Bidirectional Information Flow and the Roles of Privacy Masks in Cloud-Based Control

TL;DR

This paper investigates the interplay of privacy masks and information flow in cloud-based control systems, analyzing how privacy measures affect control performance and proposing joint design strategies for privacy masks.

Contribution

It introduces a joint design framework for uplink and downlink privacy masks in cloud control, highlighting their non-monotonic impact on privacy and control performance.

Findings

Privacy is not necessarily monotone with noise levels of masks.

Joint design of uplink and downlink masks improves privacy-control trade-offs.

Trade-offs between privacy and control performance are quantitatively analyzed.

Abstract

We consider a cloud-based control architecture for a linear plant with Gaussian process noise, where the state of the plant contains a client's sensitive information. We assume that the cloud tries to estimate the state while executing a designated control algorithm. The mutual information between the client's actual state and the cloud's estimate is adopted as a measure of privacy loss. We discuss the necessity of uplink and downlink privacy masks. After observing that privacy is not necessarily a monotone function of the noise levels of privacy masks, we discuss the joint design procedure for uplink and downlink privacy masks. Finally, the trade-off between privacy and control performance is explored.

Equations

$$I(X^T\to Y^T)\triangleq {\sum }_{t=0}^{T}I(X^t;Y_t\mid Y^{t-1}).$$

$$I(X^T\leftarrow Y^T)\triangleq I(0\ast X^{T-1}\to Y^T),$$

$$I(X^T\to {\hat{X}}^T)=I(X^T\to Y^T)=I(X^T\to U^T)$$

$$I(X^T\leftarrow {\hat{X}}^T)=I(X^T\leftarrow Y^T)=I(X^T\leftarrow U^T).$$

$$I(X^T;{\hat{X}}^T)=I(X^T\to {\hat{X}}^T)+I(X^T\leftarrow {\hat{X}}^T).$$

$$I_{\infty }(X\to \hat{X})\triangleq \underset{T\to \infty }{\mathrm{limsup}}\frac{1}{T+1}I(X^T\to {\hat{X}}^T)$$

$$I_{\infty }(X\leftarrow \hat{X})\triangleq \underset{T\to \infty }{\mathrm{limsup}}\frac{1}{T+1}I(X^T\leftarrow {\hat{X}}^T)$$

$$I_{\infty }(X;\hat{X})\triangleq \underset{T\to \infty }{\mathrm{limsup}}\frac{1}{T+1}I(X^T;{\hat{X}}^T)$$

$$C_{\infty }(X,U)\triangleq \underset{T\to \infty }{\mathrm{limsup}}\frac{1}{T+1}\sum _{t=0}^T\mathbb{E}[q{X}_t^2+r{U}_t^2].$$

$$I_{\infty }(X;\hat{X})=$$

$$C_{\infty }(X,U)=$$

$$\left(\frac{a^{2}n}{\Sigma +n}-1\right)\Sigma +m+w=0.$$

$$I_{\infty }(X;\hat{X})$$

$$+\frac{1}{2}\log \left(1+k^2\alpha \right).$$

$$(a^2-1{)}^2{\alpha }^4+2(a^2+1){\alpha }^3-\frac{2}{k^2}\alpha -\frac{1}{k^4}=0.$$

$$\underset{m,n}{\min }{I}_{\infty }(X;\hat{X})+\lambda C_{\infty }(X,U)$$

$$\displaystyle\min_{\alpha,m}\big{[}I_{\infty}(\alpha)+\lambda\ C_{\infty}(\alpha,\alpha m,m)\big{]}$$

$$\displaystyle=\min_{\alpha}\big{[}I_{\infty}(\alpha)+\lambda\min_{m}[C_{\infty}(\alpha,\alpha m,m)]\big{]}$$

$$\displaystyle=\min_{\alpha}\big{[}I_{\infty}(\alpha)+\lambda\ C_{\infty}(\alpha,0,0)\big{]},$$

