---
abstract: 'Smart Meters (SMs) are an important component of smart electrical grids, but they have also generated serious concerns about privacy data of consumers.  In this paper, we present a general formulation of the privacy-preserving problem in SMs from an information-theoretic perspective.  In order to capture the casual time series structure of the power measurements, we employ Directed Information (DI) as an adequate measure of privacy.  On the other hand, to cope with a variety of potential applications of SMs data, we study different distortion measures along with the standard squared-error distortion.  This formulation leads to a quite general training objective (or loss) which is optimized under a deep learning adversarial framework where two Recurrent Neural Networks (RNNs), referred to as the releaser and the attacker, are trained with opposite goals.  An exhaustive empirical study is then performed to validate the proposed approach for different privacy problems in three actual data sets.  Finally, we study the impact of the data mismatch problem, which occurs when the releaser and the attacker have different training data sets and show that privacy may not require a large level of distortion in real-world scenarios.' 
author:
- 'Mohammadhadi Shateri, Francisco Messina, Pablo Piantanida, Fabrice Labeau [^1] [^2][^3]'
bibliography:
- 'paper.bib'
title: 'Deep Recurrent Adversarial Learning for Privacy-Preserving Smart Meter Data Release'
---

Privacy-preserving mechanism, Deep learning, Adversarial training, Time series data, Recurrent Neural Networks, Long-Short Term Memory (LSTM) cell, Directed information, Privacy-utility trade-off, Smart meters privacy. 

Introduction
============

Meters (SMs) are a cornerstone for the development of smart electrical grids.  These devices are able to report power consumption measurements of a house to an utility provider at every hour or even at every few minutes.  This feature generates a considerably amount of useful data which enables several applications in almost real-time such as power quality monitoring, timely fault detection, demand response, energy theft prevention, etc.  [@alahakoon2016; @wang2019; @depuru2011].  However, this fine-grained power consumption monitoring poses a thread to consumers privacy.  In fact, it has been shown that simple algorithms, known in general as NonIntrusive Load Monitoring (NILM) methods, can readily be used to infer the types of appliances being used at a home in a given time, even without any prior knowledge about the household [@molina2010].  Since these features are highly correlated with the presence of people at the dwelling and their personal habits [@giaconi2018privacy], this induces serious privacy concerns which can have an impact on the acceptance and deployment pace of SMs [@mckenna2012; @cuijpers2013].  The natural challenge raised here is: how privacy can be enhanced while preserving the utility of the data?  Although this problem has been widely studied in the context of data science [@jain2016], the time series structure of SMs data requires a particular treatment [@asghar2017].  For further details the reader may be referred to [@giaconi2018privacy]. 

Simple approaches for privacy-preserving in the context of SMs include data aggregation and encryption [@li2010; @rottondi2013], the use of pseudonyms rather than the real identities of users [@efthymiou2010smart], downsampling of the data [@mashima2015authenticated; @eibl2015] and random noise addition [@barbosa2016].  However, these methods often restrict the potential applications of the SMs data.  For instance, domwnsampling of the data may incur in time delays to detect critical events, while data aggregation degrades the positioning and accuracy of the power measurements. 

A formal approach to the privacy problem has been presented in [@sankar2013smart] from an information-theoretic persepctive, where it has been proposed to assess privacy by the Mutual Information (MI) between the sensitive and released variables.  More specifically, the authors model the power measurements of SMs with a hidden Markov model in which the distribution of the measurements is controlled by the state of the appliances, and for each particular state the distribution of power consumption is modeled as Gaussian.  This model is then used to obtain the privacy-utility trade-off using tools from rate-distortion theory [@cover2006elements].  Although this approach is very appealing it has s two important limitations for its application to real-time scenarios with actual data.  First, the privacy measure does not capture the causal time dependence and processing of the data, which is an essential feature of the problem.  Second, the Gaussian model is quite restrictive in practice.  The first limitation has been addressed in [@erdogdu2015], where it is shown that for, an online scenario, the privacy measure should be based on Directed Information (DI) [@massey1990causality], which is the privacy measure that we will adopt in the present work.  We will further address the second limitation by taking a data-based approach in which no explicit constraints on the distributions or statistics of the involved variables are assumed. 

A more sophisticated approach considers the use of Rechargeable Batteries (RBs) and Renewable Energy Sources (RES) in homes in order to modify the actual energy consumption of users with the goal of hiding the sensitive information [@kalogridis2010; @tan2013; @acs2012; @zhao2014achieving; @li2018information; @giaconi2018; @erdemir2019privacy].  Many of these works borrow ideas from the well-known principle of differential privacy [@dwork2008], which seems to be better suited for fixed databases than for time series data [@asghar2017].  The main motivation to introduce the use of physical resources into the privacy problem comes from the observation that this approach does not require any distortion in the actual SMs measurements, which means that there is no loss in terms of utility.  However, the incorporation of physical resources does not only make the problem more complex and limited in scope, but can also generate a significant cost to users due to the faster wear of the RBs as a consequence of the increased charging/discharging rate [@giaconi2018privacy].  On the other hand, the required level of distortion for a specific privacy goal in a realistic scenario in which the attacker threatening privacy has only partial information is still an open question.  Thus, the need and convenience of these solutions is questionable.  As a matter of fact, in this work, we show that under some conditions the privacy-utility trade-off may be much less severe than expected.  However, it is important to note that these approaches are complementary to the ones based on distorting the power measurements rather than alternative.  Thus, for simplicity, we assume that no RBs and/or RESs are available and distortion is the only mean to achieve a desired privacy level. 

