# Immersion and Invariance-based Coding for Privacy in Remote Anomaly
Detection

Haleh Hayati  Nathan van de Wouw  Carlos Murguia  Department of Mechanical
Engineering, Dynamics and Control Group, Eindhoven University of Technology,
The Netherlands,
Emails<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

We present a framework for the design of coding mechanisms that allow remotely
operating anomaly detectors in a privacy-preserving manner. We consider the
following problem setup. A remote station seeks to identify anomalies based on
system input-output signals transmitted over communication networks. However,
it is not desired to disclose true data of the system operation as it can be
used to infer private information. To prevent adversaries from eavesdropping
on the network or at the remote station itself to access private data, we
propose a privacy-preserving coding scheme to distort signals before
transmission. As a next step, we design a new anomaly detector that runs on
distorted signals and produces distorted diagnostics signals, and a decoding
scheme that allows extracting true diagnostics data from distorted signals
without error. The proposed scheme is built on the synergy of matrix
encryption and system Immersion and Invariance (I&I) tools from control
theory. The idea is to immerse the anomaly detector into a higher-dimensional
system (the so-called target system). The dynamics of the target system is
designed such that: the trajectories of the original anomaly detector are
immersed/embedded in its trajectories, it works on randomly encoded input-
output signals, and produces an encoded version of the original anomaly
detector alarm signals, which are decoded to extract the original alarm at the
user side. We show that the proposed privacy-preserving scheme provides the
same anomaly detection performance as standard Kalman filter-based chi-squared
anomaly detectors while revealing no information about system data.

###### keywords:

Privacy, Remote Anomaly Detection, Immersion and Invariance (I&I).

