Private Status Updating with Erasures: A Case for Retransmission Without Resampling

TL;DR

This paper explores a privacy-aware status updating system over erasure channels, demonstrating that retransmitting stale updates without resampling can enhance privacy while managing age-of-information.

Contribution

It introduces a novel approach combining waiting times and retransmissions of stale updates to balance privacy and freshness in AoI systems.

Findings

Retransmitting stale updates can improve privacy under certain conditions.

Waiting times can be optimized to balance privacy and AoI.

Stale update retransmission is beneficial without resampling in specific scenarios.

Abstract

A status updating system is considered in which a source updates a destination over an erasure channel. The utility of the updates is measured through a function of their age-of-information (AoI), which assesses their freshness. Correlated with the status updates is another process that needs to be kept private from the destination. Privacy is measured through a leakage function that depends on the amount and time of the status updates received: stale updates are more private than fresh ones. Different from most of the current AoI literature, a post-sampling waiting time is introduced in order to provide a privacy cover at the expense of AoI. More importantly, it is also shown that, depending on the leakage budget and the channel statistics, it can be useful to retransmit stale status updates following erasure events without resampling fresh ones.

Equations

$$T_{j,1}$$

$$T_{j,k+1}$$

$$S_{j+1}$$

$${\delta }_i={\tau }_i+{\beta }_i.$$

$$a(t)=t-\max \left\{{\sigma }_i:{\delta }_i\le t\right\}.$$

$$-g\left(a(t)\right).$$

$$\rho \left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t}:Y_t\right),$$

$$\rho \left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t_1}:Y_{t_1}\right)\ge \rho \left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t_2}:Y_{t_2}\right),$$

$$\forall t_1<t_2,\text{s.t. }\left|\{{\delta }_i\le t_1\}\right|=\left|\{{\delta }_i\le t_2\}\right|,$$

$$\mathcal{L}(Y_t\to X_t)=\frac{\text{Var}[Y_t]}{\mathbb{E}[(Y_t-\mathbb{E}[Y_t|X_t]{)}^2]},$$

$$\rho \left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t}:Y_t\right)=\mathcal{L}(Y_t\to X_t)=\frac{1}{1-\frac{{\sigma }_0^2}{{\sigma }_0^2+t}}$$

$$\underset{\{S_j\},\{T_{j,k}\}}{\min }$$

$$\mathbb{E}\left[\underset{t}{\max }\rho \left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t}:Y_t\right)\right]\le \Delta$$

$$(\text{ref}e{q}_{s}mpl-cnstrnt-1)-(\text{ref}e{q}_{s}mpl-cnstrnt-3),$$

$$\rho \left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t}:Y_t\right)$$

$$=\rho \left(a(t)\right).$$

$$\rho \left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t}:Y_t\right)=I\left(\{X_{{\sigma }_i}{\}}_{{\delta }_i\le t};Y_t\right)$$

$$=\frac{1}{2}\log \left(\frac{\frac{{\sigma }^2}{2\theta }+{\sigma }_0^2}{\frac{{\sigma }^2}{2\theta }\left(1-e^{-2\theta a(t)}\right)+{\sigma }_0^2}\right),$$

$$W_{i,1}\triangleq \min \left\{S_j:S_j\ge {\delta }_{i-1}\right\}-{\delta }_{i-1}.$$

$$Z_{i,1}^1\triangleq \min \left\{T_{j,1}:T_{j,1}\ge {\delta }_{i-1}\right\}-\left({\delta }_{i-1}+W_{i,1}\right).$$

$$Z_{i,1}^k\triangleq \min \left\{T_{j,1}:T_{j,1}\ge {\delta }_{i-1}+\sum _{l=1}^{k-1}{Z}_{i,1}^l+b_{i,1}^l\right\}$$

$$-\left({\delta }_{i-1}+W_{i,1}+\sum _{l=1}^{k-1}{Z}_{i,1}^l+b_{i,1}^l\right),1\le k\le {\kappa }_{i,1},$$