The use of neural networks to model an attacker has been considered in [@wang2017].  However, a more powerful formulation of the problem assumes that both the releaser (or privatizer) and the attacker are deep neural networks (DNNs) that are trained simultaneously based on a minimax game, an idea that is inspired by the well-known Generative Adversarial Networks (GANs) [@goodfellow2014].  This concept can be referred to as Generative Adversarial Privacy (GAP) [@huang2018] and is the basis for our approach.  It should be mentioned that the concept of GAP has been studied for different applications related to images [@tripathy2019; @feutry2018] but, to the best of our knowledge, not in the context of SMs time series data.  In these works, the authors consider i.i.d.  data and deep feed-forward neural networks for the releaser and attacker, while in this paper we consider deep Recurrent Neural Networks (RNNs) to capture and exploit the time correlation.  The idea of time-series generation with an adversarial approach has been considered in [@esteban2018] for medical data based in the principle of differential privacy.  As we mentioned previously, our approach is instead based on the DI, an information-theoretic measure of privacy. 

In summary, the main contributions of this paper are the following:

(i) We applied DI as a privacy measure similarly to [@erdogdu2015].  However, unlike this and previous works, we impose no explicit assumptions on the generating model of the power measurements, but take a more versatile data-driven approach. 

(ii) We study different possible distortion measures which provide more flexibility to control the specific features to be preserved in the released signals that is, the relevant features for the target applications. 

(iii) For the sake of computational tractability, we propose a loss function for training the privacy-preserving releaser based on an upper bound to DI.  Then, considering an attacker that minimizes a standard cross-entropy loss, we show that this leads to an adversarial framework based on two RNNs to train the releaser. 

(iv) We perform an extensive statistical study with actual data from three different data sets and frameworks motivated by real-world theaters to characterize the utility-privacy trade-offs and the nature of the distortion generated by the releaser network. 

(v) We investigate the data mismatch problem in the context of SMs privacy, which occurs when the data available to the attacker is not the same as the one used for training the releaser mechanism, and show that it has an important impact on the privacy-utility trade-off. 

The rest of the paper is organized as follows.  In Section \[sec:formulation\], we present the theoretical formulation of the problem that motivates the loss functions for the releaser and attacker.  Then, in Section \[sec:model\], the privacy-preserving adversarial framework is introduced along with the training algorithm.  Extensive results are presented and discussed in Section \[sec:results\].  Finally, some concluding remarks are presented in Section \[sec:conclusion\]. 

Notation and conventions {#notation-and-conventions .unnumbered}
------------------------

-   $X^T = (X_1, \ldots, X_T)$ : A sequence of random variables, or a time series, of length $T$;

-   $x^T = (x_1, x_2, \ldots, x_T)$: A realization of $X^T$;

-   $x^{(i)T} = (x^{(i)}_1, x^{(i)}_2, \ldots, x^{(i)}_T)$: The $i^{\text{th}}$ sample in a minibatch used for training;

-   $\E[X]$: The expectation of a random variable $X$;

-   $p_X$: The distribution of $X$;

-   $I(X;Y)$: Mutual information between random variables $X$ and $Y$ [@cover2006elements];

-   $H(X)$: Entropy of random variable $X$;

-   $I(X^T \to Y^T)$: Directed information between two time series $X^T$ and $Y^T$;

-   $H(X^T||Y^T)$: Causally conditional entropy of $X^T$ given $Y^T$ [@kramer2003];

-   ${X {-\!\!\!\!\minuso\!\!\!\!-}Y {-\!\!\!\!\minuso\!\!\!\!-}Z}$: Markov chain among $X$, $Y$ and $Z$.

Problem Formulation and Training Loss {#sec:formulation}
=====================================

Main definitions
----------------

Consider the private time series $X^T$, the utile process $Y^T$, and the observed signal $W^T$. We assume that $X_t$ takes values on a fixed discrete alphabet $\mathcal{X}$, for each $t \in \{ 1, \ldots, T \}$. A releaser $\mathcal{R}_{\theta}$ (this notation is used to denote that the releaser is controlled by a vector of parameters $\theta$) produces the release process as $Z_t$ based on the observation $W^t$, for each time $t \in \{ 1, \ldots, T \}$, while an attacker $\mathcal{A}_{\phi}$ attempts to infer $X_t$ based on $Z^t$ by finding an approximation of $p_{X^T|Z^T}$, which we shall denote by $p_{\hat{X}^T|Z^T}$. Thus, the Markov chain $(X^t,Y^t) {-\!\!\!\!\minuso\!\!\!\!-}W^t {-\!\!\!\!\minuso\!\!\!\!-}Z^t {-\!\!\!\!\minuso\!\!\!\!-}\hat{X}^t$ holds for all $t \in \{ 1, \ldots, T \}$. In addition, due to causality, the distribution $p_{Z^T\hat{X}^T|W^T}$ can be decomposed as follows: $$p_{Z^T\hat{X}^T|W^T}(z^T,\hat{x}^T|w^T) = \prod_{t=1}^{T} p_{Z_t|W^t}(z_t|w^t) p_{\hat{X}_t|Z^t}(\hat{x}_t|z^t).$$