##  1 Introduction

Scientific and technological advancements in today’s hyperconnected world have
resulted in a massive amount of user data being collected and processed by
hundreds of companies over public networks. Companies use this data to provide
personalized services and targeted advertising. However, these technologies
have come at the cost of a significant loss of privacy in society. Depending
on their resources, adversaries can infer sensitive (private) information
about users/systems from public data available on the internet and/or
unsecured networks/servers. That is why researchers from different fields
(e.g., information theory, computer science, and control engineering) have
been drawn to the broad research subject of privacy and security of Cyber-
Physical Systems (CPSs), see Ny and Pappas (2014), Tanaka et al. (2017),
Murguia et al. (2018), Ferrari and Teixeira (2021).
In many engineering applications, information about the system operation is
obtained through sensor measurements. This data is then sent to remote
stations through communication networks for signal processing and decision-
making purposes. One of these applications is remote anomaly detection, where
a remote station seeks to identify anomalies based on system input-output
signals transmitted over communication networks. If the communication network
is public/unsecured and/or the remote station is not trustworthy, adversaries
might access and infer system sensitive data, e.g., the system
state/configuration, reference signals, product specifications, etc.
Therefore, disclosing true data of the system operation is not desired as it
can be used to infer private information.
In recent years, various privacy-preserving schemes have been implemented to
address privacy leakage in dynamical systems applications. Most of them rely
on two different strategies for providing privacy: perturbation-based schemes
and cryptographic techniques, see Farokhi (2020). Perturbation-based schemes
inject randomness to maintain privacy, and cryptographic algorithms limit
access to data through encryption.
Perturbation-based techniques, usually rely on information-theoretic measures,
see Farokhi and Sandberg (2017), Hayati et al. (2021), or differential
privacy, see Ny and Pappas (2014), Dwork (2008), Ferrari et al. (2021). In
these techniques, random noise from a known distribution is injected into
sensitive data before sending it to the remote station. However, in these
methods, the induced distortion is never removed, which leads to performance
degradation.
In most cryptography methods, data is encrypted before transmitting to the
remote station and then decrypted at the remote station before processing, see
Wan et al. (2018). This technique is suitable for making eavesdropping attacks
difficult over communication networks. However, it is still vulnerable to
insider attacks. Using encryption methods like homomorphic encryption (HE),
which do not require data to be decrypted before processing, can reduce the
occurrence of insider attacks. HE allows computations over plain data by
performing appropriate computations on the encrypted data, see Shoukry et al.
(2016). However, standard HE methods (e.g., Paillier encryption, see Paillier
(1999)) work over rings of integers which makes reformulating algorithms to
work for dynamical systems over infinite time horizons difficult, see Murguia
et al. (2020). Even when this reformulation is possible, mapping algorithms
working on the reals to operate on finite rings leads to performance
degradation and large computational overhead, see Kim et al. (2022).
To summarize, although current solutions improve privacy of dynamical systems,
they often do it at the expense of data utility and system efficiency.
Balancing these tradeoffs is a key challenge when implementing privacy
solutions for dynamical systems. Novel privacy-preserving schemes must be
designed to provide strict privacy guarantees with a fair computational cost
and without compromising application performance.
The aim of this work is to devise synthesis tools that allow designing coding
mechanisms that protect private information and allow the implementation of
remote anomaly detection procedures – here, we consider standard Kalman
filter-based chi-squared change detection procedures, see Murguia and Ruths
(2019). We propose a privacy-preserving anomaly detection scheme built on the
synergy of random coding and system Immersion and Invariance (I&I) tools, see
Astolfi and Ortega (2003), from control theory. The main idea is to treat the
standard anomaly detection algorithm as a dynamical system that we seek to
immerse into a higher-dimensional system (the so-called target system). The
dynamics of the target system must be designed such that: 1) trajectories of
the standard anomaly detector are immersed/embedded in its trajectories; and
2) it operates on encoded data. We use random coding, which is formulated at
the user side as a random change of coordinates that maps original private
data to a higher-dimensional space. Such coding enforces that the target
system produces an encoded version of the standard anomaly detector alarm
signals. The encoded anomaly detector alarms are decoded at the user side
using the inverse of the encoding map (so this is basically a homomorphic
encryption scheme that operates over the reals). The proposed framework
provides the same performance as the standard anomaly detector (i.e., when no
coding is employed to protect against data inference), reveals no information
about private data, and is computationally efficient. To the best of our
knowledge, this is the first piece of work that provides a high level of
privacy for remote anomaly detectors without affecting performance.
Summarizing, the main contribution of the paper is the development of a
synthesis framework that allows to jointly design of coding schemes to
randomize disclosed data and new anomaly detectors that work on encrypted
data, does not lead to performance degradation, and provides unconditionally
secure privacy guarantees (Wang and Ju (2008)). We have explored the use of
similar ideas for privacy in Federated Learning, see Hayati et al. (2022).
To the best of the authors’ knowledge, only Ferrari et al. (2021) addresses a
similar problem setup (using very different techniques, though, and proving
different guarantees). For remote anomaly detection in stochastic dynamical
systems, the authors in Ferrari et al. (2021) consider differential privacy
between driving inputs and distorted disclosed data as their notion of privacy
and provide tools to select the variance of i.i.d. noise to be injected such
that disclosed data guarantees differential privacy. Their results consider
privacy at every time-step, i.e., they do not consider information disclosed
over a history of observations. While this indeed gives privacy guarantees, it
is well known that for dynamical systems, the more data is collected, the more
accurate the input/state estimation can be. Therefore, if the privacy scheme
is to avoid input/state estimation, giving guarantees at every time-step is
certainly not sufficient.

###  1.1 Notation

The symbol ${\mathds{R}}$ stands for the real numbers, and ${\mathds{R}}^{+}$
denotes the set of positive real numbers. The symbol ${\mathds{N}}$ stands for
the set of natural numbers. The Euclidian norm in ${\mathds{R}}^{n}$ is
denoted by $||X||$, $||X||^{2}=X^{\top}X$, where ⊤ denotes transposition. The
$n\times n$ identity matrix is denoted by $I_{n}$ or simply $I$ if $n$ is
clear from the context. Similarly, $n\times m$ matrices composed of only ones
and only zeros are denoted by $\mathbf{1}_{n\times m}$ and
$\mathbf{0}_{n\times m}$, respectively, or simply $\mathbf{1}$ and
$\mathbf{0}$ when their dimensions are clear. The notation
$x\sim\mathcal{N}[\mu^{x},\Sigma^{x}]$ means $x\in{\mathds{R}}^{n}$ is a
normally distributed random vector with mean $E[x]=\mu^{x}\in{\mathds{R}}^{n}$
and covariance matrix
$E[(x-\mu^{x})(x-\mu^{x})^{T}]=\Sigma^{x}\in{\mathds{R}}^{n\times n}$, where
$E[a]$ denotes the expected value of the random vector $a$. The left inverse
of the matrix $X$ is denoted by $X^{L}$ where $X^{L}X=I$. The operator
$\operatorname{ker}[\cdot]$ denotes the kernel.

