving value to its original one.

However, DP faces significant challenges when the resulting privacy-preserving datasets are used as inputs to complex optimization algorithms, e.g., Optimal Power Flow (OPF) problems. Indeed, the privacy-preserving dataset may have lost the fidelity and realism of the original data and may even not admit feasible solutions for the optimization problems of interest [2].

This paper studies how to address such a challenge when the goal is to preserve the privacy of line parameters and transformers. It presents a DP mechanism to release data for power networks that is realistic and limits the power of an attacker. More precisely, the contribution of this paper is fourfold. (1) It proposes the Power Line Obfuscation (PLO) mechanism to obfuscate the line parameters in a power system network. (2) It shows that PLO has strong theoretical properties: It achieves $\epsilon$-differential privacy, it ensures that the released data can produce feasible solutions for OPF problems, and its objective value is a constant factor away from optimality. (3) It extends the PLO mechanism to handle time-series network data. (4) It demonstrates, experimentally, that the PLO mechanism improves the accuracy of existing approaches. When tested on the largest collection of OPF test cases available, it results in solutions with similar costs and optimality gaps to those obtained on the original problems, while also protecting well against an attacker that has access to the released data and uses it to damage the real power network. Interestingly, on the test cases adopted, the damage inflicted on the real power network, when the attacker exploits the PLO-obfuscated data, converges to that of a random, uninformed attack as the privacy level increases.

II Related Work

There is a rich literature on theoretical results of DP (see, for instance, the excellent surveys [3] and [4]). The literature on DP applied to energy systems includes considerably fewer efforts. Ács and Castelluccia [5] exploit a direct application of the Laplace mechanism to hide user participation in smart meter data sets, achieving $\epsilon$-DP. Zhao et al. [6] study a DP schema that exploits the ability of households to charge/discharge a battery to hide the real energy consumption of their appliances. Halder et al. [7] propose an DP-based architecture to support privacy-preserving thermal inertial load management at an aggregated level. Liao et al. [8] introduce Di-PriDA, a privacy-preserving mechanism for appliance-level peak-time load balancing control in the smart grid, aimed at masking the consumption of the top-k appliances of a household.

Karapetyan et al. [9] empirically quantify the trade-off between privacy and utility in demand response systems. The authors analyze the effects of a simple Laplace mechanism on the objective value of the demand response optimization problem. Their experiments on a 4-bus micro-grid show drastic results: the optimality gap approaches nearly 90% in some cases. Eibl and Engel [10] studied the effect of DP-based aggregation schemes on the utility of real smart meter data, and [11] studies the impact of applying a DP approach to protect metering data used for load forecasting. Zhou et al. [12] have recently studied the problem of releasing differential private network statistics obtained from solving a Direct Current (DC) optimal power flow problem.

A differential private schema that uses constrained post-processing was recently introduced by Fioretto et al. [2] and adopted to protect load consumption in power networks. In contrast, the proposed PLO mechanism releases the obfuscated network data protecting the line parameters imposing constraints to ensure that the problem solution cost is close to the solution cost of the original problem, and that the underlying optimal power flow constraints are satisfiable.

III Preliminaries

This section reviews the AC Optimal Power Flow (AC-OPF) problem and key concepts from differential privacy. A summary of the notation adopted is tabulated in Table I. Bold-faced symbols are used to denote constant values.

III-A AC Optimal Power Flow

Optimal Power Flow (OPF) is the problem of determining the most economical generator dispatch to serve demands while satisfying operating and feasibility constraints. AC-OPF refers to modeling the full AC power equations when computing an OPF. This paper views the grid as a graph $(N,E)$ where $N$ is the set of buses and $E$ is the set of transmission lines and transformers, called lines for simplicity. We use $E$ to represent the set of directed arcs and $E^{R}$ to refer to the arcs in $E$ with the reverse direction. The AC power flow equations use complex quantities for current $I$, voltage $V$, admittance $Y$, and power $S$. The quantities are linked by constraints expressing Kirchhoff’s Current Law (KCL) and Ohm’s Law, resulting in the AC Power Flow equations:

[TABLE]

These non-convex nonlinear equations are the core building block in many power system applications and Model 1 depicts the AC-OPF formulation. The objective function (1) minimizes the cost of the generator dispatch. Constraint (2) sets the reference angle for a slack bus $s\in N$ to be zero to eliminate numerical symmetries. Constraints (3) and (4) capture the voltage bounds and phase angle difference constraints. Constraints (5) and (6) enforce the generator output and line flow limits. Finally, Constraints (7) and (8) capture the AC Power Flow equations. We use $\mathcal{N}=\langle N,E,{\bf{S}},{\bf{Y}},\bm{\theta^{\Delta}},{\bf{s}},{\bf{v}}\rangle$ for a succinct network description and define $m=|N|$ and $n=|E|$.