$$X_t=a{X}_{t-1}+U_{t-1}+M_{t-1}+W_t$$

$$Y_t=X_t+N_t$$

$$U_t=k{Y}_t.$$

$${\hat{X}}_{t|t-1}=a{\hat{X}}_{t-1}+U_{t-1}{\hat{X}}_0=0$$

$${\Sigma }_{t|t-1}=a^2{\Sigma }_{t-1}+m+w{\Sigma }_0=0$$

$$l_t={\Sigma }_{t|t-1}/({\Sigma }_{t|t-1}+n)$$

$${\hat{X}}_t={\hat{X}}_{t|t-1}+l_t(Y_t-{\hat{X}}_{t|t-1})$$

$${\Sigma }_t=(1-l_t{)}^2{\Sigma }_{t|t-1}+l_t^{2}n.$$

$$\begin{array}{rl}& {\hat{X}}_t={\hat{X}}_{t|t-1}+l_t(X_t+N_t-{\hat{X}}_{t|t-1})\\ & =(1-l_t)a{\hat{X}}_{t-1}+(1-l_t)U_{t-1}+l_t{X}_t+l_t{N}_t.\end{array}$$

$$\begin{split}&I(X^{T}\rightarrow\hat{X}^{T})=\sum\nolimits_{t=0}^{T}I(X^{t};\hat{X}_{t}|\hat{X}^{t-1})=\\ &\sum\nolimits_{t=1}^{T}\Big{[}\underbrace{I(X^{t-1};\hat{X}_{t}|\hat{X}^{t-1},X_{t})}_{=(A)}+\underbrace{I(X_{t};\hat{X}_{t}|\hat{X}^{t-1})}_{=(B)}\Big{]}.\end{split}$$

$$(A)=I(X^{t-1};{\hat{X}}_t|{\hat{X}}^{t-1},X_t)=I(X^{t-1};l_t{N}_t|{\hat{X}}^{t-1},X_t)=0$$

$$\begin{array}{rl}& (B)=I(X_t;{\hat{X}}_t|{\hat{X}}^{t-1})\\ & =I(X_t;(1-l_t)U_{t-1}+l_t{X}_t+l_t{N}_t|{\hat{X}}^{t-1})\\ & =I(X_t;l_t{X}_t+l_t{N}_t|{\hat{X}}^{t-1})\\ & =h(l_t{X}_t+l_t{N}_t|{\hat{X}}^{t-1})-h(l_t{X}_t+l_t{N}_t|{\hat{X}}^{t-1},X_t)\\ & =h(l_t{X}_t+l_t{N}_t|{\hat{X}}^{t-1})-\frac{1}{2}\log (l_t^{2}n).\end{array}$$

$$h(l_t(a{X}_{t-1}+U_{t-1}+M_{t-1}+W_t+N_t)|{\hat{X}}^{t-1})$$

$$=h(l_t(a{X}_{t-1}+M_{t-1}+W_t+N_t)|{\hat{X}}^{t-1})$$

$$=h(l_t(a{e}_{t-1}+M_{t-1}+W_t+N_t)|{\hat{X}}^{t-1})$$

$$=\frac{1}{2}\log (l_t^2(a^2{\Sigma }_{t-1}+m+w+n))$$

$$=\frac{1}{2}\log (l_t^2({\Sigma }_{t|t-1}+n)).$$

$$I(X^T\to {\hat{X}}^T)$$

$$={\sum }_{t=1}^T\frac{1}{2}\log \left(1+\frac{{\Sigma }_{t|t-1}}{n}\right).$$

$$\begin{split}&I(0*\hat{X}^{T-1}\rightarrow X^{T})=I(0;X_{1}|X_{0})+\sum_{t=1}^{T}I(\hat{X}^{t-1};X_{t}|X^{t-1})\\ &=\sum\nolimits_{t=1}^{T}\Big{[}h(X_{t}|X^{t-1})-h(X_{t}|\hat{X}^{t-1},X^{t-1})\Big{]}\\ &=\sum\nolimits_{t=1}^{T}\Big{[}h(kN_{t-1}+M_{t-1}+W_{t-1})-h(M_{t-1}+W_{t-1})\Big{]}\\ &=\sum\nolimits_{t=1}^{T}\Big{[}\frac{1}{2}\log(k^{2}n+m+w)-\frac{1}{2}\log(m+w)\Big{]}\\ &=\sum\nolimits_{t=1}^{T}\Big{[}\frac{1}{2}\log\left(1+\frac{k^{2}n}{m+w}\right)\Big{]}.\end{split}$$

