Dynamics-Based Algorithm-Level Privacy Preservation for Push-Sum Average Consensus

Several approaches have been available to tackle the growing privacy concerns in average consensus literature. One of the mostly widespread non-encryption privacy-preserving techniques is differential privacy [14], which essentially injects the uncorrelated noise to the transmitted state information. This strategy has already been applied in [15, 16, 17, 18, 19]. However, such approaches cannot achieve exact average consensus owing to its inherent privacy-accuracy compromise. This makes differentially private approaches unpalatable for sensor networks and cyber-physical systems with high requirements for consensus accuracy. To ensure computational accuracy, several improvement efforts were developed in [20, 21, 22], which focus on the strategic addition of correlated noise to the transmitted information, as opposed to the uncorrelated noise typically utilized in differential privacy. Another stand of interest is observability-based privacy-preserving approaches [23, 24, 25], where the privacy is guaranteed by minimizing the observation information of a certain agent. However, both the correlated-noise based and the observability-based approaches are vulnerable to external eavesdroppers who have the ability to wiretap all communication channels.

Note that the above mentioned approaches are only valid for undirected and balanced networks. In real-world scenarios, communication among agents is usually directed and unbalanced. For example, broadcasting at different power levels, the communication activity corresponds to a directed and unbalanced networks. To preserve privacy of nodes interacting on an unbalanced directed network, the authors in [26, 27, 28, 29] presented a series of encryption-based approaches by utilizing the homomorphic encryption techniques. However, this type of approaches requires substantial computational and communication overhead, which is unfriendly to resource-limited systems. Recently, state-decomposition based approaches [30, 31] have been favored by researchers. The idea of such approaches is to divide the states of agents into two sub-states with one containing insignificant information for communication with other agents and the other containing sensitive information only for internal information exchange. Another extension of privacy-preserving consensus is dynamics-based approaches [32, 33, 34, 35], which is also the focus of this work. An important benefit of such approaches is that no trade-off exists between privacy and consensus performances, and they are easy to implement in conjunction with techniques like homomorphic encryption, differential privacy, etc. In contrast to state-decomposition strategy, dynamics-based approaches have a simpler structure and seem easier to much understand and implement. Note that some of the above privacy-preserving strategies have also been recently applied in decentralized learning literature [36, 37, 38, 39, 40, 41, 42].

In this paper, our work contributes to enrich the dynamic-based privacy-preserving methods over unbalanced directed networks. Specifically, the contributions contain the points listed next.

1. i)

   Based on the conventional push-sum structure, we design a novel push-sum average consensus method enabling privacy preservation. Specifically, during the initial several iterations, we ensure privacy preservation by carefully embedding randomness in mixing weights to confuse communications and introducing an extra auxiliary parameter to mask the state-updated dynamics. As well, to ensure consensus accuracy, exploiting the intrinsic robustness of consensus dynamics to cope with uncertain changes in information exchanges, we carefully redesign the push-sum protocol so that the “total mass” of the system is invariant in the presence of embedded randomness.

2. ii)

   We provide a formal and rigorous analysis of convergence rate. Specifically, our analysis consists two parts. One is to analyze the consensus performance of the initial several iterations with randomness embedded, and the other is to analyze that of remaining randomness-free dynamics, which has the same structure as the conventional push-sum method [6, 8, 9]. Our analysis exploits the properties of the mixing matrix product and norm relations to build consensus contractions of each dynamic. The result shows that the designed algorithm attains a linear convergence rate and explicitly captures the effect of mixing matrix and network connectivity structure on convergence rate.

3. iii)

   Relaxing the privacy notion of considering only exact initial values in [22, 43, 44, 45], we present two new privacy notions for honest-but-curious attacks and eavesdropping attacks (see Definition 3), respectively, where the basic idea is that the attacker has an infinite number of uncertainties in the estimation of the initial value through the available information. The privacy notions are more generalized in the context that the attacker is not only unable to determine the exact initial value but also the valid range of the initial value.

Notations: $\mathbb{N}$ and $\mathbb{R}$ are the natural and real number sets, respectively. $\mathbf{0}$, $\mathbf{1}$, and $\mathbf{I}$ represent all-zero vector, all-one vector, and identity matrix, respectively, whose dimensions are clear from context. $\mathbf{A}=[A_{ij}]_{N\times N}$ represents an $N\times N$-dimensional matrix whose $ij$-th element is $A_{ij}$. $[\cdot]^{\top}$ denotes the transpose of $[\cdot]$. The symbol “$\setminus$” stands for set subtraction. The symbol $|\cdot|$ is applied to the set to represent the cardinality and to the scalar value to represent absolute value. The $\ell_{2}$-norm (resp. $\ell_{1}$-norm) is signified by $\lVert\cdot\rVert$ (resp. $\lVert\cdot\rVert_{1}$).