III-B Differential Privacy

Differential privacy [1] is a privacy framework that protects the disclosure of the participation of an individual to a dataset. In the context of this paper, differential privacy is used to protect the disclosure of conductance and susceptance values of transmission lines. The paper considers datasets $D=\{g_{1},\ldots,g_{n}\}\in\mathbb{R}^{n}$ as $n$-dimensional real-valued vector describing conductance values and aims at protecting the value of each conductance $g_{i}$ up to some quantity $\alpha>0$. This requirement allows to obfuscate the parameters of lines whose values are close to one another while keeping the distinction between line parameters that are far apart from each other. This privacy notion is characterized by the adjacency relation between datasets that captures the indistinguishability of individual line values and defined as:

[TABLE]

where $D$ and $D^{\prime}$ are two datasets and $\alpha>0$ is a real value [13]. Informally speaking, a DP mechanism needs to ensure that queries on two indistinguishable datasets (i.e., datasets differing on a single value by at most $\alpha$) give similar results. The following definition formalizes this intuition [1, 13].

** Definition​ 1**

A randomized algorithm $\mathcal{A}\!:\!\mathcal{D}\!\to\!\mathcal{R}$ with domain $\mathcal{D}$ and range $\mathcal{R}$ is $\epsilon$-differential private if, for any output response $O\subseteq\mathcal{R}$ and any two adjacent inputs $D\sim_{\alpha}D^{\prime}\in\mathbb{R}^{n}$, fixed a value $\alpha>0$,

[TABLE]

The level of privacy is controlled by the parameter $\epsilon\geq 0$, called the privacy budget, with small values denoting strong privacy. The level of indistinguishability is controlled by the parameter $\alpha>0$. Differential privacy satisfies several important properties, including composability and immunity to post-processing [3].

** Theorem​ 1**** (Sequential Composition)**

The composition $(\mathcal{A}_{1}(D),\ldots,\mathcal{A}_{k}(D))$ of a collection $\{\mathcal{A}_{i}\}_{i=1}^{k}$ of $\epsilon_{i}$-differential private algorithms satisfies $(\sum_{i=1}^{k}\epsilon_{i})$-differential privacy.

** Theorem​ 2**** (Parallel Composition)**

Let $D_{1}$ and $D_{2}$ be disjoint subsets of $D$ and $\mathcal{A}$ be an $\epsilon$-differential private algorithm. Computing $\mathcal{A}(D\cap D_{1})$ and $\mathcal{A}(D\cap D_{2})$ satisfies $\epsilon$-differential privacy.

** Theorem​ 3**** (Post-Processing Immunity)**

Let $\mathcal{A}$ be an $\epsilon$-differential private algorithm and $g$ be an arbitrary mapping from the set of possible output sequences to an arbitrary set. Then, $g\circ\mathcal{A}$ is $\epsilon$-differential private.

A function (also called query) $Q:\mathbb{R}^{n}\to\mathbb{R}$ can be made differential private by injecting random noise to its output. The amount of noise to inject depends on the sensitivity of the query, denoted by $\Delta_{Q}$ and defined as

[TABLE]

For instance, querying the conductance values of a line from a dataset $D$ is achieved through an identity query $Q$, whose sensitivity $\Delta_{Q}=\alpha$. The Laplace distribution with 0 mean and scale $b$, denoted by ${\text{Lap}}(\lambda)$, has a probability density function ${\text{Lap}}(x|\lambda)=\frac{1}{2\lambda}e^{-\frac{|x|}{\lambda}}$. It can be used to obtain an $\epsilon$-differential private algorithm to answer numeric queries [1]. In the following, ${\text{Lap}}(\lambda)^{n}$ denotes the i.i.d. Laplace distribution over $n$ dimensions with parameter $\lambda$.

** Theorem​ 4**** (Laplace Mechanism)**

Let $Q$ be a numeric query that maps datasets to $\mathbb{R}^{n}$. The Laplace mechanism that outputs $Q(D)+z$, where $z\in\mathbb{R}^{n}$ is drawn from the Laplace distribution $\textrm{{\text{Lap}}}\left(\frac{\Delta_{Q}}{\epsilon}\right)^{n}$, achieves $\epsilon$-differential privacy.

IV The Obfuscation Mechanism for Power Lines

IV-A Problem Setting and Attack Model

A power grid operator desires to release a network description $\tilde{\mathcal{N}}\!=\!\langle N,E,{\bf{S}},\tilde{{\bf{Y}}},\bm{\theta^{\Delta}},{\bf{s}},{\bf{v}}\rangle$ of a network $\mathcal{N}\!=\!\langle N,E,{\bf{S}},{\bf{Y}},\bm{\theta^{\Delta}},{\bf{s}},{\bf{v}}\rangle$, that obfuscates the lines admittance values ${\bf{Y}}$ within a given indistinguishability parameter $\alpha$. In addition, the released data must preserve the realism of the original network. The lines parameters are considered to be extremely sensitive as they can reveal important operational information that can be exploited by an attacker to inflict targeted damages on the network infrastructure [14, 15]. The paper assumes that the optimal dispatch cost ${\mathcal{O}}(\mathcal{N})$ and typical conductance-susceptance line ratios are publicly available and thus accessible by an attacker. This is not restrictive since the optimal dispatch cost can be inferred from market clearing prices which are publicly accessible, and the ratios between conductance and susceptance of a line can be retrieved from the manufacture informational material.