$$M_{i,1}\triangleq {\delta }_{i-1}+W_{i,1}+\sum _{k=1}^{{\kappa }_{i,1}}{Z}_{i,1}^k+b_{i,1}^k$$

$$W_{i,2}\triangleq \min \left\{S_j:S_j\ge M_{i,1}\right\}-M_{i,1}.$$

$$W_{i,r}=$$

$$M_{i,r}=$$

$$Z_{i,r}^k=$$

$$-\left(M_{i,r-1}+W_{i,r}+\sum _{l=1}^{k-1}{Z}_{i,r}^l+b_{i,r}^l\right),k\le {\kappa }_{i,r},$$

$$L_i={\delta }_i-{\delta }_{i-1}=$$

$$+W_{i,R_i}+\sum _{k=1}^{{\psi }_i}{Z}_{i,R_i}^k+b_{i,R_i}^k,$$

$$a\left({\delta }_i\right)=\sum _{k=1}^{{\psi }_i}{Z}_{i,R_i}^k+b_{i,R_i}^k.$$

$${\kappa }_{i,r}=K,\forall i,r.$$

$$\underset{\{W_{i,r}\ge 0\},\{Z_{i,r}^k\ge 0\},K\in {\mathbb{Z}}_{++}}{\min }$$

$$\mathbb{E}\left[\rho \left(\sum _{k=1}^{{\psi }_i}{Z}_{i,R_i}^k+b_{i,R_i}^k\right)\right]\le \Delta .$$

$$W_i\triangleq \sum _{r=1}^{R_i}{W}_{i,r},$$

$$Z_{i,r}\triangleq \sum _{k=1}^K{Z}_{i,r}^k,1\le r\le R_i-1,Z_{i,R_i}\triangleq \sum _{k=1}^{{\psi }_i}{Z}_{i,r}^k,$$

$$W_i\equiv w\left(Z_{i-1,R_{i-1}}+\sum _{k=1}^{{\psi }_{i-1}}{b}_{i-1,R_{i-1}}^k\right).$$

Full text

I Introduction

Providing fresh status updates to destinations is crucial for timely decision-making in various applications, including smart city, e-Health, and digital twins, to name a few. At the same time, with the vast connectivity and correlation between data sources, some information may need to be kept private from curious destinations while providing them with the useful data they need. In this paper, we consider the interplay between utility and privacy of status updates through the lens of time.

Data freshness is quantified by the age-of-information (AoI), defined as the time elapsed since the latest useful piece of received data has been generated [1]. In this paper, the utility of status updates is measured through a function acting on their AoI. Such function may represent the estimation mean square error [2, 3], under some assumptions on the underlying process being updated. Privacy, on the other hand, is measured through a function that depends on the relationship between the amount of data received so far and the process to be kept private. We focus on scenarios in which the privacy leakage is at its peak when status updates are most fresh. Thereby, a tension arises between data freshness and data privacy.

We study a continuous-time status updating system in which a source-destination pair are communicating through an erasure channel. The freshness of data is controlled by pre-sampling waiting times [4], while the privacy is maintained by post-sampling waiting times. The post-sampling waiting times are carefully designed to deliver moderately fresh updates; these are updates that are fresh enough to provide utility, yet stale enough to provide privacy. A main pillar in our work is that we allow the source to retransmit old samples following erasures without resampling fresh ones. Specifically, we study the following question here:

how many retransmissions are to be allowed before the sample becomes too stale and useless?

We carefully provide an answer to that question that depends on the privacy leakage budget and the channel statistics such that the long-term average utility is maximized.