##  2 System Description and Problem Formulation

###  2.1 System Description

We consider discrete-time stochastic systems of the form:

$\displaystyle\left\\{\begin{aligned}
x_{k+1}&=Ax_{k}+Bu_{k}+t_{k}+D\delta_{k},\\\
y_{k}&=Cx_{k}+w_{k}+F\delta_{k},\end{aligned}\right.$ (1)

with time-index $k\in{\mathds{N}}$, state $x_{k}\in{\mathbb{R}^{{n_{x}}}}$,
measurable output $y_{k}\in{\mathbb{R}^{{n_{y}}}}$, and _known_ input
$u_{k}\in{\mathbb{R}^{{n_{u}}}}$. Vector
$\delta_{k}\in{\mathbb{R}^{{n_{\delta}}}}$ models changes in the system
dynamics due to faults or anomalies (thus, in the absence of anomalies
$\delta_{k}=\mathbf{0}$). Matrices $(A,B,C,D,F)$ are of appropriate
dimensions, and the pair $(A,C)$ is detectable. The state disturbance $t_{k}$
and the output disturbance $w_{k}$ are multivariate i.i.d. Gaussian processes
with zero mean and positive definite covariance matrices ${\Sigma^{t}}$ and
${\Sigma^{w}}$, respectively. The initial state $x_{1}$ is assumed to be a
Gaussian random vector with $E[x_{1}]=\mu_{1}^{x}\in\mathbb{R}^{n_{x}}$ and
covariance matrix $\Sigma^{x}_{1}\in\mathbb{R}^{n_{x}\times n_{x}}$,
$\Sigma^{x}_{1}>0$. Disturbances $t_{k}$ and $w_{k}$ and the initial condition
$x_{1}$ are mutually independent. We assume that matrices (vectors)
$(A,B,C,\Sigma^{x}_{1},\mu^{x}_{1},\Sigma^{t},\Sigma^{w})$ and input $u_{k}$
are known for all $k$.

###  2.2 Anomaly Detection

The aim of the anomaly detection algorithm is to identify anomalies (i.e.,
when $\delta_{k}\neq\mathbf{0}$ in (1)) using system input-output signals.
Here, we consider standard Kalman filter-based chi-squared change detection
procedures, see Murguia and Ruths (2019). The main idea is to use an estimator
to anticipate the system evolution in the absence of anomalies. This
prediction is subsequently compared with actual measurements from sensors. If
the difference between what is measured and the estimation (commonly referred
to as residuals) is larger than expected, there might be an anomaly in the
system. We use steady-state Kalman filters as the state estimator.

####  2.2.1 Steady-state Kalman Filter (anomaly-free case):

Consider the following one step-ahead Kalman filter, see Aström and Wittenmark
(1997), for (1):

$\hat{x}_{k+1}=A\hat{x}_{k}+Bu_{k}+L(y_{k}-C\hat{x}_{k}),$ (2)

with estimated state $\hat{x}_{k}\in{\mathbb{R}^{{n_{x}}}}$,
$\hat{x}_{1}=E[x_{1}]$, and output injection gain matrix
$L\in{\mathbb{R}^{{n_{x}}\times{n_{y}}}}$. Define the estimation error
$e_{k}:=x_{k}-\hat{x}_{k}$. The optimal filter gain $L$ minimizing the trace
of the asymptotic estimation error covariance matrix
$P:=\lim_{k\rightarrow\infty}E[e_{k}e_{k}^{\mathrm{T}}]$ in the absence of
anomalies is given by

$L:=\left(APC^{\top}\right)\left(\Sigma^{w}+CPC^{\top}\right)^{-1},$ (3)

where $P$ is the solution of the Riccati equation:

$APA^{\top}-P+\Sigma^{t}=APC^{\top}\left(\Sigma^{w}+CPC^{\top}\right)^{-1}CPA^{\top}.$
(4)

Equation (4) always has a unique solution $P$ under the assumption of
detectability of the pair $(A,C)$, see Aström and Wittenmark (1997).