$$P_t=(a+k{)}^2{P}_{t-1}+m+k^{2}n+w{P}_0=0.$$

Full text

I Introduction

Cloud-based control is a popular platform in industrial automation in recent years. It has a number of advantages over conventional on-site controllers in terms of installation costs, flexibility, and computational resources. In a cloud-based control architecture, it is necessary for clients to share operational data of a local plant with the cloud in real time. Since operational data can contain clients’ sensitive information, privacy concerns are inherent in cloud-based control.

Privacy has been studied in recent years in a broad range of academic disciplines including control, information theory, and computer science. Formal concepts of privacy include $k$-anonymity, $t$-closeness, and $\ell$-diversity. The recent concept of differential privacy [1] has been used in both the research community and industry. Information-theoretic privacy [2, 3] has also been investigated. Some of these privacy notions have already been applied to control-related problems. Differential privacy, in particular, has been applied to various estimation and control problems [4, 5, 6, 7, 8, 9, 10, 11]. Information-theoretic privacy was also proposed in [12], where a rate-distortion approach similar to [2] was generalized to feedback control systems.

While these results demonstrate the effectiveness of existing privacy notions in feedback control systems, it is important to be mindful that there are key differences between privacy problems for static (e.g., databases) and dynamic (e.g., feedback control) applications. The key feature of cloud-based control architectures, which distinguishes them from static databases, is the existence of a bidirectional information flow between the cloud and the client. The purpose of this paper is to identify and address the privacy consequences of this fact, which has received comparatively little attention in the existing privacy literature for feedback control systems.

In this paper, we consider a cloud-based control architecture equipped with an uplink privacy mask (perturbing the client-to-cloud information flow) and a downlink privacy mask (perturbing the cloud-to-client information flow). Following [2], we adopt mutual information as a measure of privacy loss. Our problem setup is minimal, yet effective to draw the following conclusions:

• (A)

Both an uplink privacy mask and a downlink privacy mask are necessary to enhance privacy, especially when the process noise of the plant is absent or small. Intuitively, this is because the absence of a downlink privacy mask allows the cloud to estimate the client’s state solely based on control commands it sends. In this way, the cloud can compromise the client’s privacy, even without ever receiving any information from the client.

• (B)

Unlike applications in which only the uplink information flow exists, privacy is not necessarily a monotone function of the noise level of the uplink privacy mask. This fact can be understood by invoking the computation of the capacity of channels with feedback. Consequently, a joint design of uplink and downlink privacy masks is needed, which is demonstrated in this paper.

Notation: Random variables are denoted by upper-case symbols. The notation $X^{t}=(X_{0},X_{1},...,X_{t})$ is used to denote a sequence. If $X^{T}$ and $Y^{T}$ are random processes, the (forward) directed information [13] is defined as

[TABLE]

The (backward) directed information is denoted by

[TABLE]

where $0*X^{T-1}=(0,X_{0},X_{1},...,X_{T-1})$. The natural logarithm is used throughout the paper.

II Problem formulation

In this paper, we consider the cloud-based control architecture shown in Fig. 1. We assume there are two parties in this configuration, namely the cloud operator and the client. The client owns a local plant, whose dynamics is described by a linear dynamical system with Gaussian process noise. The system parameters $a$ and $w$ are assumed to be known to both parties. We consider the situation in which the local plant is controlled by the cloud, but, in the interest of privacy, the client does not wish a full disclosure of the state of the plant, $X_{t}$. We assume that the client adopts a bidirectional privacy masking mechanism comprised of uplink and downlink privacy masks, as shown in Fig. 1. Both uplink and downlink privacy masks are simple additive white Gaussian noise (AWGN) channels, where noise intensities $m$ and $n$ are parameters to be designed. The cloud observes a perturbed version $Y_{t}=X_{t}+N_{t}$ of the state, which is multiplied by a feedback control gain $k\neq 0$ to compute the raw control input $U_{t}=kY_{t}$. Instead of applying the raw control input $U_{t}$, the client applies a perturbed version of the control input, $V_{t}=U_{t}+M_{t}$, where the realization of the random variable $M_{t}$ is not known to the cloud. For simplicity, we assume that all random variables are scalar-valued. We also assume that $k$ is a pre-designed feedback gain, which is treated as a constant in this paper.