Related works. A number of works in the literature study the relationship between AoI and privacy. Our previous work [5] considers an information-theoretic private information retrieval problem with AoI guarantees. The work in [6] studies differential privacy metrics that depend on AoI. Reference [7] is closely-related to our work. It considers the privacy-AoI tradeoff in discrete-time systems, and designs post-sample waiting policies for when to release updates in queuing systems in order to control the privacy leakage. Different from [7], we consider a continuous-time system, with erasures, and jointly design waiting times and the number of retransmissions to balance AoI with leakage.

II System Model and Objective

Consider a stochastic process $\{X_{t}\}$ that represents a time-varying status to be conveyed to a destination. Such process represents a user’s status over time, e.g., home electric usage. Samples from this process are generated at will, and are sent through a channel that introduces random delays and erasures. Specifically, the $j$th sample is generated at time $S_{j}$, transmitted for the first time at $T_{j,1}$, and takes $b_{j,1}$ time units to traverse through the channel, denoted the channel busy time. After that, the sample is still prune to erasure with probability $\epsilon$, whence the sample may be retransmitted at time $T_{j,2}$, incurring $b_{j,2}$ channel busy time, and the process repeats. In general, the $j$th sample may be (re)transmitted $k_{j}$ times until successful reception. In case the $k_{j}$th attempt fails, the sample is discarded and the process restarts with a fresh sample $j+1$. Observe that $k_{j}=1$ means that the sample is transmitted only once. We now have the following constraints:

[TABLE]

Channel busy times, $b_{j,k}$’s, are independent and identically distributed (i.i.d.). Similarly, erasure events are i.i.d., and are independent from $\{X_{t}\}$ and $b_{j,k}$’s.

A successfully-received sample is denoted an update. Let $\sigma_{i}$, $\tau_{i}$ and $\beta_{i}$ denote the sampling time of the $i$th update, its transmission time, and the channel busy time it encounters, respectively. It follows that $\left\{\sigma_{i}\right\}\subseteq\{S_{j}\}$, $\left\{\tau_{i}\right\}\subseteq\{T_{j,k}\}$ and $\left\{\beta_{i}\right\}\subseteq\{b_{j,k}\}$. The $i$th update is delivered at time

[TABLE]

See Fig. 1 for an example time line including all the variables introduced so far. At the destination, the age-of-information (AoI) of the process $\{X_{t}\}$ at time $t$ is defined as

[TABLE]

We measure the utility of the status updates through a general increasing age-penalty functional $g(\cdot)$ that acts upon the AoI process $a(t)$. Specifically, the instantaneous utility of the updates at time $t$ is given by

[TABLE]

Therefore, updates are more useful when their AoI is small. Observe that the AoI drops right after delivery times. We note that measuring utility through AoI is meaningful in estimation and tracking settings, as one can show that the minimum mean square error estimate of Markovian processes is given by an increasing function of the AoI, see, e.g., [2, 3].

Correlated with $\{X_{t}\}$ is another stochastic process $\{Y_{t}\}$ that represents a latent variable that needs to be kept private from the destination. We consider an honest-but-curious destination node that may be interested in getting more information about the user from the updates it conveys. The privacy leakage at time $t$ is governed by the amount of information that the received samples, so far, can reveal about $Y_{t}$, which we capture using the following non-negative function $\rho(\cdot:\cdot)$:

[TABLE]

where $\{X_{\sigma_{i}}\}_{\delta_{i}\leq t}$ denotes all the updates received up to time $t$. For instance, one can adopt the mutual information [8] to measure the privacy leakage, as done in several works [9, 10, 11, 12, 13, 14, 15, 16], or other notions such as $\alpha-Leakage$ in [17, 18], and its generalization, $g-Leakage$ in [19]. We have the following assumption about $\rho$:

[TABLE]

where $|\cdot|$ denotes cardinality. Thus, the leakage decreases over time, as long as no new samples have been received. This also implies that leakage peaks occur right after delivery times. Several situations satisfy the privacy leakage assumption in (II). For instance, consider the information leakage metric to an estimating adversary in [20],

