Initial-Value Privacy of Linear Dynamical Systems

TL;DR

This paper investigates initial-value privacy in linear dynamical systems, introducing new privacy metrics and analyzing how system structure and noise influence privacy guarantees.

Contribution

It defines differential and intrinsic initial-value privacy, establishes their equivalence to unobservability and observability, and analyzes privacy in networked systems with node-specific privacy conditions.

Findings

Intrinsic privacy is equivalent to unobservability.

Differential privacy depends on extended observability and noise covariance.

Node privacy is determined by network structure.

Abstract

This paper studies initial-value privacy problems of linear dynamical systems. We consider a standard linear time-invariant system with random process and measurement noises. For such a system, eavesdroppers having access to system output trajectories may infer the system initial states, leading to initial-value privacy risks. When a finite number of output trajectories are eavesdropped, we consider a requirement that any guess about the initial values can be plausibly denied. When an infinite number of output trajectories are eavesdropped, we consider a requirement that the initial values should not be uniquely recoverable. In view of these two privacy requirements, we define differential initial-value privacy and intrinsic initial-value privacy, respectively, for the system as metrics of privacy risks. First of all, we prove that the intrinsic initial-value privacy is equivalent to unobservability, while the differential initial-value privacy can be achieved for a privacy budget depending on an extended observability matrix of the system and the covariance of the noises. Next, the inherent network nature of the considered linear system is explored, where each individual state corresponds to a node and the state and output matrices induce interaction and sensing graphs, leading to a network system. Under this network system perspective, we allow the initial states at some nodes to be public, and investigate the resulting intrinsic initial-value privacy of each individual node. We establish necessary and sufficient conditions for such individual node initial-value privacy, and also prove that the intrinsic initial-value privacy of individual nodes is generically determined by the network structure. These results may be extended to linear systems with time-varying dynamics under the same analysis framework.