Differentially private Kalman filtering

This paper studies the H <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> (Kalman) filtering problem in the situation where a signal estimate must be constructed based on inputs from individual participants, whose data must remain private. This problem arises in emerging applications such as smart grids or intelligent transportation systems, where users continuously send data to third-party aggregators performing global monitoring or control tasks, and require guarantees that this data cannot be used to infer additional personal information. To provide formal privacy guarantees against adversaries with arbitrary side information, we rely on the notion of differential privacy introduced relatively recently in the database literature. This notion is extended to dynamic systems with many participants contributing independent input signals, and mechanisms are then proposed to solve the H <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> filtering problem with a differential privacy constraint. A method for mitigating the impact of the privacy-inducing mechanism on the estimation performance is described, which relies on controlling the H <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">∞</inf> norm of the filter. Finally, we discuss an application to a privacy-preserving traffic monitoring system.