To analyze the fundamental limitations of the cloud’s capability to estimate $X_{t}$, we assume that the parameters $m$ and $n$ are available to the cloud, based on which the estimate $\hat{X}_{t}$ is computed by Kalman filtering. Due to the invertibility of the Kalman filter, the following identities are easy to verify:

[TABLE]

Following [2], this paper adopts the mutual information $I(X^{T};\hat{X}^{T})$ as a privacy metric. The following identity, known as the conservation of information [14], is useful in the developments below:

[TABLE]

This identity articulates the fact that it is not only the uplink information flow, but also the downlink information flow that impact the confidentiality of cloud-based control systems. Minimizing mutual information should therefore account for information flow in both directions.

III Main Results

III-A Computation of performance metrics

To analyze performance from both information and control perspectives, we explicitly compute the following metrics:

[TABLE]

In what follows, we regard $I_{\infty}(X;\hat{X})$ as the privacy loss and $C_{\infty}(X,U)$ as the control cost. In general, it is desirable to keep both of these quantities small. We next derive exact expressions for them in terms of system parameters.

Lemma 1

The mutual information and the $H_{2}$ control performance are

[TABLE]

where $\Sigma$ is the positive solution to the algebraic Riccati equation (ARE)

[TABLE]

Fig. 2 shows the values of mutual information $I_{\infty}(X;\hat{X})$ as a function of $m$ and $n$. We note that it is neither convex nor concave in $(m,n)$.

III-B Necessity of privacy masks

The necessity of privacy masks can be understood by analyzing $I_{\infty}(X;\hat{X})$.

Proposition 1

For arbitrary $w\geq 0$ and $m\geq 0$ such that $w+m>0$, we have $\lim_{n\searrow 0}I_{\infty}(X;\hat{X})=+\infty$.

This result shows that the lack of uplink privacy mask (cloud observes unperturbed data) implies unbounded privacy loss, indicating its necessity for privacy protection.

Proposition 2

If $w=0$, for arbitrary $n\geq 0$, we have $\lim_{m\searrow 0}I_{\infty}(X;\hat{X})=+\infty$.

This result indicates that the downlink privacy mask is also necessary when $w=0$. To see why, notice that when $w=0$, the lack of downlink privacy mask ($m=0$) makes the plant a deterministic dynamical system from the cloud’s perspective. Assuming that the initial state $X_{0}$ is known, the cloud operator is able to compute $X_{t}$ by “simulating” the dynamics based on the knowledge of the control sequence $U^{t}$ alone. We emphasize that such a privacy attack through the downlink channel is possible even when the client shares no information over time.

Proposition 2 does not apply when $w\neq 0$. However, even in such cases, the downlink privacy filter can provide robustness against modeling errors. We will revisit this point in Section III-E.

III-C Connection to the capacity of channels with feedback

As Fig. 2 shows, for a fixed value of $m$, the privacy loss (10) is not a monotonically decreasing function of the noise level $n$ of the uplink privacy filter. This is a unique characteristic of systems with feedback, and shows a stark contrast to the privacy theory for static databases, where larger perturbations provide stronger privacy protections. A closer look at (10) reveals that, for fixed values of $(m,w,a,k)$, the uplink directed information $I(X\rightarrow\hat{X})$ is indeed a convex and monotonically non-increasing function of $n$. A related observation has already been made in [12]. However, the downlink directed information $I_{\infty}(X\leftarrow\hat{X})$ is a concave and monotonically increasing function of $n$. To understand the latter fact, it is instrumental to invoke the computation of channel capacity under noiseless feedback [15, 16, 17, 18].