####  2.2.2 Residuals and Hypothesis Testing:

Consider the process dynamics (1) and the steady-state Kalman filter (2), and
define the residual sequence $r_{k}:=y_{k}-C\hat{x}_{k}$, which can be shown
to evolve according to the difference equation:

$\displaystyle\left\\{\begin{aligned}
e_{k+1}&=(A-LC)e_{k}+t_{k}-Lw_{k}+(D-LF)\delta_{k},\\\
r_{k}&=Ce_{k}+w_{k}+F\delta_{k}.\end{aligned}\right.$ (5)

If there are no anomalies ($\delta_{k}=\mathbf{0}$), the mean and the
covariance matrix of the residual are as follows

$\displaystyle\left\\{\begin{aligned}
&E[r_{k}]=CE[e_{k}]+E[w_{k}]=\mathbf{0}_{n_{y}\times 1},\\\\[5.69054pt]
&E[r_{k}r^{\top}_{k}]=CPC^{\top}+\Sigma^{w}=:\Sigma\in{\mathbb{R}^{{n_{y}}\times{n_{y}}}}.\end{aligned}\right.$
(6)

For this residual, we identify two hypotheses to be tested: $\mathcal{H}_{0}$
the normal mode (no anomalies) and $\mathcal{H}_{1}$ the faulty mode (with
anomalies). Under the normal mode, $\mathcal{H}_{0}$, the statistics of the
residual are given by (6). However, in the presence of anomalies
($\mathcal{H}_{1}$), we expect that the statistics of the residual are
different from those in the normal mode, i.e.,

$\mathcal{H}_{1}:\left\\{\begin{aligned} &E[r_{k}]\neq\mathbf{0}_{n_{y}\times
1},\text{ and/or}\\\\[5.69054pt]
&E[r_{k}r^{\top}_{k}]\neq\Sigma.\end{aligned}\right.$ (7)

There exist many well-known hypothesis testing techniques that could be used
to examine the residual and subsequently detect anomalies/faults, for
instance, (CUSUM) (Murguia and Ruths (2016)), generalized likelihood ratio
testing (Basseville (1988)), Compound Scalar Testing (CST) (Gertler (1988)),
etc. Each technique has its own advantages and disadvantages, depending on the
scenario. In this manuscript, we consider a particular case of CST, namely the
so-called chi-squared change detection procedure, see Murguia and Ruths
(2019).

####  2.2.3 Distance Measure and Chi-Squared Procedure:

The input to the chi-squared procedure is a distance measure
$z_{k}\in{\mathbb{R}}$, i.e., a measure of how deviated the estimator is from
the sensor measurements. Here, we use the quadratic (in the residual) distance
measure:

$z_{k}=r^{\top}_{k}\Sigma^{-1}r_{k},$ (8)

where $r_{k}$ and $\Sigma$ are the residual sequence and its covariance matrix
introduced in (6). If there are no anomalies ($\delta_{k}=\mathbf{0}$),
$E[r_{k}]=\mathbf{0}$ and $E[r_{k}r^{\top}_{k}]=\Sigma$; it follows that

$\displaystyle\left\\{\begin{array}[]{ll}E[z_{k}]&=\text{tr}[\Sigma^{-1}\Sigma]+E[r_{k}]^{\top}\Sigma^{-1}E[r_{k}]=n_{y},\\\\[5.69054pt]
\text{var}[z_{k}]&=2\text{tr}[\Sigma^{-1}\Sigma\Sigma^{-1}\Sigma]+4E[r_{k}]^{\top}\Sigma^{-1}\Sigma\Sigma^{-1}E[r_{k}]\\\\[2.84526pt]
&=2n_{y},\end{array}\right.$ (12)

see, e.g., Ross (2014) for details. Because
$r_{k}\sim\mathcal{N}(\mathbf{0},\Sigma)$, $z_{k}$ follows a chi-squared
distribution with $n_{y}$ degrees of freedom. The chi-squared procedure is
characterized by $z_{k}$ and its cumulative distribution as follows:
Chi-Squared procedure:

$a_{k}=m\left(z_{k}\right):=\begin{cases}0&\text{If}\,\,\,z_{k}\leq\alpha,\\\
1&\text{If}\,\,\,z_{k}>\alpha.\end{cases}$ (13)

Design parameter: threshold $\alpha\in\mathbb{R}^{+}$.
Output: alarm signal $a_{k}$.

The idea is that if $z_{k}$ exceeds the threshold $\alpha$, alarms are
triggered, and the time instant $k$ is identified as an alarm time. The
parameter $\alpha$ is selected to satisfy a desired false alarm rate
$\mathcal{A}^{*}$. Assume that there are no anomalies/faults and consider the
chi-squared procedure with threshold $\alpha\in\mathbb{R^{+}}$, and
$r_{k}\sim\mathcal{N}(\mathbf{0},\Sigma)$. Let
$\alpha=\alpha^{*}:=2\mathcal{P}^{-1}\left(\frac{n_{y}}{2},1-\mathcal{A}^{*}\right)$,
where $\mathcal{P}^{-1}$ denotes the inverse regularised lower incomplete
gamma function, then the false alarm rate $\mathcal{A}$, induced by the
threshold $\alpha^{*}$, satisfies $\mathcal{A}=\mathcal{A}^{*}$ (see Murguia
and Ruths (2019) for more details).