The goal of the releaser $\mathcal{R}_\theta$ is to minimize the flow of information from the sensitive process $X^T$ to $\hat{X}^T$ while simultaneously keeping the distortion between the release time series $Z^T$ and the useful signal $Y^T$ small.  On the other hand, the goal of the attacker $\mathcal{A}_{\phi}$ (again, this notation is used to denote that the attacker is controlled by a vector of parameters $\phi$) is to learn the optimal decision rule based on the distribution $p_{X_t|Z^t}$, for each $t$, as accurately as possible.  Note that after the approximation $p_{\hat{X}_t|Z^t}$ is obtained, the attacker can estimate the realization $x^T$ corresponding to $z^T$ in an online fashion, by solving the following $T$ problems: $$\underset{\hat{x}_t \in \mathcal{X}}{\text{argmax}} \; p_{\hat{X}_t|Z^t}(\hat{x}_t|z^t), \qquad t \in \{1,\ldots,T\}.$$ Thus, the attacker can be interpreted as an hypothesis test, as stated in [@li2019].  However, in the present case, we consider the more realistic scenario in which the statistical test is suboptimal due to the fact that the attacker has no access to the actual conditional distributions $p_{X_t|Z^t}$ but only to $p_{\hat{X}_t|Z^t}$, i.e., an inference of them.  In order to take into account the causal relation between $X^T$ and $\hat{X}^T$, the flow of information is quantified by DI [@massey1990causality]: $$\label{eqtr1} I\big(X^T\rightarrow \hat{X}^T\big)\triangleq \sum_{t=1}^{T} I(X^t;\hat{X}_t|\hat{X}^{t-1}),$$ where $I(X^t;\hat{X}_t|\hat{X}^{t-1})$ is the conditional mutual information between $X^t$ and $\hat{X}_t$ conditioned on $\hat{X}^{t-1}$[@cover2006elements].  The normalized expected distortion between $Z^T$ and $Y^T$ is defined as: $$\label{Distortion} \mathcal{D}(Z^T,Y^T) \triangleq \frac{\E[d(Z^T,Y^T)]}{T},$$ where $d : \R^T \times \R^T \to \R$ is any distortion function (i.e., a metric on $\R^T$).  To ensure the quality of the release, it is natural to impose the following constraint: $\mathcal{D}(Z^T,Y^T) \le \varepsilon$ for some given $\varepsilon \ge 0$. In previous works, the normalized squared error was considered as a distortion function (e.g., [@sankar2013smart]).  Beside this, other distortion measures can be relevant whithin the framework of SMs.  For instance, demand response programs usually require an accurate knowledge of peak power consumption, so a distortion function closer to the infinity norm would be more meaningful for those particular applications.  Thus, for the sake of generality and to keep the distortion function simple, we propose to use an $\ell_p$ distance: $$\label{eq:p_distortion} d(z^T,y^T) \triangleq \| z^t - y^t \|_p = \left( \sum_{t=1}^T |z_t - y_t|^p \right)^{1/p},$$ where $p \ge 2$ is a fix parameter.  Note that this distortion function contains the squared error case as a particular case for $p = 2$ while it converges to the maximum error between the components of $z^T$ and $y^T$ as $p \to \infty$.

Therefore, the problem of finding an optimal releaser $\mathcal{R}_\theta$ subject to the aforementioned attacker $\mathcal{A}_{\phi}$ and distortion constraint can be formally written as follows: $$\begin{aligned}
 \label{eqtr2} & \underset{\theta}{\text{min}} \; \quad I\left(X^T\rightarrow \hat{X}^T\right), \nonumber \\ & \text{s.t. }  \quad \mathcal{D}(Z^T,Y^T) \le \varepsilon.  \end{aligned}$$ Note that the solution to this optimization problem depends on $p_{\hat{X}^T|Z^T}$, i.e., the conditional distributions that represent the attacker $\mathcal{A}_{\phi}$. Thus, a joint optimization of the releaser $\mathcal{R}_{\theta}$ and the attacker $\mathcal{A}_{\phi}$ is required. 