Consider a network consisting of $N$ agents and it is modeled as a digraph $\mathcal{G}=(\mathcal{V},\mathcal{E})$, where $\mathcal{V}=\{1,\cdots,N\}$ is the agent set, and $\mathcal{E}$ is the edge set which comprises of pairs of agents and characterizes the interactions between agents, i.e., agent $i$ affects the dynamics of agent $j$ if a directed line from $i$ to $j$ exists, expressed as $(i,j)\in\mathcal{E}$. Moreover, let $(i,i)\notin\mathcal{E}$ for any $i\in\mathcal{V}$, i.e., no self-loop exists in digraph. Let $\mathcal{N}_{i}^{\text{in}}=\{j|(j,i)\in\mathcal{E}\}$ and $\mathcal{N}_{i}^{\text{out}}=\{j|(i,j)\in\mathcal{E}\}$ be the in-neighbor and out-neighbor sets of agent $i$, respectively. Accordingly, $D_{i}^{\text{in}}=|\mathcal{N}_{i}^{\text{in}}|$ and $D_{i}^{\text{out}}=|\mathcal{N}_{i}^{\text{out}}|$ denote the in-degree and out-degree, respectively. For any $i,j\in\mathcal{V}$, a trail from $i$ to $j$ is a chain of consecutively directed lines. The digraph $\mathcal{G}$ is strongly connected if at least one trail lies between any pair of agents. The associated incidence matrix $\mathbf{R}=[R_{i\varepsilon_{j}}]_{N\times|\mathcal{E}|}$ of $\mathcal{G}$ is given by

One can know that the sum of each column of $\mathbf{R}$ is zero, i.e., $\sum\nolimits_{i=1}^{N}{R_{il}}=0$ for any $l\in[1,|\varepsilon|]$. The mixing matrix $\mathbf{C}=[C_{ij}]_{N\times N}$ associated with $\mathcal{G}$ is defined as: $C_{ji}>0$ if $j\in\mathcal{N}_{i}^{\text{out}}\cup\{i\}$ and $C_{ji}=0$ otherwise.

Regarding the investigation of average consensus, the push-sum algorithm [6, 8, 9] is a well-established protocol, which is summarized in Algorithm 1. All agents simultaneously update two variable states: $x_{i}(k)$ and $y_{i}(k)$, and the sensitive information of agent $i$ is the initial value $x_{i}(0)$. Define $\mathbf{x}(k)=[x_{1}(k),\cdots,x_{N}(k)]^{\top}$, $\mathbf{y}(k)=[y_{1}(k),\cdots,y_{N}(k)]^{\top}$, and $\mathbf{C}=[C_{ij}]_{N\times N}$. We can rewrite (1) and (2) in a compact form as follows:

initialized with $\mathbf{x}(0)=[x_{1}^{0},\cdots,x_{N}^{0}]^{\top}$ and $\mathbf{y}(0)=\mathbf{1}$.

Under Assumption 1, $\mathbf{C}^{k}$ converges to rank-one matrix at an exponential rate [46, 47]. Let $\mathbf{C}^{\infty}$ be the infinite power of matrix $\mathbf{C}$, i.e., $\mathbf{C}^{\infty}=\lim_{k\rightarrow\infty}\,\,\mathbf{C}^{k}$. Applying the Perron-Frobenius theorem [48] gives $\mathbf{C}^{\infty}=\bm{\pi}\mathbf{1}^{\top}$, where $\bm{\pi}=[\pi_{1},\cdots,\pi_{N}]^{\top}$. Recursively calculating (3) and (4) yields:

Then, it follows that

where $[\cdot]_{i}$ means the $i$-th element of $[\cdot]$. Thus, the ratio $z_{i}(k)$ gradually reaches to $\bar{x}^{0}$. More details of the analysis can be found in [6].

We introduce two prevalent attack types, namely, honest-but-curious attacks and eavesdropping attacks. Then, we explain that Algorithm 1 fails to preserve privacy due to the explicit sharing of state variables.

In general, in terms of information leakage, an eavesdropping attack is more devastating than an honest-but-curious attack as it can capture all transmitted information, while the latter can only access the received information. Yet, the latter has the advantage that the initial values $\{x_{j}^{0}\}$ of all honest-but-curious agents $j$ are accessible, which are unavailable to the external eavesdroppers.

For the average consensus, the sensitive information to be protected is the initial value $x_{i}(0)$, $i\in\mathcal{V}$. At the first iteration, agent $i$ will send the computed values $C_{ji}x_{i}(0)$ and $C_{ji}y_{i}(0)$ to all of its out-neighbors $j\in\mathcal{N}_{i}^{\text{out}}$. Then, the initial value $x_{i}(0)$ is uniquely inferable by the honest-but-curious agent $j$ using $x_{i}(0)=\frac{C_{ij}x_{i}(0)}{C_{ij}y_{i}(0)}$ and $y_{i}(0)=1$. Therefore, the honest-but-curious agents are always able to infer the sensitive information of its in-neighbors. Likewise, one can readily check that external eavesdroppers are also able to easily infer sensitive information about all agents. Therefore, the privacy concern is not addressed in the conventional push-sum method. In this work, we try to study the privacy concern and develop a privacy-preserving version of Algorithm 1 to achieve exact average consensus.