This paper also considers an attack model in which a malicious user can disrupt $k$ power lines (called attack budget) to inflict maximal network damage. It further assumes that the attacker has full knowledge of a network description $\mathcal{N}$ and can use it to estimate the damages inflicted by its actions. To measure the impact of an attack on the power network, this paper measures the total load affected and the amount of the affected loads that can be restored via Model 2. The latter aims at maximizing the active load $l_{i}\Re(S^{d}_{i})$ served by the damaged network while preserving the active/reactive factor.

IV-B The PLO Problem

The Power Lines Obfuscation (PLO) problem establishes the fundamental desiderata to be delivered by the obfuscation mechanism. It operates on the line conductances and suceptances, which are denoted by ${\bf{g}}=\{g_{ij}\}_{(i,j)\in E}$ and ${\bf{b}}=\{b_{ij}\}_{(i,j)\in E}$, respectively.

** Definition​ 2**** (PLO problem)**

Given a network description $\mathcal{N}$ and positive real values $\alpha,\beta,$ and $\epsilon$, the PLO problem produces a network description $\tilde{\mathcal{N}}$ that satisfies:

Lines obfuscation*: The lines conductances $\tilde{{\bf{g}}}$ of $\tilde{\mathcal{N}}$ satisfy $\epsilon$-differential privacy under $\alpha$-indistinguishability.* 2. 2.

Consistency*: $\tilde{\mathcal{N}}$ have feasible solutions to the OPF Constraints (2)–(8).* 3. 3.

Objective faithfulness*: $\tilde{\mathcal{N}}$ must be faithful to the value of the objective function up to a factor $\beta$, i.e., $\frac{|{\mathcal{O}}(\mathcal{N})-{\mathcal{O}}(\tilde{\mathcal{N}})|}{{\mathcal{O}}(\mathcal{N})}\leq\beta$.*

Finding values $\tilde{{\bf{g}}}$ satisfying $\alpha$-indistinguishability is readily achieved through the Laplace mechanism. However, finding values $\tilde{{\bf{Y}}}$ that satisfy conditions (2) and (3) is more challenging. Indeed, these conditions require that the new network $\tilde{\mathcal{N}}$ satisfies the AC power flow equations, the operational constraints, and closely preserves the objective value. In other words, these conditions ensure the realism and fidelity of $\tilde{\mathcal{N}}$.

IV-C The PLO Mechanism

The PLO mechanism, described in Algorithm 1, addresses these challenges. It takes as input a power network description $\mathcal{N}$, its optimal dispatch cost, denoted as ${\mathcal{O}}^{*}$, as well as three positive real numbers: $\epsilon$, which determines the privacy value of the private data, $\alpha$, which determines the indistinguishability value, and $\beta$, which determines the required faithfulness to the value of the objective function.

The PLO mechanism relies on three, independent, private data estimations, each of which requires the addition of carefully calibrated noise to guarantee privacy. It first injects Laplace noise with parameter $\lambda=3\alpha/\epsilon$ to the output of each query on each dimension of the conductance vector ${\bf{g}}$ of $\mathcal{N}$ resulting in new noisy conductance and susceptances vectors:

[TABLE]

as shown in lines 1–1 of Algorithm 1, where $\tilde{{\bf{g}}}=\{\tilde{g}_{ij}\}_{(ij)\in E}$ and $\tilde{{\bf{b}}}=\{\tilde{b}_{ij}\}_{(ij)\in E}$ are the vectors of noisy conductances and suceptances, r is the vector of ratios $\{\frac{g_{ij}}{b_{ij}}\}_{(ij)\in E}$ between ${\bf{g}}$ and ${\bf{b}}$, and $\cdot$ denotes the dot-product. Note that, importantly, the mechanism retains the conductance-susceptance ratio.

It is also important to ensure that the line values within different voltage levels preserve their differences. Denote by $\textsl{VL}(\mathcal{N})$ as the set of voltage levels in $\mathcal{N}$. For each voltage level $v$, the PLO mechanism computes the noisy mean value of the conductance vector ${\bf{g}}$ (lines 1 and 1):

[TABLE]

and suceptance ${\bf{b}}$:

[TABLE]

where $E(v)$ denotes the subset of lines at voltage level $v$, and $n_{v}=|E(v)|$. These estimates are used to guarantee that the parameters of the lines do not deviate too much from their original values within each voltage level.

While the application of the Laplace noise to produce new conductance and susceptance vectors satisfies condition 1 of Definition 2, it may not satisfy conditions 2 and 3. In fact, Section VI shows that the Laplace noise induced on the parameters of the lines often result in a new network description which admits no feasible flow. To overcome this limitation, the PLO mechanism post-processes the noisy values $\tilde{{\bf{b}}}$ and $\tilde{{\bf{g}}}$ by exploiting an optimization model specified in line 5 of Algorithm 1. The result of such an optimization-based post-processing step is a new network $\dot{\mathcal{N}}=\langle N,E,{\bf{S}},\dot{{\bf{Y}}},\bm{\theta^{\Delta}},{\bf{s}},{\bf{v}}\rangle$ that satisfies the objective faithfulness and consistency requirements of Definition 2.