[TABLE]

where the leakage $\mathcal{L}(Y_{t}\rightarrow X_{t})$ signifies the estimating accuracy of the adversary (i.e., $\mathcal{L}(Y_{t}\rightarrow X_{t})\rightarrow\infty$ denotes almost perfect estimation of $Y_{t}$ given $X_{t}$). Considering the estimation setting $X_{t}=Y_{t}+W_{t}$, where $W_{t}$ is a Wiener process with $W_{0}=0$ and $Y_{t}\sim\mathcal{N}(0,\sigma_{0}^{2})$ i.i.d. Gaussian process, then $\mathbb{E}[Y_{t}|X_{t}]=\frac{\sigma_{0}^{2}}{\sigma_{0}^{2}+t}X_{t}$,. The estimation leakage is given by:

[TABLE]

Hence, $\mathcal{L}(Y_{t}\rightarrow X_{t})$ decreases over time. The same arguments hold for the guessing adversary if $Y_{t}$ is picked from a discrete distribution with $\mathcal{L}(Y_{t}\rightarrow X_{t})=\frac{\mathbb{E}[\max_{y\in\mathcal{Y}}\>P(Y_{t}|X_{t})]}{\max_{y\in\mathcal{Y}}\>P(Y_{t})}$. A different example with an Ornstein-Uhlenbeck (OU) process estimation and a mutual information leakage metric can be found in Section III.

From the above, we see a tension between utility and privacy, as noted in previous works [9, 10, 11, 12, 14, 16, 18, 21]: reducing AoI increases the leakage, and vice versa.

Our goal is to maximize the utility of the updates, while preserving privacy. Specifically, we wish to design the sampling times $\{S_{j}\}$ and transmission times $\{T_{i,j}\}$ such that the long-term average age-penalty is minimized, subject to an upper bound on the average maximum privacy leakage:

[TABLE]

where $\Delta\geq 0$ denotes the leakage budget, and $\mathbb{E}\left[\cdot\right]$ denotes the expectation over the random variables involved.

For $\Delta=\infty$, problem (II) reduces to minimizing an AoI functional, and hence it would be optimal to set $T_{j,1}=S_{j}$ (first transmission times are the same as sampling times) and $k_{j}=1$ (only one transmission attempt per sample), $\forall j$. The reason behind these is obvious: there is no need to keep a fresh sample waiting idly after being generated as this will only hurt the AoI, and retransmitting an older sample is worse than discarding it and starting fresh. We note that this has been the typical scenario in most AoI literature that do not consider a sampling constraint budget.

Now for $\Delta<\infty$, it may be beneficial to set $T_{j,1}>S_{j}$. This would relatively increase the AoI of the received update, but at the same time would decrease the privacy leakage. The reason follows from the assumption in (II); the peak leakage occurs at delivery times, and we need to make it no larger than $\Delta$, on average. Following the same rationale, it may also be beneficial to retransmit the same sample in case of a failure since a fresher sample would lead to a relatively lower AoI, and hence a higher privacy leakage, when delivered.

We characterize the solution of (II) in the remainder of this paper. In particular, we discuss when to acquire a new sample, when to transmit it, and how many times it should be retransmitted so as to keep the information about $\{X_{t}\}$ fresh and that about $\{Y_{t}\}$ private.

III Problem Reformulation:

Waiting Times and Stationary Policies

In this section, we focus on processes in which the privacy leakage reduces, with a slight abuse of notation, to

[TABLE]

Thus, according to our assumption on $\rho$, the privacy leakage is a decreasing function of AoI. For instance, consider an OU process $\{X_{t}\}$ with parameters $\sigma^{2}$ and $\theta$ [22], and set $Y_{t}=X_{t}+N_{t}$ with $N_{t}\sim\mathcal{N}\left(0,\sigma_{0}^{2}\right)$ being i.i.d. noise. Further, let the leakage function $\rho$ be given by the mutual information. One can show that [8]

[TABLE]

which is a decreasing function of $a(t)$ as required.