A novel training loss
---------------------

The optimization problem in can be exploited to motivate an objective function for $\mathcal{R}_\theta$. However, note that the cost of computing DI term is $O(|\mathcal{X}|^T)$, where $|\mathcal{X}|$ is the size of $\mathcal{X}$. Thus, for the sake of tractability, DI will be replaced with the following surrogate upper bound: $$\begin{aligned}
 \label{eqtr5}
I\left(X^T\rightarrow \hat{X}^T\right) & = \sum_{t=1}^{T}\left[H(\hat{X}_t|\hat{X}^{t-1})-H(\hat{X}_t|\hat{X}^{t-1},X^t)\right]
\nonumber \\  &\overset{\text{(i)}}{\leq}\sum_{t=1}^{T}\left[H(\hat{X}_t|\hat{X}^{t-1})-H(\hat{X}_t|\hat{X}^{t-1},X^t,Z^t)\right] \nonumber \\ 
&\overset{\text{(ii)}}{\triangleq} \sum_{t=1}^{T} \left[ H(\hat{X}_t|\hat{X}^{t-1})-H(\hat{X}_t|Z^t)\right]\nonumber \\ 
& \overset{\text{(iii)}}{\leq} T \log|\mathcal{X}| - \sum_{t=1}^{T}H(\hat{X}_t|Z^t)\nonumber  \\
& \overset{\text{(iv)}}{=} \textrm{constant} - H\big(\hat{X}^T \| Z^T \big), \end{aligned}$$ where (i) is due to the fact that conditioning reduces entropy; equality (ii) is due to the Markov chains $X^t {-\!\!\!\!\minuso\!\!\!\!-}Z^t {-\!\!\!\!\minuso\!\!\!\!-}\hat{X}^t$ and $\hat{X}^{t-1} {-\!\!\!\!\minuso\!\!\!\!-}Z^t {-\!\!\!\!\minuso\!\!\!\!-}\hat{X}^t$; (iii) is due to the trivial bound $H(\hat{X}_t|\hat{X}^{t-1}) \le H(\hat{X}_t) \le \log |\mathcal{X}|$; and (iv) follows by the definition of the *causally* conditional entropy  [@kramer2003] and the Markov chain $\hat{X}^{t-1} {-\!\!\!\!\minuso\!\!\!\!-}Z^t {-\!\!\!\!\minuso\!\!\!\!-}\hat{X}^t$. Therefore, the loss function for $\mathcal{R}_\theta$ can be written as: $$\label{eq:releaser_loss} 
\mathcal{L}_{\mathcal{R}}(\theta, \phi,\lambda) =  \mathcal{D}(Z^T,Y^T) - \frac{\lambda}{T} H\big(\hat{X}^T \| Z^T \big),$$ where $\lambda \ge 0$ controls the privacy-utility trade-off and the factor $1/T$ has been introduced for normalization purposes.  It should be noted that, for $\lambda = 0$, the loss function $\mathcal{L}_{\mathcal{R}}(\theta,\phi,\lambda)$ reduces to the expected distortion, being independent from the attacker $\mathcal{A}_{\phi}$. In such scenario, $\mathcal{R}_\theta$ offers no privacy guarantees.  Conversely, for very large values of $\lambda$, the loss function $\mathcal{L}_{\mathcal{R}}(\theta,\phi,\lambda)$ is dominated by the upper bound on DI, so that privacy is the only goal of $\mathcal{R}_\theta$. In this regime, we expect the attacker $\mathcal{A}_{\phi}$ to fail completely to infer $X^T$, i.e., to approach to random guessing performance. 

On the other hand, the attacker $\mathcal{A}_{\phi}$ is a classifier which optimizes the following cross-entropy loss: $$\label{eq:attacker_loss} \mathcal{L}_{\mathcal{A}}(\phi) \triangleq \frac{1}{T} \sum_{t=1}^T \E\left[- \log p_{\hat{X}_t|Z^t}(X_t|Z^t) \right],$$ where the expectation should be understood w.r.t.  $p_{X_tZ^t}$. It is important to note that $$\begin{aligned}
 \label{eq:loss_a_bound} \mathcal{L}_{\mathcal{A}}(\phi) & = \frac{1}{T} \sum_{t=1}^T \E\left[- \log p_{\hat{X}_t|Z^t}(\hat{X}_t|Z^t) \right] + \E\left[ \log \frac{p_{\hat{X}_t|Z^t}(\hat{X}_t|Z^t)}{p_{\hat{X}_t|Z^t}(X_t|Z^t)} \right] \nonumber \\ & \ge \frac{1}{T} H\big(\hat{X}^T \| Z^T \big), \end{aligned}$$ since the second term in is a Kullback-Leibler divergence, which is non-negative.  Thus, by minimizing $\mathcal{L}_{\mathcal{R}}$, the releaser is preventing the attacker from inferring the sensitive process while also minimizing the distortion between the useful and released processes.  This shows that $\mathcal{R}_{\theta}$ and $\mathcal{A}_{\phi}$ are indeed trained in an adversarial fashion.  It should be noted that $\mathcal{A}_{\phi}$ here is an artificial attacker used for training $\mathcal{R}_{\theta}$. Once the training is complete, and $\mathcal{R}_{\theta}$ is fixed, a new attacker should be trained from scratch, using the loss , in order to assess the privacy-utility trade-off in an unbiased way. 