The optimization model minimizes the sum of the $L_{2}$-distances between the variables $\dot{{\bf{g}}}\in\mathbb{R}^{n}$ and the noisy conductances $\tilde{{\bf{g}}}\in\mathbb{R}^{n}$, and the variables $\dot{{\bf{b}}}\in\mathbb{R}^{n}$ and the noisy susceptances $\tilde{{\bf{b}}}\in\mathbb{R}^{n}$. The model is subject to Constraints (2)–(7) of Model 1 with the addition of the $\beta$-faithfulness constraint ($s_{2}$) that guarantees to satisfy condition 3 of the PLO problem (Definition 2). The notation $\bm{cost}(S^{g}_{i})$ is used as a shorthand for $c_{2i}(\Re(S^{g}_{i}))^{2}+\bm{c}_{1i}\Re(S^{g}_{i})+\bm{c}_{0i}$. Constraint ($s_{3}$) enforces the power-flow based on the Ohm’s Law on the post-processed conductance and suceptance values. Finally, Constraints ($s_{4}$) and ($s_{5}$) bound the values for the post-processed conductance and susceptance to be close to their privacy-preserving means, parameterized by a value $\lambda>0$. These constraints are used to avoid that the post-processed values deviate arbitrarily from the original ones. The optimization also works on a pre-processed network to ensure the realism and feasibility. This pre-processing ensures that parallel lines have the same resistance and reactance parameters and that negative resistance values are not part of the obfuscation. Moreover, the optimization guarantees that all remaining resistances are positive.

The PLO mechanism can be thought as redistributing the noise of the Laplace mechanism applied to the admittance values of the lines in $\mathcal{N}$ to obtain a new network $\dot{\mathcal{N}}$ that is consistent with the problem constraints and objective. It searches for a feasible solution that satisfies the AC-OPF constraints and the $\beta$-faithfulness constraint.

The following results show that PLO has desirable properties. All the proofs are in Appendix A.

** Theorem​ 5**

For a given $\alpha$-indistinguishability level, the PLO mechanism is $\epsilon$-differential private.

The following result is a consequence of [2](Theorem 5).

** Corollary​ 1**

The optimal solution $\langle{\bf{g}}^{*},{\bf{b}}^{*}\rangle$ to the optimization model in line 5 of Algorithm 1 satisfies $\|{\bf{g}}^{*}-{\bf{g}}\|_{2}+\|{\bf{b}}^{*}-{\bf{b}}\|_{2}\leq 2\|\tilde{{\bf{g}}}-{\bf{g}}\|_{2}+2\|\tilde{{\bf{b}}}-{\bf{b}}\|_{2}.$

This last result implies the PLO mechanism is at most a factor 2 away from optimality. Such a result, in turn, follows from the optimality of the Laplace mechanism for identity queries [16]. Note that a solution to the PLO always exists. Indeed, the original network values $\bm{Y}$ represent a feasible solution satisfying all requirements of Definition 2.

V Extension: Multi-step PLO

The PLO mechanism obfuscates the line parameters based on a single snapshot (time-point) of the steady state of the network. To improve the fidelity and realism of the network, the mechanism can be generalized by reasoning about multiple snapshots (time-series) of loads and optimal dispatches. Consider a set of network descriptions $\{\mathcal{N}_{t}\}_{t=1}^{h}$ over a finite time horizon $h$ where the loads and the optimal generator dispatches are varying over time. Each $\mathcal{N}_{t}=(N,E,{\bf{S}}_{t},{\bf{Y}},\bm{\theta^{\Delta}},{\bf{s}},{\bf{v}})$ represents the steady state of the power grid at time step $0<t\leq h$, and therefore $\{\mathcal{N}_{t}\}_{t=1}^{h}$ represents a network of time-series data.

The Multi-step Power Lines Obfuscation (MPLO) problem extends the PLO by enforcing the objective faithfulness condition (Definition 2) for every $\mathcal{N}_{t}$ ($t\in[h]$). The derived MPLO mechanism is outlined in Appendix B. It extends the PLO mechanism in taking as input a collection of networks $\{\mathcal{N}_{t}\}_{t=1}^{h}$ and it returns the admittance values $\dot{{\bf{Y}}}$ for the lines in the power grid that satisfy the conditions of Definition 2. The MPLO mechanism differs from the PLO mechanism exclusively in the post-processing optimization step of line 5. Observe that the admittance matrix ${\bf{Y}}$ containing the line parameters is constant during the whole time horizon. Therefore, similarly to PLO, the MPLO mechanism perturbs the lines parameters only once, prior applying the post-processing optimization step. Thus, the MPLO mechanism provides the same privacy guarantees as those provided by the PLO mechanism.

** Theorem​ 6**

For a given $\alpha$-indistinguishability level, the MPLO mechanism is $\epsilon$-differential private.

