Differentially private average consensus: Obstructions, trade-offs, and optimal algorithm design

Abstract

This paper studies the multi-agent average consensus problem under the requirement of differential privacy of the agents' initial states against an adversary that has access to all the messages. We first establish that a differentially private consensus algorithm cannot guarantee convergence of the agents' states to the exact average in distribution, which in turn implies the same impossibility for other stronger notions of convergence. This result motivates our design of a novel differentially private Laplacian consensus algorithm in which agents linearly perturb their state-transition and message-generating functions with exponentially decaying Laplace noise. We prove that our algorithm converges almost surely to an unbiased estimate of the average of agents' initial states, compute the exponential mean-square rate of convergence, and formally characterize its differential privacy properties. We show that the optimal choice of our design parameters (with respect to the variance of the convergence point around the exact average) corresponds to a one-shot perturbation of initial states and compare our design with various counterparts from the literature. Simulations illustrate our results.

Privacy preservation in a continuous-time static average consensus algorithm over directed graphs

“…The proof of this lemma is given in the appendix. Lemma 4.2 (Privacy preservation for i ∈ V via a concealed β i ): Consider the modified static average consensus algorithm (3) with a set of locally chosen admissible perturbation signals {f j , g j } N j=1 over a strongly connected and weightbalanced digraph G. Let the knowledge set of the malicious agent 1 include the form of conditions (5) and (6), and also the parameter α that the agents agreed to use. Let agent 1 be the in-neighbor of agent i ∈ V and all the out-neighbors of agent i, i.e., agent 1 knows {y j (t)} j∈N i out+i , t ∈ R ≥0 .…”

“…This way the reference value of the agents is guaranteed to stay private but the algorithm does not necessarily converge to the anticipated value. Similarly, in recent years, Nozari, Tallapragada and Cortes [6] also relied on adding zero mean noises to protect the privacy of the agents. However, they develop their noises according to a framework defined based on the concept of differential privacy, which is initially developed in the data science literature [7]- [10].…”

“…However, they develop their noises according to a framework defined based on the concept of differential privacy, which is initially developed in the data science literature [7]- [10]. In this framework, [6] characterizes the convergence degradation and proposes an optimal noise in order to keep a level of privacy to the agents while minimizing the rate of convergence deterioration. To eliminate deviation from desired convergence point, Manitara and Hadjicostis [11] proposed to add a zero sum finite sequence of noises to the transmitted signal of each agent, and Mo and Murray [12] proposed to add a zero sum infinite sequences.…”

Statistical Privacy in Distributed Average Consensus on Bounded Real Inputs

“…Several proposals [6], [8], [9] achieve differential privacy by having agents obscure their intermediate states (or values) by adding locally generated noise in a particular synchronous distributed average consensus protocol. Adding such local noises induces a loss in accuracy [9], [16] and there is an inherent trade-off between privacy and the achievable accuracy (agents are only able to compute an approximation to the exact average value). Schemes in [8], [7] iteratively cancel the noise added over time to preserve the accuracy of the average of all inputs.…”

“…We note that some of the above solutions [6], [7], [8], [9] require synchronous execution of the agents, whereas our privacy protocol is asynchronous (refer Section III). Moreover, this is the first paper, to the best of authors' knowledge, to propose a privacy protocol for distributed average consensus on bounded real-value inputs where bounds are apriori known.…”