Our task is to propose an average consensus algorithm that can achieve exact convergence while guaranteeing privacy security. According to the above discussion, the following two requirements for privacy-preserving push-sum algorithms must be satisfied.

1. i)

   Exact output: After the last iteration of the algorithm, each agent should converge to the average consensus point $\bar{x}^{0}$.

2. ii)

   Privacy preservation: During the entire algorithm implementation, the private information, i.e., the initial value $x_{i}^{0}$, of each legitimate agent $i$ should be preserved against both honest-but-curious and eavesdropping attacks.

In order to respond to the above two requirements, two metrics are required to quantify them.

Output metric: To measure the accuracy of the output, we adopt the consensus error $\lVert\mathbf{z}(k)-\bar{x}^{0}\mathbf{1}\rVert$. The algorithm achieves exact consensus if $\lim_{k\rightarrow\infty}\lVert\mathbf{z}(k)-\bar{x}^{0}\mathbf{1}\rVert=0$. Furthermore, the algorithm is said to be elegant if $\lVert\mathbf{z}(k)-\bar{x}^{0}\mathbf{1}\rVert=\mathcal{O}(\rho^{k})$, $\rho\in(0,1)$.

Privacy metric: For the honest-but-curious attacks, we consider the presence of some honest-but-curious agents $\mathcal{H}$. The accessible information set of $\mathcal{H}$ is represented as $\mathcal{I}_{h}(k)=\{\mathcal{I}_{j}(k)|j\in\mathcal{H}\}$, where $\mathcal{I}_{j}(k)$ represents the information available to agent $j\in\mathcal{H}$ at iteration $k$. Given a moment $k^{\prime}\in\mathbb{N}$, the access information of agents $\mathcal{H}$ in time period $0-k$ is $\mathcal{I}_{h}(0:k^{\prime})=\cup_{0\leq k\leq k^{\prime}}\mathcal{I}_{h}(k)$. For any information sequence $\mathcal{I}_{h}(0:k^{\prime})$, define $\mathcal{S}_{0}^{i}$ as the set of all possible initial values at the legitimate agent $i$, where all initial values leave the information accessed by agents $\mathcal{H}$ unchanged. That is to say, there exist any two initial values $x_{i}^{0},\tilde{x}_{i}^{0}\in\mathcal{S}_{0}^{i}$ with $x_{i}^{0}\neq\tilde{x}_{i}^{0}$ such that $\tilde{\mathcal{I}}_{h}(0:k^{\prime})=\mathcal{I}_{h}(0:k^{\prime})$. The diameter of $\mathcal{S}_{0}^{i}$ is defined as

For the eavesdropping attacks, we consider the presence of an external eavesdropper whose available information is denoted as $\mathcal{I}_{e}(k)$, $k\in\mathbb{N}$. Let $\mathcal{I}_{e}(0:k^{\prime})=\cup_{0\leq k\leq k^{\prime}}\mathcal{I}_{e}(k)$. Similar to the honest-but-curious attacks, we define $\mathcal{S}_{0}$ as the set of all possible initial values for all agents, where all initial values leave the information accessed by an external eavesdropper unchanged. That is, there exist $\mathbf{x}(0),\mathbf{\tilde{x}}(0)\in\mathcal{S}_{0}$ with $\mathbf{x}(0)\neq\mathbf{\tilde{x}}(0)$ such that $\mathcal{I}_{e}(k)=\tilde{\mathcal{I}}_{e}(k)$. In addition, the diameter of $\mathcal{S}_{0}$ is given as

For the honest-but-curious and eavesdropping attacks, we use $\mathbf{D}(\mathcal{S}_{0}^{i})$ for all legitimate agents $i\in\mathcal{V}\setminus\mathcal{H}$ and $\mathbf{D}(\mathcal{S}_{0})$ for all agents to measure the individual privacy and algorithm-level confidentiality, respectively. For more details, see the definition below.

The privacy concept outlined in Definition 4 shares similarities with the uncertainty-based privacy concept presented in [49], which derives inspiration from the $l$-diversity principle [50]. Within the $l$-diversity framework, the variety of any private information is gauged by the number of disparate estimates produced for the information. The higher this diversity, the more ambiguous the associated private information becomes. In our setting, the privacy information is the initial value $x_{i}^{0}$ (resp. $\mathbf{x}(0)$), whose diversity is measured by the diameter $\mathbf{D}(\mathcal{S}_{0}^{i})$ (resp. $\mathbf{D}(\mathcal{S}_{0})$). Larger diameters imply greater uncertainty in the estimation of the initial values.

For the honest-but-curious attacks, we make the following standard assumption.