The objective of MPLO is equivalent to the objective ($s_{1}$) of the post-processing step in the PLO mechanism. In addition, the model constraints naturally extend those of the PLO mechanism by considering multiple time steps with a fixed time horizon. The MPLO mechanism also outputs a new network whose line parameters $\dot{{\bf{Y}}}$ are obfuscated and do not deviate too far from their privacy-preserving mean values. However, it further requires the AC-OPF problem constraints and the $\beta$ consistency requirement are satisfied for the whole time series instead of just one time-step. The PLO mechanism can be seen as a special case of the MPLO mechanism with a time horizon $h=1$; Hence the PLO mechanism is a relaxation of MPLO mechanism.

VI Experimental Evaluations

This section examines the proposed mechanisms on a variety of networks from the NESTA library [17]. It analyzes the line values produced by the obfuscation procedure, studies the mechanism ability to preserve the dispatch costs and optimality gaps (to be defined shortly), determines how well the resulting network can sustain an attack, and reports the runtime of the mechanisms. It also extends this analysis to time-series networks using a multiple-step approach.

For presentation simplicity, the analysis focuses primarily on the IEEE 39-bus network. However, our results are consistent across the entire NESTA benchmark set. All experiments use a privacy budget $\epsilon=1.0$ and vary the indistinguishability level $\alpha\in\{10^{-3},10^{-2},10^{-1},1.0\}$ and the faithfulness level $\beta\in\{10^{-2},10^{-1}\}$. The model was implemented using the Julia package PowerModels.jl [18] with the nonlinear solver IPOPT [19] for solving the various power flow models, including the nonlinear AC model and the QC [20, 21] and SOCP [22] relaxations.

VI-A Analysis of the Line Parameters

This section studies the realism of the Laplace mechanism. Table II reports the percentage of feasible instances (over 100 runs) for obfuscated networks obtained using exclusively the Laplace mechanism on the IEEE-30 bus, IEEE-39 bus, IEEE-57 bus, and the IEEE-118 bus networks. When the indistinguishability values $\alpha$ exceed $0.1$, the Laplace-obfuscated networks are rarely AC-feasible. In contrast, the PLO mechanism is always AC-feasible (except for one IEEE-118 instance). These results justify the need of studying mechanisms that are more sophisticated than the Laplace mechanism, and hence the PLO mechanism. Figure 1 illustrates the line resistances of an IEEE 39-bus network obtained by the Laplace and the PLO mechanisms and compare them with the associated values in the original network. The figure reports the results at varying of the indistinguishability level $\alpha$ and fixing $\beta=0.01$. The results indicate that the OPF obfuscated values differ by at most 1% from their original ones. Not surprisingly, the differences are more pronounced as the indistinguishability level increases: For larger indistinguishability levels, the PLO mechanism introduces more noise and hence more diverse lines values are generated.

VI-B Dispatch Costs and Optimality Gaps

The next results evaluate the ability of the PLO-obfuscated networks to preserve the dispatch costs and optimality gaps. Optimality gaps measures the relative distance between the objective value of the AC-OPF problem with one of its relaxations. It is frequently used as a measure to reflect the hardness of a problem instance. For our experimental evaluations, it is used as a proxy to measure whether the structure of an instance changed after applying our proposed mechanism. Figure 2 shows the difference, in percentage, of the dispatch costs obtained via the Laplace and the PLO mechanisms with respect to the original costs at varying of the indistinguishability level $\alpha$ and the faithfulness parameter $\beta$. The figure illustrates the mean and the standard deviation (shown with black, solid, lines) obtained on $100$ runs, for each combination of the $\alpha$ and $\beta$ parameters. Optimality gap (percentage differences) are measured as: $100\times\frac{{\mathcal{O}}(\mathcal{N})-{\mathcal{O}}(\tilde{\mathcal{N}})}{{\mathcal{O}}(\mathcal{N})}$, where $\mathcal{N}$ represents the original network, $\tilde{\mathcal{N}}$ the obfuscated network (using the Laplace or the PLO mechanisms), and ${\mathcal{O}}$ the cost of a (local) optimal solution to the AC-OPF problem. Parameter $\alpha$ controls the amount of noise being added to the line parameters, therefore, the OPF costs are close to their original values when $\alpha$ is small (e.g., $\leq 10^{-3}$). The PLO mechanism often produces obfuscated network inducing OPFs with lower costs than the original ones. This is because PLO returns an AC-feasible solution whose cost is close to that of the original network, ignoring whether a lower dispatch cost may exist.

Figure 3 compares the optimality gaps on the QC and the SOCP relaxations of the AC-OPF obtained using the original and the PLO-obfuscated networks. The percentage measures are defined as $100\times\frac{|{\mathcal{O}}(\mathcal{N})-\widehat{{\mathcal{O}}}(\mathcal{N})|}{{\mathcal{O}}(\mathcal{N})}$, where $\mathcal{N}$ is either the original or the obfuscated network, and $\widehat{{\mathcal{O}}}$ is the function returning the costs of the QC or the SOCP AC-OPF relaxation on $\mathcal{N}$. The results are averaged on $100$ runs and show that the optimality gaps attained with the obfuscated networks are close to those attained with the original ones for small ($\leq 10^{-2}$) $\alpha$ values. This is important for capturing the fidelity of the obfuscated network and the difficulty of the associated OPF. In general, the PLO mechanism increases the optimality gaps slightly, and these results are consistent across the NESTA networks.