Privacy-Preserving Adversarial Learning {#sec:model}
=======================================

Based on the previous theoretical formulation, an adversarial modeling framework consisting of two RNNs, a releaser $\mathcal{R}_{\theta}$ and an attacker $\mathcal{A}_{\phi}$, is considered (see Fig.  \[had1\]).  Note that independent noise $U^T$ is appended to $W^T$ in order to randomize the released variables $Z^T$, which is a popular approach in privacy-preserving methods.  In addition, the available theoretical results show that, for Gaussian distributions, the optimal release contains such a noise component [@sankar2013smart; @tripathy2017privacy].  For both networks, a LSTM architecture is selected (see Fig.  \[had2\]), which was shown to be successful in several problems dealing with sequences of data (e.g., see [@goodfellow2016] and references therein for more details).  Training in the suggested framework is performed using the Algorithm \[Al1\] which requires $k$ gradient steps to train $\mathcal{A}_\phi$ followed by one gradient step to train $\mathcal{R}_\theta$. It is worth to emphesize that $k$ should be larger than $1$ in order to ensure that $\mathcal{A}_\phi$ represents a strong attacker.  However, if $k$ is too large, this could lead to an overfitting and thus a poor attacker. 

![ Privacy-Preserving framework.  The seed noise $U^T$ is generated from i.i.d.  samples according to a uniform distribution: $U_t \sim U[0,1]$.[]{data-label="had1"}](Model.png){width="0.7\linewidth"}

![ LSTM recurrent network cell diagram.  The cell includes four gating units to control the flow of information.  All the gating units have a sigmoid activation function ($\sigma$) except for the input unit (that uses an hyperbolic tangent activation function ($\tanh$) by default).  The parameters $b,V,W$ are respectively biases, input weights, and recurrent weights.  In the LSTM architecture, the forget gate $f_t = \sigma(b^f + K^fh_{t-1} + V^fw_t)$ uses the output of the previous cell (which is called hidden state $h_{t-1}$) to control the cell state $C_t$ to remove irrelevant information.  On the other hand, the input gate $g_t = \sigma(b^g + K^g h_{t-1} + V^g w_t)$ and input unit adds new information to $C_t$ from the current input.  Finally, the output gate $o_t = \sigma(b^o + K^oh_{t-1} + V^ow_t)$ generates the output of the cell from the current input and cell state.[]{data-label="had2"}](LSTM.png){width="0.7\linewidth"}

**Input:** Data set (which includes sample sequences of useful data $y^T$, sensitive data $x^t$); seed noise samples $u^T$; seed noise dimension $m$; batch size $B$; number of steps to apply to the attacker $k$; gradient clipping value $C$; $\ell_2$ recurrent regularization parameter $\beta$.\
**Output:** Releaser network $\mathcal{R}_\theta$.

Sample minibatch of $B$ examples: $\mathcal{B} = \Big\{w^{(b)T}=\Big(x^{(b)T},y^{(b)T},u^{(b)T}\Big); \; b=1,2,\ldots,B\Big\}$. Compute the gradient of $\mathcal{L}_{\mathcal{A}}(\phi)$, approximated with the minibatch $\mathcal{B}$, w.r.t.  to $\phi$. Update the attacker by applying the RMSprop optimizer with clipping value $C$. 

Sample minibatch of $B$ examples: $\mathcal{B} = \Big\{w^{(b)T}=\Big(x^{(b)T},y^{(b)T},u^{(b)T}\Big); \; b=1,2,\ldots,B\Big\}$. Compute the gradient of $\mathcal{L}_{\mathcal{R}}(\theta,\phi,\lambda)$, approximated with the minibatch $\mathcal{B}$, w.r.t.  to $\theta$. Use $\textrm{Ridge}(L_2)$ recurrent regularization with value $\beta$ and update the releaser by applying RMSprop optimizer with clipping value $C$. 

Results and Discussion {#sec:results}
======================

Description of data sets {#sec:dataset}
------------------------

Three different data sets are considered:

-   The Electricity Consumption & Occupancy (ECO) data set, collected and published by [@beckel2014eco], which includes 1 Hz power consumption measurements and occupancy information of five houses in Swiss over a period of $8$ months.  In this study, we re-sampled the data to have hourly samples. 

-   The Pecan Street data set contains hourly SMs data of houses in Texas, Austin and was collected by Pecan Street Inc. [@street2019dataport].  Pecan Street project is a smart grid demonstration research program which provides electricity, water, natural gas, and solar energy generation measurements for over $1000$ houses in Texas, Austin. 

-   The Low Carbon London (LCL) data set, which includes half-hourly energy consumption for more than $5000$ households over the period $2011-2014$ in London [@LCLdatastore].  Each household is allocated to a CACI Acorn group [@caci1989acorn], which includes three categories: affluent, comfortable and adversity. 