Fig. 3 shows an equivalent diagram to Fig. 1 when $m=0$. This diagram shows a connection between Fig. 1 and the computation of the capacity of a channel with feedback. It is known that the capacity of a channel with noiseless feedback coincides with the supremum of $I_{\infty}(X\leftarrow Y)$ over the distribution of inputs, subject to channel input constraints [16]. In Fig. 1 with $m=0$, the channel input distribution is restricted to the form $Y_{t}=X_{t}+N_{t}$, with $N_{t}\sim\mathcal{N}(0,n)$. Since the channel input power $\mathbb{E}[Y_{t}^{2}]$ monotonically increases with $n$, the capacity also increases with $n$. The second term of the equation (10) confirms this intuition.

III-D Joint uplink and downlink mask designs

In this section, we find the optimal values of $m$ and $n$ to have minimum privacy loss.

Proposition 3

The mutual information (10) depends only on the Noise-to Noise (NNR) ratio $\alpha:=\frac{n}{m+w}$. In particular,

[TABLE]

Proposition 3 indicates that the level of privacy is determined by the ratio of $n$ and $m+w$ and not by the magnitude of noises. The mutual information (13) as a function of $\alpha$ is depicted in Fig. 4. This function is neither convex nor concave. Nevertheless, we have the following result:

Proposition 4

Mutual information (13) is uniquely minimized by the unique positive solution $\alpha^{*}$ to the quartic equation

[TABLE]

The red line on Fig. 2 shows the line $n=\alpha^{*}(m+w)$. As can be inferred, $I_{\infty}(X;\hat{X})$ is constant along this line.

III-E Privacy-utility trade-off

The privacy masks also alter the control performance $C_{\infty}(X,U)$. To analyze the privacy-utility trade-off, we now consider the following multi-objective optimization problem

[TABLE]

where $\lambda>0$ is a positive weight. We observed in Lemma 1 that the control cost is affine in $m$ and $n$. Thus, using $n=\alpha(m+w)$, we can express $C_{\infty}$ as an affine function of $\alpha$, $m$, and $\alpha m$, which is denoted by $C_{\infty}(\alpha,\alpha m,m)$ with a slight abuse of notation. Since Proposition 3 shows that $I_{\infty}(X;\hat{X})$ is only a function of $\alpha$ (denoted by $I_{\infty}(\alpha)$), (15) can be rewritten in terms of $\alpha$ and $m$ as \min_{\alpha,m}\big{[}I_{\infty}(\alpha)+\lambda\ C_{\infty}(\alpha,\alpha m,m)\big{]}. Assuming that the closed-loop system is stable (i.e., $|a+k|<1$), the affine function $C_{\infty}(\alpha,\alpha m,m)$ is increasing in its individual arguments. Hence, we can proceed as

[TABLE]

where $C_{\infty}(\alpha,0,0)$ is an increasing affine function in $\alpha$. This observation indicates that (i) the privacy-utility trade-off can be performed purely in terms of the NNR $\alpha=\frac{n}{m+w}$, and that (ii) as far as the NNR $\alpha$ is chosen to be the minimizer of (16c), selecting $m=0$ (no downlink mask) is mathematically optimal. However, (ii) must be taken with two caveats. First, as observed in Proposition 2, simultaneous $m=0$ and $w=0$ result in an ill-defined $\alpha$ and an unbounded privacy loss. Second, even if $w>0$, the task of selecting the optimal $n$ such that $\alpha=\frac{n}{m+w}$ minimizes (16c) becomes sensitive to modeling error of $w$ if $m=0$. Thus, the downlink mask has the practical benefit of enhancing robustness against modeling errors of $w$.

IV Proofs

IV-A Proof of Lemma 1

We consider the case of a scalar-valued LTI system in finite time horizon. The closed-loop dynamics are

[TABLE]

$X_{t}$ can be estimated by $\hat{X}_{t}=\mathbb{E}[X_{t}\mid Y^{t},U^{t-1}]$ with the error covariance $\Sigma_{t}=\mathbb{E}[(X_{t}-\hat{X}_{t})(X_{t}-\hat{X}_{t})^{\intercal}\mid Y^{t},U^{t-1}]$ that can be calculated iteratively by Kalman filtering via

[TABLE]

It follows from (20) that

[TABLE]