VI-C Power Grid Attack Simulation

The next experiment evaluates the damages that an attacker may inflict on a real power network $\mathcal{N}$, if an obfuscated counterpart $\tilde{\mathcal{N}}$ is released. The attack setting is as follows: An attacker is given a budget denoting the percentage $k$ of lines it can damage. The attacker chooses the lines to damage based on the obfuscated network, but the attack impact is evaluated on the real network. To assess the benefits of the proposed obfuscation scheme, in response to such an attack, three attack strategies are compared:

Random Attack: $k$ lines are randomly selected. This represents a scenario in which an attacker carries an uninformed attack. 2. 2.

Obfuscated Flow Attack: The attacker solves an OPF problem on the obfuscated network $\tilde{\mathcal{N}}$ and chooses the top-$k$ lines carrying the largest active flows. This case represents a scenario in which the attacker carries an informed attack based on the obfuscated network data. 3. 3.

Real Flow Attack: The attacker solves an OPF problem on the real network $\mathcal{N}$ and chooses the top-$k$ lines carrying the largest active flows. This case represents a scenario in which the real data is released and exploited by an attacker.

To compare the damages inflicted by the attacks, the experiments report the load that can be restored after an attack using the maximum load restoration model described in Model 2. Figures 4 and 5 illustrate the percentage of the load being restored for each attack strategies, at varying of the attack budget $k\in\{5,10,15\}$ and the indistinguishability value $\alpha\in\{0.01,0.1,1.0\}$, on the IEEE-39 bus and the IEEE-118 bus benchmarks, respectively, with faithfulness value $\beta=0.01$. The results report the average values of 100 simulations for each combination of parameters.

The random attacks are used as a baseline to assess the damage that may be caused by an uninformed attacker. Not surprisingly, they result in the largest load restoration for each setting and the restored load decreases as the attack budget increases. In contrast, the real flow attacks produce the most significant damage to the networks. In all cases tested, the load restoration after these attacks were close to [math]% after the attacker reaches a sufficient budget (as low as 5% for IEEE-39 bus and 10% for IEEE-118 bus), meaning that these attacks are highly effective and extremely harmful.

On the other hand, the results for the Obfuscated Flow Attacks show a different pattern. Even though the attacker selects the lines with the highest flows (in the obfuscated network), the network ability to restore loads is substantially higher when compared to those of the real flow attacks. Remarkably, as the indistinguishability values increase, the strength of the obfuscated flow attack to inflict damages decreases and its success rate are close to those of random attacks. This is because larger indistinguishability implies more noise and thus higher chance for an attacker to damage less harmful lines.

VI-D Mechanism Runtimes

Having shown the effectiveness of the PLO mechanism in generating obfuscated networks, we now analyze its computational efficiency. Table III tabulates the average runtime, in seconds, for 100 experiments on several NESTA instances at varying of the indistinguishability values ($\alpha$ in $\{0.01,0.1,1.0\}$) and using the faithfulness value $\beta=0.01$. In all cases, producing an obfuscated network requires less than $60$ seconds. The results illustrate that, in general, the runtime increases when $\alpha$ increases. Larger $\alpha$ values may result in obfuscated line parameters that are farther from the original values, thus affecting the power losses and the feasible power flows. Therefore, minimizing the PLO optimization model (line 1 of Algorithm 1) may increase the runtime.

VI-E MPLO for Time-Series Data

This subsection evaluates the effect of obfuscating a network with the Multistep PLO mechanism. The experiments use time-series data $\{\mathcal{N}_{t}\}_{t=1}^{h}$ with a time horizon of $h$ steps, obtained and computed by varying the load profile in the range of $[80\%,110\%]$ of their original values.

Each time step will be associated with a load profile. The goal of MPLO is to find line parameters that meet the constraints imposed by a fixed number $1\leq r\leq h$ time steps ($r=1$ reduces to PLO, and $r=h$ implies using all the steps). These $r$ time steps are equally spaced in the time horizon $[h]$.

The results on the OPFs and optimality gaps are very similar to those obtained by the (single-step) PLO mechanism. The presentation focuses on the power network attacks which have significant differences. Figures 6 and 7 illustrates the percentage of the load restored on the IEEE-39 bus network for the attack strategies and settings discussed earlier, using $r=4$ and $r=h=31$, respectively. The results for $r=4$ are similar to those obtained by the PLO mechanism. In contrast, when the entire time horizon is considered, the effectiveness of attacks on the obfuscated network increases. This is because constraining the MPLO optimization problem to consider each single time step in the time horizon reduces the degrees of freedom for generating obfuscated networks that differ substantially from the original ones.

Figure 8 further explains these results. It quantifies the similarity of the attacks on the real and obfuscated networks using the following metric to measure similarity: $100\times\frac{\lvert E^{o}\cap E^{d}\rvert}{\lvert E^{o}\rvert}$ where $E^{o}$ and $E^{d}$ are the set of lines selected by the real and obfuscated flow attacks. The experiments fix the attack budget at $k=10\%$ and vary the number of time steps $r$ within the MPLO mechanism. The figure clearly illustrates that the number of lines chosen by both attacks grows as $r$ increases. When $r\geq 7$, the two attack configurations select, on average, up to $90\%$ of common lines. The experiment highlights the tradeoffs between obfuscation and network fidelity: Larger values for $r$ result in higher network fidelity but reduce the effects of the obfuscation process, making the networks more vulnerable to attacks.