We now reformulate the optimization problem in (II) in terms of waiting times, as opposed to sampling and transmission times. Specifically, we denote by an epoch the time elapsed in between two successful updates: the $i$th epoch extends from $\delta_{i-1}$ until $\delta_{i}$. We now define the first pre-sampling waiting time in the $i$th epoch as

[TABLE]

That is, $W_{i,1}$ is the waiting time at the beginning of epoch $i$ before acquiring the first sample in it. Next, we define the first post-sampling waiting time following the acquisition of the first sample in the $i$th epoch as

[TABLE]

We now (re)denote by $b^{k}_{i,1}$ the channel busy time of the first sample’s $k$th transmission attempt in the $i$th epoch. Therefore, we have the post-sampling waiting time sequence given by

[TABLE]

where $\kappa_{i,1}$ now denotes the maximum number of transmission attempts for the first sample in the $i$th epoch. For simplicity of presentation, let us define

[TABLE]

as the maximum time allocated to the transmission attempts of the first sample in the $i$th epoch. In case the first sample is unsuccessful after its last transmission attempt, we define the second pre-sampling waiting time as

[TABLE]

This is then followed by a post-sampling waiting time sequence $\{Z^{k}_{i,2}\}$ given exactly as in (15) and (III) after replacing $\delta_{i-1}$, $W_{i,1}$ and $\kappa_{i,1}$ by $M_{i,1}$, $W_{i,2}$ and $\kappa_{i,2}$, respectively.

In general, the pre- and post-sampling waiting time sequences in the $i$th epoch will be given as follows:

[TABLE]

with $r\geq 1$ and $M_{i,0}\triangleq\delta_{i-1}$. The $i$th epoch ends whenever a transmission attempt is successful, which defines $\delta_{i}$ and the start of the next epoch $i+1$. The length of the $i$th epoch is

[TABLE]

where $R_{i}$ is the number of samples generated in the $i$th epoch, and $\psi_{i}$ denotes the number of attempts needed for the $R_{i}$th sample to be delivered. Clearly, $\psi_{i}\leq\kappa_{i,R_{i}}$. Observe that the AoI at the start of epoch $i+1$ is given by

[TABLE]

We focus on stationary policies in which the waiting times have the same distribution across epochs. We also fix

[TABLE]

Problem (II) now reduces to one over a single epoch:

[TABLE]

We now have the following lemma:

Lemma 1

In problem (III), it is optimal to perform pre-sampling waiting only at the beginning of an epoch. Likewise, it is optimal to perform post-sampling waiting only once per sample following each sampling time.

**Proof: ** Observe that the epoch length in (III) only depends on the aggregate sum of the pre-sampling waiting times. One can then define the aggregate pre-sampling waiting time

[TABLE]

and optimize that instead, which does not change the value of the optimal solution. Similarly, one can also define aggregate post-sampling waiting times

[TABLE]

and optimize those instead.  $\blacksquare$

Next, we focus on deterministic waiting policies in which the pre-sampling waiting time $W_{i}$ is a deterministic function of the starting AoI of the $i$th epoch:

[TABLE]

We note that stationary deterministic waiting policies are known to be optimal under i.i.d. channel settings [4]. By Lemma 1, and under stationary deterministic waiting policies, the $i$th epoch length is now given by

[TABLE]

and the optimization problem finally becomes

[TABLE]

In the sequel, we present solutions to problem (III) first for the case without errors, followed by that with errors.