We model the time dependency over each day, so the data sets were reshaped to sample sequences of length $24$ for ECO and Pecan Street (data rate of 1 sample per hour) while sample sequences of length $48$ were used for LCL data set (data rate of 1 sample per half hour).  For the ECO, Pecan Street, and LCL data sets, a total number of $11225$, $9120$, and $19237$ sample sequences were collected, respectively.  The data sets were splitted into train and test sets with a ratio of roughly while $10 \%$ of the training data is used as the validation set.  The network architectures and hyperparameters used for training and test in the different applications are summarized in Table \[tab:hyperparameters\]. 

[width=0.95]{}

   **SMs Application**   ****   ****   ****   ****   ****   ****  
  --------------------- ------ ------ ------ ------ ------ ------ --
                                              128     4      8    
                                              128     5      3    
                                              128     7      3    

\[tab:hyperparameters\]

To assess the distortion with respect to the actual power consumption measurements, we define the Normalized Error (NE) for the different $\ell_p$ distortion functions as follows:$$\text{NE}_p \triangleq \frac{\E\left[ \| Y^T - Z^T \|_p \right]}{\E\left[ \| Y^T \|_p \right]}.$$

$\ell_2$ Distortion {#subsec:L2norm}
-------------------

First, the $\ell_2$ distortion function is considered (i.e., $p = 2$ in ).  In the following subsections, three different privacy applications are studied (one for each of the data sets presented in Section \[sec:dataset\]). 

### Inference of households occupancy {#sec:household_occupancy}

The first practical case of study regarding privacy-preserving in time series data is the concern of inferring presence/absence of residents at home from the total power consumption collected by SMs [@kleiminger2015household; @jia2014human].  For this application, the electricity consumption measurements from the ECO data set are considered as the useful data, while occupancy labels are defined as the private data.  Therefore, in this case, the releaser attempts to minimize a trade-off between the distortion of the total electricity consumption incurred and the probability of inferring the presence of an individual at home from the release signal.  Note from Table \[tab:hyperparameters\] that a stronger attacker composed of 3 LSTM layers is used for the test. 

In Fig.  \[ECOTradeoff\] we show the empirically found privacy-utility trade-off for this application.  Note that by adding the distortion the accuracy of the attacker changes from more than $80 \%$ (no privacy) to $50 \%$ (full privacy), which corresponds to the performance of a random guessing classifier. 

![ Privacy-utility trade-off for house occupancy inference application.  Since in this application the attacker is a binary classifier, the random guessing (balanced) accuracy is 50$\%$. The fitted curve is based on an exponential function and is included only for illustration purposes.[]{data-label="ECOTradeoff"}](ECO_Tradeoff.png){width=".45\linewidth"}

In order to provide more insights about the release mechanism, the Power Spectrum Density (PSD) of the input signal and the PSD of the error signal for three different cases along the privacy-utility trade-off curve of Fig.  \[ECOTradeoff\] are estimated using Welch’s method [@stoica2005spectral].  For each case, we use 10 release signals and average the PSD estimates to reduce the variance of the estimator.  Results are shown in Fig.  \[ECONoise\].  Looking at the PSD of the input signal (useful data), some harmonics are clearly visible.  The PSD of the error signals show that the model controls the trade-off in privacy-utility by modifying the floor noise and the distortion on these harmonics. 

![ PSD of the actual electricity consumption and error signals for the house occupancy inference application.[]{data-label="ECONoise"}](ECO_Noise.png){width="0.65\linewidth"}

It should be mentioned that two stationary tests, the Augmented Dickey-Fuller test [@dickey1979distribution] and the Kwiatkowski, Phillips, Schmidt, and Shin (KPSS) test [@kwiatkowski1992testing], were applied to the data.  This confirmed that there is enough evidence to suggest the data is stationary, thus supporting our PSD analysis. 

### Inference of household identity {#sec:household_identity}

The second practical case of study regarding privacy preservation in SMs measurements is identity recognition from total power consumption of households [@efthymiou2010smart].  It is assumed that both the releaser and the attacker have access to the total power consumption of different households in a region (training data), and then the attacker attempts to determine the identity of a house using the released data obtained from the test data.  Thus, our model aims at generating release data of total power consumption of households in a way that prevents the attacker to perform the identity recognition while keeping distortion on the total power minimized.  For this task, total power consumption of five houses is used.  The empirical privacy-utility trade-off curve obtained for this application is presented in Fig.  \[PEECANTradeoff\].  Comparing Fig.  \[PEECANTradeoff\] with Fig.  \[ECOTradeoff\], we see that a high level of privacy requires a high level of distortion.  For instance, in order to obtain an attacker accuracy of 30 $\%$, NE$_2$ should be approximately equal to 0.30.  This is attributed to the fact that this task is harder from the learning viewpoint than the one considered in Section \[sec:household\_occupancy\]. 

![ Privacy-utility trade-off for house identity inference application.  Since in this application the attacker is a five-class classifier, the random guessing (balanced) accuracy is 20$\%$. The fitted curve is based on an exponential function and is included only for illustration purposes.[]{data-label="PEECANTradeoff"}](PEECAN_Five_Houses.png){width="0.45\linewidth"}

### Inference of households acorn type {#sec:household_acorntype}

As the third practical case of study, we consider the family acorn type identification which can reveal the family economic status to any third-party having access to the SMs data [@thorve2018].  Thus, for this application, the SMs power consumption is used as useful data while the acorn type is considered as private one. 