VII Conclusions

This paper presented a privacy-preserving scheme for the release of power grid benchmarks that obfuscate the parameters of transmission lines and transformers. The proposed Power Line Obfuscation (PLO) mechanism hides the network sensitive values using differential privacy, while also ensuring that the released obfuscated network preserves fundamental properties useful in optimal power flow. Specifically, the released networks have dispatch costs similar to those of the original networks and satisfy the power flow operational constraints. The PLO mechanism was tested on a large collection of test cases. It was shown to be efficient and to produce obfuscated networks that preserve dispatch costs and optimality gaps values. Finally, the networks released by the PLO mechanism are shown to be effective in deceiving an attacker attempting to damage the network components for disrupting the power grid load. Future work will focus on jointly obfuscating other sensitive aspects of the network, such as loads and generators. Another avenue of future research is to study more complex attack models, including those in which the attacker evaluates the (near)-optimal subset of lines to disrupt so to minimize the total load restoration.

Acknowledgment

The authors would like to thank Kory Hedman for extensive discussions about obfuscation techniques and effective attack strategies. The authors are also grateful to the anonymous reviewers for their valuable comments. This research is partly funded by the ARPA-E Grid Data Program under Grant 1357-1530.

Appendix A Detailed Proofs

This section provides the missing proofs. It first reviews the sensitivity of the queries adopted in the PLO mechanisms. The characterization of properties discussed below holds true for the $\alpha$-indistinguishability model of differential privacy [13].

** Property​ 1**

Let $D=\{x_{1},\ldots,x_{n}\}\in\mathbb{R}^{n}$ be an $n$-dimensional numerical vector. The sensitivity of the identity query $Q_{I}(D)=\{x_{1},\ldots,x_{n}\}$ is $\Delta_{Q_{I}}=\alpha$.

The property above follows directly from the definition of sensitivity of queries in the $\alpha$-indistinguishability model.

** Property​ 2**

Let $D=\{x_{1},\ldots,x_{n}\}\in\mathbb{R}^{n}$ be an $n$-dimensional numerical vector. The sensitivity of the average query $Q_{A}(D)=\frac{1}{n}\sum_{i=1}^{n}x_{i}$ is $Q_{A}=\frac{\alpha}{n}$.

Proof:

Let $D$ and $D^{\prime}$ be two datasets such that $D\sim_{\alpha}D^{\prime}$, that is $D^{\prime}$ differs from $D$ in at most one coordinate and for a factor of at most $\alpha$. Denote by $i$ be the coordinate such that $|x_{i}-x_{i}^{\prime}|\leq\alpha$. It follows:

[TABLE]

∎

Theorem 4

For a given $\alpha$-indistinguishability level, the PLO mechanism is $\epsilon$-differential private.

Proof:

Consider an indistinguishability value $\alpha>0$. Algorithm 1 queries the dataset of real conductance data in three different instances:

To compute $\tilde{{\bf{g}}}$: In Equation (15), $\tilde{{\bf{g}}}$ is computed by issuing an identity query over ${\bf{g}}$. The privacy budget used in Equation (15) is $\frac{\epsilon}{3\alpha}$. Thus, since by Property 1, Theorem 4, and parallel composition (Theorem 2), privately computing the conductance values $\tilde{{\bf{g}}}$ is $\epsilon/3$-differentially private. 2. 2.

To compute $\tilde{\mu}_{{\bf{g}}}^{v}$: In Equation (16), for a voltage level $v$, the mean value $\mu_{{\bf{g}}}^{v}$ of the conductance vector ${\bf{g}}$ the computation of is computed issuing an average query $Q_{A}$ on ${\bf{g}}$. The privacy budget used is $\frac{n_{v}\,\epsilon}{3\alpha}$. Therefore, by Property 2 and Theorem 4 computing $\tilde{\mu}_{{\bf{g}}}^{v}$ is $\epsilon/3$-differentially private. Computing the vector of mean values $\tilde{\mu}_{\bf{g}}=\{\tilde{\mu}_{{\bf{g}}}^{v_{1}},\ldots,\tilde{\mu}_{{\bf{g}}}^{v_{|VL(\mathcal{N})|}}\}$ for each voltage level of the network is also $\epsilon/3$-differentially private by parallel composition (Theorem 2) since each line belongs to exactly one voltage level set $E(v)$. 3. 3.

To compute $\tilde{\mu}_{{\bf{b}}}^{v}$: The mean value $\mu_{{\bf{b}}}$ is $\epsilon/3$ differentially private. The argument is analogous to the one above.

Computing a privacy-preserving version of the susceptance vector ${\bf{b}}$ uses exclusively privacy-preserving data (${\bf{g}}$) and public information ($\bm{r}$), therefore the vector $\tilde{{\bf{b}}}$ defined in Equation 15 is differentially private by post-processing immunity (Theorem 3).