IV The Case Without Errors: $\epsilon=0$

We analyze problem (III) for error-free transmissions in this section. Our structural insights drawn from the solution of this scenario will serve as a building block for the scenario with channel errors in the following section. Now, for $\epsilon=0$, we have $K=1$ (no retransmissions are needed), $R_{i}=1,~{}\forall i$ and $\psi_{i}=1,~{}\forall i$. Hence, we drop the $r$ subscript and $k$ superscript in $Z_{i,r}$ and $b^{k}_{i,r}$, and re-evaluate the epoch length in (III) as

[TABLE]

Problem (III) then reduces to

[TABLE]

Lemma 2

The optimal post-sampling waiting policy of problem (IV) is $Z_{i}^{*}=\zeta,~{}\forall i$, for some constant $\zeta$ given by

[TABLE]

where $\xi(\Delta)$ is the unique solution of $\mathbb{E}\left[\rho\left(\xi(\Delta)+b_{i}\right)\right]=\Delta$.

**Proof: ** We first argue that $Z_{i}$ cannot depend on $Z_{j},~{}j\leq i-1$, since the new sample generated in the $i$th epoch leaks information at the beginning of epoch $i+1$ with a value that is independent of previous epochs’ events. Specifically, $Z_{i}$ depends solely on $b_{i}$ (through its distribution). Since $b_{i}$’s are i.i.d., we can conclude that $Z_{i}$’s are also i.i.d.

Next, observe that the post-sampling waiting time $Z_{i}$ can only hurt the AoI. This can readily be shown by a sample path argument; increasing $Z_{i}$ increases the service time of the $i$th sample, and only makes it more stale when received. Now let us fix $Z_{i-1}$. Setting $Z_{i}=0$ would then be AoI-optimal, provided that the privacy constraint is met, i.e., if $\mathbb{E}\left[\rho\left(b_{i}\right)\right]<\Delta$. Otherwise, one should set $Z_{i}$ to the lowest value allowed by the leakage budget. Since $\rho$ is decreasing, such value is given by $\xi(\Delta)$ in (33).

Finally, since $Z_{i}$’s are i.i.d., the above argument shows that they should all be fixed at the same value.  $\blacksquare$

Lemma 2 shows that there can be situations in which the channel busy time provides a natural privacy cover (when $\mathbb{E}\left[\rho\left(b_{i}\right)\right]<\Delta$), and that post-waiting times should only be used when necessary. The lemma also shows that one can define a new channel busy time

[TABLE]

with $\zeta$ given by (33), which is still i.i.d., and optimize the pre-sampling waiting time over $\{\tilde{b}_{i}\}$ as done in the AoI minimization literature. Specifically, the results in, e.g., [23, 3], show that the pre-sampling policy is a threshold policy

[TABLE]

where $\left[\cdot\right]^{+}\triangleq\max\left(\cdot,0\right)$, and the function

[TABLE]

denotes the expected utility by the end of the $i$th epoch when it starts with an AoI value of $t$. Further, the value of $\gamma$ is given by the unique solution of

[TABLE]

which can be found by, e.g., a bisection search [3].

This completes the solution for the setting without errors.

V The Case With Errors: $\epsilon>0$

In this section, we extend the aforementioned solution to the case with channel errors. First, we fix the value of $K$ and evaluate the distributions of the random variables $R_{i}$ and $\psi_{i}$. Observe that a new sample will be generated only if the previous one has $K$ failed transmissions, which occurs with probability $\epsilon^{K}$. It then follows that

[TABLE]

As for the number of transmissions, $\psi_{i}$, needed for sample $R_{i}$ (the final sample) to succeed, we note that $\psi_{i}=k$ in case the $k$th transmission attempt is successful given that a successful transmission occurs in at most $K$ attempts. Thus,

[TABLE]

i.e., $\psi_{i}$ is a truncated $\sim\text{geometric}(1-\epsilon)$ random variable.

Next, following similar arguments as in Lemma 2, one can show that the post-sampling waiting times $Z_{i,r}$’s are all fixed in the optimal solution of problem (III), and are given by (33). Hence, the epoch length in (III) is now proportional to

[TABLE]

This allows us to draw the following insight:

Remark 1

As the privacy leakage budget $\Delta$ decreases, $\zeta$ increases, and hence the value of $R_{i}$ must be relatively small so as to not to make the epoch length too large. This can be achieved by increasing $K$, which controls the distribution of $R_{i}$ and makes it take smaller values with higher probabilities.