The uplink information flow $I(X^{T}\rightarrow\hat{X}^{T})$ is computed as

[TABLE]

Considering (21) and the fact that $U_{t-1}=kY_{t-1}$ is a deterministic function of $\hat{X}^{t-1}$, we have:

[TABLE]

since $N_{t}$ is independent of $X^{t-1}$ given $(\hat{X}^{t-1},X_{t})$. We next focus on $(B)$, again by considering (21):

[TABLE]

The first term in the last line can be made more explicit as

[TABLE]

In (24b), we used the fact the innovation $e_{t-1}=X_{t-1}-\hat{X}_{t-1}$ is independent of the previous measurement (and of $\hat{X}^{t-1}$). Therefore, the uplink directed information is:

[TABLE]

The backward directed information is computed as

[TABLE]

Due to the observability of the system, the limit $\Sigma=\lim_{t\rightarrow\infty}\Sigma_{t|t-1}$ exists for the Riccati recursion defined by (20c) and (20e), which coincide with the unique positive solution of ARE (12).

To compute the control cost $C_{\infty}(X,U)$, consider the predicted error covariance $P_{t}=\mathbb{E}[X_{t}^{2}]$ which can be computed from the recursion

[TABLE]

The control cost is obtained as

[TABLE]

where $P=\frac{m+k^{2}n+w}{1-(a+k)^{2}}$ is the solution to algebraic Riccati equation induced by (25).

IV-B Proof of Propositions 1 and 2

From (12), $\Sigma\rightarrow m+w$ as $n\rightarrow 0$. Thus, Proposition 1 is clear. When $w=0$, the downlink information flow diverges for $m\rightarrow 0$ unless $m+w=0$ (Proposition 2).

IV-C Proof of Proposition 3

For uplink directed information, by direct substitution,

[TABLE]

To compute the downlink directed information, we can plug $m+w=\frac{n}{\alpha}$ in ARE (12). Then (12) reduces to

[TABLE]

Substituting the positive solution in $I_{\infty}(X\rightarrow\hat{X})=\frac{1}{2}\log\left(1+\frac{\Sigma}{n}\right)$ completes the proof.

IV-D Proof of Proposition 4

Equation (12) can be solved for $n$ as $n=\frac{\Sigma(\Sigma-p)}{(a^{2}-1)\Sigma+p}$, where $p:=m+w$ is defined for simplicity. Substituting this into (10), we have

[TABLE]

Since $F>0$, the minimizing $\Sigma$ is obtained by solving

[TABLE]

Substituting $(a^{2}-1)\Sigma+p=\frac{\Sigma(\Sigma-p)}{n}$ (this identity follows from (12)) into the denominator of the second term in (26), we obtain

[TABLE]

from which $\Sigma$ is solved as $\Sigma=\frac{2pn^{2}}{(\frac{p^{2}}{k^{2}}-(a^{2}-1)n^{2})}$. Substituting this back into (12), a quartic equation for $n$ is obtained as

[TABLE]

We can rewrite (27) in terms of $\alpha=\frac{n}{p}$ as

[TABLE]

Note that $F^{\prime}(0)<0$, $\lim_{\alpha\rightarrow\infty}F^{\prime}(\alpha)=\infty$, and $F^{\prime}(\alpha)$ is strictly increasing. Thus, by the intermediate value theorem, there exists a unique $\hat{\alpha}>0$ such that $F^{\prime}(\hat{\alpha})=0$. Therefore, $F(\alpha)$ is strictly decreasing for $\alpha\in[0,\hat{\alpha})$ and strictly increasing for $\alpha\in(\hat{\alpha},\infty)$. It follows from $F(0)<0$ that $F(\hat{\alpha})<0$. Since $\lim_{\alpha\rightarrow\infty}F(\alpha)=\infty$ and $F(\alpha)$ is strictly increasing on $(\hat{\alpha},\infty)$, again by the intermediate value theorem, $F(\alpha)=0$ necessarily has a unique positive solution $\alpha^{*}$.

V Future Work

Future work includes the generalization of this paper’s results to multi-dimensional control systems. It is also worth investigating whether the observations (A) and (B) in Section I hold for other privacy metrics, such as differential privacy.