Note that the optimization model of line (5) uses exclusively privacy-preserving data $(\tilde{{\bf{g}}},\tilde{{\bf{b}}},\tilde{\mu}_{\bf{g}},\tilde{\mu}_{\bf{b}})$ and additional public information (i.e., the optimization problem and its optimal solution value). The result follows by sequential composition (Theorem 1) and post-processing immunity (Theorem 3). ∎

Theorem 5

For a given $\alpha$-indistinguishability level, the MPLO mechanism is $\epsilon$-differential private.

Proof:

Note that MPLO differs from PLO exclusively in the optimization model executed on line 4. The optimization model does not operate on the sensitive data and takes as input the same privacy-preserving values as those taken as input by the PLO’s optimization model. Therefore, by post-process immunity and Theorem 4 the MPLO mechanism is $\epsilon$-differential private. ∎

Appendix B MPLO Algorithm

The MPLO mechanism is outlined in Algorithm 2. It takes as input a sequence of power network descriptions $\{\mathcal{N}_{t}\}_{t=1}^{h}$ where the loads and the optimal generator dispatches are varying over time, the associated optimal dispatch costs $\{O^{*}(t)\}_{t=1}^{h}$, as well as three positive real numbers: $\epsilon$, which determines the privacy value of the private data, $\alpha$, which determines the indistinguishability value, and $\beta$, which determines the required faithfulness to the value of the objective function. Recall that each $\mathcal{N}_{t}=(N,E,{\bf{S}}_{t},{\bf{Y}},\bm{\theta^{\Delta}},{\bf{s}},{\bf{v}})$ represents the steady state of the power grid at time step $1\leq t\leq h$, and therefore $\{\mathcal{N}_{t}\}_{t=1}^{h}$ represents a network of time-series data.

Lines 1 to 4 of Algorithm 2 are analogous to lines 1 to 4 of Algorithm 1 executed by the PLO mechanism. They produce the noisy conductance and susceptance vectors (lines 1 and 2) $\tilde{{\bf{g}}}$ and $\tilde{{\bf{b}}}$, respectively, as well as their noisy mean values (lines 3 and 4). Since the voltage levels $VL(\mathcal{N}_{t})$ are invariant for any $t=1,\ldots,h$, the loop of line 3 uses network $\mathcal{N}_{1}$ as a reference. Line 5 describe the post-processing optimization step associated to the mechanism, and, similarly to that associated to the PLO mechanism, it operates using exclusively the privacy-preserving version of the line parameters.

The multi-step PLO post-processing finds the set of conductance $\dot{{\bf{g}}}$ and susceptance $\dot{{\bf{b}}}$ values, summarized with the notation $\dot{{\bf{Y}}}$, by minimizing Equation ($m_{1}$). This process is similar to the one performed by the (single-step) PLO post-processing (in Equation ($s_{1}$)). The models differ in their constraints. While the PLO post-processing operates over a single network, the MPLO post-processing works over $h$ networks. Constraints ($m_{2}$) and ($m_{3}$) are similar to Constraint ($s_{4}$) and ($s_{5}$), respectively, of Algorithm 1. They bound the values for the post-processed conductance and susceptance to be close to their privacy-preserving means, for each voltage level $v$ and parametrized by a value $\lambda>0$. These constraints are used to avoid that the post-processed values deviate arbitrarily from the original ones. Constraint ($m_{4}$) guarantees to satisfy condition 3 of the PLO problem (Definition 2) for each network $\mathcal{N}_{t}$ in the horizon ($t\in[h]$). The notation $\bm{cost}(S^{g}_{i})$ is used as a shorthand for $c_{2i}(\Re(S^{g}_{i}))^{2}+\bm{c}_{1i}\Re(S^{g}_{i})+\bm{c}_{0i}$. Finally, Constraints ($m_{5}$) to ($m_{11}$) enforce the AC-OPF Constraints (2) to ($s_{3}$) for each network $\mathcal{N}_{t}$ in the considered horizon $(t\in[h])$/

Appendix C Extended Results

This section presents additional results to shed additional lights on the attack performance of the proposed PLO mechanism on the IEEE-118 bus network. To do so, Figure 9 illustrates the percentage of the load being restored for the three introduced attack strategies at a finer granularity of the attack budget $k$ from 5% to 10%, at varying of the indistinguishability value $\alpha\in\{0.01,0.1,1.0\}$ and with faithfulness value $\beta=0.01$. The results report the average values of 100 simulations for each combination of parameters.

The plots show that the real flow attacks require to damage as little as $9\%$ of the network power lines to produce un-restorable damages. We observe that the network restoration abilities after a real flow attack decrease drastically when the attack budget increases from $8\%$ to $9\%$. This is due to that there exist a set of critical power lines, that, if collectively damaged results in an un-restorable network. On the other hand, when only a subset of these power lines is damaged, a high percentage of the network loads can be restored.

On the other hand, the PLO mechanism is able to hide the critical power lines to an attacker exploiting the released data, thus avoiding such critical restoration behavior.

Figures 10 and 11 report the boxplot visualizations of Figures 2 and 3, respectively.