The empirical privacy-utility trade-off curve obtained for this application is presented in Fig.  \[LondonTradeoff\].  Once again, we see a large variation in the accuracy of the attacker as the distortion is modified. 

![ Privacy-utility trade-off for acorn type inference application.  Since in this application the attacker is a three-class classifier, the random guessing (balanced) accuracy is 33$\%$. The fitted curve is based on an exponential function and is included only for illustration purposes.[]{data-label="LondonTradeoff"}](London_Tradeoff.png){width="0.45\linewidth"}

It should be noted that the PSD analysis for this application and the previous one lead to similar results to the ones of the first application and therefore are not reported. 

To assess the quality of the release signal, utility providers may be interested in several different indicators.  These include, for instance, the mean, skewness, kurtosis, standard deviation to mean ratio, and maximum to mean ratio [@shen2019].  Thus, for completeness, we present these indicators in Table \[tab:tab1\] for three different cases along the privacy-utility trade off curve.  These results show that in general the error in these indicators is small when the privacy constraints are lax and increases as they become strict.  Whereas no simple relation can be expected between NE$_2$ and the values of the corresponding indicators. 

[width=0.9]{}

  ------------------------------------------------------- --------------------------- -------------------------------- -------- ------------ ------------ ------------------ -------------
              \[4\][\*]{}[SMs Application]{}               \[4\][\*]{}[**NE$_2$**]{}   \[4\][\*]{}[**Accuracy(%)**]{}                                                        
                        (rl)[4-8]{}                                                                                     *Mean*   *Skewness*   *Kurtosis*   *Std.  Dev./Mean*   *Max./Mean*
   \[4\][\*]{}[**Inference of households occupancy**]{}              0.04                            78                  1.42       1.06         0.70            0.67            0.46
                                                                     0.12                            65                  9.69       4.32         5.81            4.58            4.92
                                                                     0.18                            57                 13.26      12.83         2.57           16.44            13.89
   \[4\][\*]{}[**Inference of households identity** ]{}              0.05                            54                  3.42       2.22         2.01            3.50            2.51
                                                                     0.17                            39                  4.63       3.18         1.79           15.74            9.32
                                                                     0.36                            29                 12.49       6.71         1.44           19.12            9.98
   \[4\][\*]{}[**Inference of households acron type**]{}             0.03                            85                  1.86       0.66         0.44            0.02            0.02
                                                                     0.29                            47                  2.49       9.46        14.54           24.97            13.24
                                                                     0.60                            35                 13.21      45.92        24.03           55.38            41.68
  ------------------------------------------------------- --------------------------- -------------------------------- -------- ------------ ------------ ------------------ -------------

\[tab:tab1\]

$\ell_p$ Distortion
-------------------

As already discussed in Section \[sec:formulation\], the distortion function should be properly matched to the intended application of the release variables $Z^T$ in order to preserve the characteristics of the target variables $Y^T$ that are considered essential.  In this section, we consider the $\ell_p$ distortion with $p=4,5$ as an alternative to the $\ell_2$ distortion function in Section and study their potential benefits. 

The privacy-utility trade-off curve for the inference of households occupancy application is shown in Fig.  \[LossesEco\].  As a first observation, it appears clear that the choice of the distortion measure has a non-negligible impact on the privacy-utility trade-off curve.  In fact, it can be seen that for a given amount of distortion, the releasers trained with the $\ell_4$ and $\ell_5$ distortion measures achieve a higher level of privacy than the one trained with the $\ell_2$ distortion function.  It should be mentioned that we also considered other norms, such as the $\ell_{10}$, and the privacy-utility trade-off was observed to be similar, but slightly better, than the one corresponding to the $\ell_4$ norm. 

![ Privacy-utility trade-off for house occupancy inference application based on the different $\ell_p$ distortion functions.  For each figure, the dashed line, shown for comparison purposes, is the fitted curve found in Fig.  \[ECOTradeoff\] for the $\ell_2$ distortion function.[]{data-label="LossesEco"}](L4L5_tradeoff.png){width="0.8\linewidth"}

As we discussed in Section \[sec:formulation\], in demand response programs, the utilities are mostly interested in the peak power consumption of the customers.  It is also expected that higher-order $\ell_p$ norms are better at preserving these signal characteristics than the $\ell_2$ norm.  To verify this notion, we considered 60 random days of the ECO data set in a full privacy scenario (i.e., with an attacker accuracy very close to $50 \%$) and plotted the actual power consumption along with the corresponding release signals for both the $\ell_4$ and $\ell_2$ distortion functions.  Results are shown in Fig.  \[TimeL4L2ECO\], which clearly indicates that the number of peaks preserved by the releaser trained with the $\ell_4$ distortion function is much higher than the ones kept by the releaser trained with the $\ell_2$ distortion function.  This suggests that for the demand response application, higher order $\ell_p$ distortion functions should be considered. 