Summarizing, the complete anomaly detector is given as follows:

$\left\\{\begin{aligned}
\hat{x}_{k+1}&=A\hat{x}_{k}+Bu_{k}+L\left(y_{k}-C\hat{x}_{k}\right),\\\
r_{k}&=y_{k}-C\hat{x}_{k},\\\ z_{k}&=r_{k}^{\top}\Sigma r_{k},\\\
a_{k}&=\begin{cases}0&\text{If}\,\,\,z_{k}\leq\alpha,\\\
1&\text{If}\,\,\,z_{k}>\alpha.\end{cases}\end{aligned}\right.$ (14)

Therefore, the anomaly detector at the remote station uses the system input
$u_{k}$ and measurement $y_{k}$, which are transmitted over communication
networks, to create the alarm signal $a_{k}$. Signal $a_{k}$ is sent back to
the user through the networks. Note that information about the system dynamics
(state, model, references, etc.) can be inferred from the transmitted data. If
the communication network is public/unsecured and/or the remote station is not
a trusted party, information about the system dynamics needs to be fully
disclosed to run the anomaly detector in (14). To avoid this, in this work,
transmitted data (input, measurement, and alarm signals) is considered private
data that we aim to hide from adversaries by coding.

###  2.3 Immersion Map and Target System

The goal of the proposed privacy-preserving anomaly detection scheme is to
make the inference of private data from the encoded disclosed data as hard as
possible without degrading the performance of the anomaly detector. We seek to
design a coding mechanism using system immersion and invariance tools from
control theory.
System immersion refers to embedding the trajectories of a dynamical system
into the trajectories of a different higher-dimensional system (the so-called
target system), see Astolfi and Ortega (2003). That is, there is a bijection
between the trajectories of both systems (here referred to as the immersion
map), and thus having a trajectory of the target system uniquely determines a
trajectory of the original system via the immersion map.
In our setting, the idea is to immerse the dynamics of the standard anomaly
detector (14) into a target dynamical system – referred hereafter as the
target anomaly detector. The dynamics of the target anomaly detector must be
designed such that: 1) trajectories of the standard anomaly detector (14) are
immersed in its trajectories via a known immersion map; 2) the target anomaly
detector works on encoded input-measurement signals (here, we use random
coding); and 3) the target anomaly detector produces an encoded version of the
standard anomaly detector alarms that we can later decode at the user side.
Once we have designed the target system and the immersion map, we can use them
in real-time to operate on encoded input-measurement signals and to encode
anomaly detector alarms. The user can decode the encoded alarm signal using
the left-inverse of the encoding map.
Denote the state generated by the target Kalman filter as
$\hat{x}^{\prime}_{k}\in\mathbb{R}^{\tilde{n}_{x}}$ with
${\tilde{n}_{x}}>{n_{x}}$. Consider the following target anomaly detector:

$\text{Target anomaly detector}:\left\\{\begin{aligned}
\hat{x}^{\prime}_{k+1}&=\tilde{g}\left(\hat{x}_{k}^{\prime},\tilde{u}_{k},\tilde{y}_{k}\right),\\\
\tilde{r}_{k}&=\tilde{h}\left(\tilde{y}_{k},\hat{x}^{\prime}_{k}\right),\\\
\tilde{z}_{k}&=\tilde{f}\left(\tilde{r}_{k},\tilde{y}_{k}\right),\\\
\tilde{a}_{k}&=\tilde{m}\left(\tilde{z}_{k},\tilde{y}_{k}\right),\end{aligned}\right.$
(15)

with functions $\tilde{g}(\cdot)$, $\tilde{h}(\cdot)$, $\tilde{f}(\cdot)$, and
$\tilde{m}(\cdot)$ to be designed, initial filter state
$\hat{x}^{\prime}_{0}$, and encoded input $\tilde{u}_{k}$, measurement
$\tilde{y}_{k}$, residual $\tilde{r}_{k}$, distance measure $\tilde{z}_{k}$,
and alarm signal $\tilde{a}_{k}$. We define encoding maps of input-measurement
signals as $\tilde{y}_{k}=\pi_{1}(y_{k})$ and $\tilde{u}_{k}=\pi_{2}(u_{k})$
to be designed.
The standard anomaly detector in (14) is immersed in the target anomaly
detector (15) through a function
$\pi_{3}:\mathbb{R}^{n_{x}}\to\mathbb{R}^{\tilde{n}_{x}}$ to be designed
satisfying:

