Modular control under privacy protection: Fundamental trade-offs

Abstract

In privacy-preserving controller design, there is usually a trade-off between the privacy level and control performances, and we show in this paper that this trade-off in particular determines a lower bound on the differential privacy level of the closed-loop system. The control task we consider is reference tracking in a plug-and-play setting, and the plant under control is a networked system of modules, each of which has no access to the models of the others. For a module, we first identify the whole set of tracking local controllers based on the Youla parametrization. At the same time, each module, to protect its own privacy, tries to prevent the other interconnected modules to identify its private information; in this context, for example, the tracking reference signal (say, the target production amount if each module is a workshop in a factory) can be viewed as a piece of private information. Each module can tune the parameters of its local controller to increase the privacy level of its reference signal. However, if the distribution of Laplace (resp. uniform) noise is fixed, the differential privacy level of a Laplace (resp. uniform) mechanism cannot be further improved from a ceiling value no matter how one tunes parameters. In other words, for modular systems under local reference tracking control, there is a lower bound on the differential privacy level.