The above remark is one fundamental observation in this paper: the number of retransmissions $K$ should be inversely proportional to $\Delta$. Intuitively, higher levels of privacy are naturally achieved when retransmitting stale samples, and therefore making a case for retransmission without resampling.

To get more insight on how the utility behaves as a function of $K$, we focus on the scenario in which $g(x)=x$, together with a zero-pre-sampling waiting policy in which $w(t)=0$. In this case, the starting AoI in the $i$th epoch is given by

[TABLE]

and the $i$th epoch length in (III) reduces to

[TABLE]

Consequently, direct geometrical arguments lead to expressing the utility (long-term average AoI) as

[TABLE]

We start with computing the second moment of $L_{i}$. Since $\left\{b^{k}_{i,r}\right\}$, $R_{i}$ and $\psi_{i}$ are mutually independent, one can write

[TABLE]

One can then show that the second term in (V) is given by

[TABLE]

while the first term in (V) can be expressed as

[TABLE]

where the last term follows by iterated expectations. Focusing on the second term above, one can expand it as follows:

[TABLE]

Substituting (49) in (V), and then (V) and (45) in (V), we get an expression for the second moment of $L_{i}$ in terms of the first and second moments of $R_{i}$ and $\psi_{i}$. These latter moments are directly computable from (38) and (39) as

[TABLE]

Finally, observe that the remaining terms in (43) are merely the first moments of $R_{i}$ and $\psi_{i}$ computed above. We now have a closed-form expression of the utility in terms of the number of retransmissions $K$, and the privacy leakage budget $\Delta$ (embedded in the value of $\zeta$).

Next, we discuss how to choose the optimal $K$.

VI Optimal Number of Retransmissions

We evaluate the optimal number of retransmissions $K^{*}$ for a system with $b_{i}\sim\exp(\lambda)$. For the privacy leakage function, we consider the OU process example considered in Section III ($\rho$ is given by (13)). In Fig. 2, we plot the utility versus $K$ for different values of error probability $\epsilon$. In the top figure, we consider a leakage budget of $\Delta=0.2$, for which one can show by (33) that $\zeta=0.122$. In the bottom figure, we consider $\Delta=0.15$, for which $\zeta=0.24$. In both cases, $\lambda=10$. Evidently, the utility in the bottom figure is worse (higher AoI) since the leakage budget is tighter. Two further observations can be drawn. First, the optimal $K^{*}$ (circled in red) increases with $\epsilon$ for fixed $\zeta$. The intuition behind this is that as $\epsilon$ increases, a sample takes a relatively longer time to be successfully delivered. Hence, if one resamples often in this case (i.e., if $K$ is small), the sample will incur even more time due to the extra post-sampling waiting $\zeta$ that has to be added. The second observation is that the optimal $K^{*}$ increases with $\zeta$ for fixed $\epsilon$. This is also intuitive since for larger $\zeta$ the leakage budget is tighter, and hence one has to retransmit the same sample for longer times to preserve privacy.

Next, we fix $\Delta=0.2$ (i.e., $\zeta=0.122$) and vary the busy time statistic, $\lambda$. For $\lambda=1$ (slower channel) we get $K^{*}=1$ for all values of $\epsilon$ in Fig. 2. While for $\lambda=20$ (faster channel), we get $K^{*}=[4,4,6,10]$, i.e., $K^{*}$ increases relative to the values in Fig. 2. This is mainly because the channel naturally adds a privacy coverage when it is slow, and requires more protection by retranmissions when it is fast.

VII Conclusion

A freshness-privacy tradeoff has been considered for a source-destination pair communicating through an erasure channel. It has been shown that carefully designing post-sampling waiting times, together with the number of retransmissions of unsuccessful samples can provide useful status updates while maintaining desired levels of privacy.