![ Example of the release power consumption in the time domain compared with the actual power consumption over 60 random days with almost full privacy for the $\ell_4$ and $\ell_2$ distortion functions.[]{data-label="TimeL4L2ECO"}](Time_L24.png){width="0.65\linewidth"}

Attacker with Data Mismatch Problem
-----------------------------------

All the previous results are based on the assumption that the attacker has access to exactly the same training data set used by the releaser.  This case should be considered as a worst-case analysis of the performance of the privacy-preserving networks.  However, this assumption may not be true in practice.  To examine this scenario, we revisit the application of Section \[sec:household\_occupancy\] in two different cases.  In the first case, we assume that out of the data set of five houses (ECO data set), the releaser uses the data of houses $\{1,2,4,5|$ for training while the attacker has access to just the data of house $3$. In the second case, we assume that releaser is trained by the the data set of all houses but just the data set of houses $1$ and $3$ are available to the attacker.  These scenarios try to capture different degrees of a data mismatch problem, which could have an impact on the privacy-utility trade-off due to the different generalization errors. 

The results are presented in Fig.  \[DiffDataset\] along with the worst-case scenario.  This clearly shows how the overlapping of the training data sets of the releaser and the attacker affect the performance of the model.  In fact, in the case where the attacker does not have access to the full data set of the releaser but a portion of that, the performance of the attacker largely degrades, which means that a target level of privacy requires much less distortion.  In the extreme case where the attacker has no access to the releaser training data set, a very high level of privacy can be achieved with negligible distortion.  This should be considered as a best-case scenario.  It should be mentioned that we repeated this experiment with different shuffling of the houses and similar results were obtained. 

![ Privacy-utility trade-off for house occupancy inference application when an attacker (trained separately to infer private data from the release) does not have full access to the releaser training data set.[]{data-label="DiffDataset"}](drawing13.png){width=".45\linewidth"}

Summary and Discussion {#sec:conclusion}
======================

Privacy problems associated with smart meters measurements are an important concern in society, which can have an impact on their deployment pace and the advancement of smart grid technologies.  Thus, it is essential to understand the real privacy risks associated with them in order to provide an adequate solution to this problem. 

In this paper, we proposed to measure the privacy based on Directed Information (DI) between the sensitive time series and its inference by a potential attacker optimized for that task.  DI captures the causal time dependencies present in the time series data and its processing.  Unlike previous approaches, we impose no explicit assumption on the statistics or distributions of the involved random variables.  We believe that this data-driven approach can provide a more accurate assessment of the information leakage in practice than purely theoretical studies based on worst-case assumptions. 

We considered a privacy-preserving adversarial learning framework that balances the trade-off between privacy and distortion on release data.  More precisely, we defined a tractable training objective (or loss) based on an upper bound to DI and a general distortion measure.  The desired releaser is then trained in an adversarial framework using RNNs to optimize such objective, while an artificial attacker is trained with an opposite goal.  After convergence, a new attacker is trained to test the level of privacy achieved by the releaser.  A detailed study of different applications, including inference of households occupancy (ECO data set), inference of household identity (Pecan Street data set), and inference of household acorn type (LCL data set), shows that the privacy-utility trade-off is strongly dependent upon the considered application and distortion measure.  We showed that the usual $\ell_p$-norm based distortion measure for $p=2$ can have a worse privacy-utility trade-off than for $p>2$. In addition, we showed that the $\ell_4$ distortion measure generates a release that preserves most of the power consumption peaks even under a full privacy regime, which is not the case for the $\ell_2$ distortion function.  This result is of considerable importance for demand response applications. 

Finally, we studied the impact of the data mismatch problem in this application, which occurs when the training data set of the releaser is not the same as the one used by the attacker.  Results show that this effect can greatly affect the privacy-utility trade-off.  Since this phenomenon is expected in practice, at least to some degree, these findings suggest that the level of required distortion to achieve desired privacy targets may not be too significant in several cases of interest.  In such scenarios, our approach may offer a simpler and more general solution than the ones offered by methods based on rechargeable batteries and renewable energy sources. 

[^1]: This work was supported by Hydro-Quebec, the Natural Sciences and Engineering Research Council of Canada, and McGill University in the framework of the NSERC/Hydro-Quebec Industrial Research Chair in Interactive Information Infrastructure for the Power Grid (IRCPJ406021-14).  The work of Prof. Pablo Piantanida was supported by the European Commission’s Marie Sklodowska-Curie Actions (MSCA), through the Marie Sklodowska-Curie IF (H2020-MSCAIF-2017-EF-797805-STRUDEL. 

[^2]: M. Shateri, F. Messina, and F. Labeau are with the Department of Electrical and Computer Engineering, McGill University, QC, Canada.  Email:{mohammadhadi.shateri,francisco.messina}@mail.mcgill.ca

[^3]: P. Piantanida is with Laboratoire des Signaux et Systèmes, CentraleSupélec-CNRS-Université Paris Sud, Gif-sur-Yvette, France and with Montreal Institute for Learning Algorithms (Mila), Université de Montréal, QC, Canada.