$\hat{x}_{k}^{\prime}=\pi_{3}\left(\hat{x}_{k}\right),$ (16)

for all $k$. We refer to this function $\pi_{3}(\cdot)$ as the _immersion
map_. To have (16) for all $k$, the target system (15), the function
$\pi_{3}(\cdot)$, and the initial filter state $\hat{x}_{0}^{\prime}$ must be
designed such that starting the target filter state from the manifold (16),
i.e., $\hat{x}_{0}^{\prime}=\pi_{3}\left(\hat{x}_{0}\right)$, it always remain
on this manifold. This leads to forward invariance condition under the
dynamics of the standard Kalman filter in (14) and the target filter
$\tilde{g}(\cdot)$. Defining an off-the-manifold error as
$\epsilon_{k}=\hat{x}_{k}^{\prime}-\pi_{3}\left(\hat{x}_{k}\right)$, the
manifold is forward invariant if the origin of its dynamics:

$\displaystyle\epsilon_{k+1}$
$\displaystyle=\hat{x}^{\prime}_{k+1}-\pi_{3}\left(\hat{x}_{k+1}\right)$ (17)
$\displaystyle=\tilde{g}\left((\pi_{3}\left(\hat{x}_{k}\right)+\epsilon_{k}),\tilde{u}_{k},\tilde{y}_{k}\right)-\pi_{3}\left(\hat{x}_{k+1}\right),$

is a fixed point, i.e., $\epsilon_{k}=\mathbf{0}$ implies
$\epsilon_{k+1}=\mathbf{0}$. Substituting $\epsilon_{k}=\mathbf{0}$ and
$\epsilon_{k+1}=\mathbf{0}$ into (17) we have:

$\displaystyle\tilde{g}\left(\pi_{3}\left(\hat{x}_{k}\right),\tilde{u}_{k},\tilde{y}_{k}\right)=\pi_{3}\left(\hat{x}_{k+1}\right).$
(18)

Hence, we need to enforce (by designing $\pi_{3}(\cdot)$, $\tilde{g}(\cdot)$,
and $\hat{x}^{\prime}_{0}$) that: (a) the initial condition of (15),
$\hat{x}^{\prime}_{0}$, satisfies $\hat{x}^{\prime}_{0}=\pi_{3}(\hat{x}_{0})$,
which leads to $\epsilon_{0}=\mathbf{0}$ (start on the manifold); and (b) the
dynamics of both algorithms match under the immersion map, i.e., (18) is
satisfied (invariance condition on the manifold). Therefore, using the
expressions for $\hat{x}_{k+1}$ in (14), the immersion map (16), and encoding
maps, the invariance condition (18) can be written as follows:

$\displaystyle\tilde{g}\left(\pi_{3}\left(\hat{x}_{k}\right),\pi_{2}\left({u}_{k}\right),\pi_{1}\left({y}_{k}\right)\right)$
(19) $\displaystyle\hskip
56.9055pt=\pi_{3}\left(A\hat{x}_{k}+Bu_{k}+L\left(y_{k}-C\hat{x}_{k}\right)\right),$

for all $\hat{x}_{k}\in\mathbb{R}^{n_{x}}$. We refer to this equation as the
_immersion condition_.
In the target anomaly detector (15), a distorted filter is used to compute
encoded residuals, distance measures, and alarms, and then, the encoded alarms
are sent back to the user for decoding. Therefore, the alarm signal must
satisfy $\tilde{a}_{k}=\pi_{4}({a}_{k})$ for some left-invertible mapping
$\pi_{4}(\cdot)$ to be designed. The latter imposes an extra condition on
encoding maps since to retrieve $a_{k}$ from $\tilde{a}_{k}$: (c) there must
exist a function $\pi_{4}^{L}:\mathbb{R}^{\tilde{n}_{a}}\to\mathbb{R}$
satisfying the following left-invertibility condition:

$\pi_{4}^{L}\left(\tilde{a}_{k}\right)=a_{k}.$ (20)

If such $\pi_{4}^{L}(\cdot)$ and $\pi_{4}(\cdot)$ exist, the user can retrieve
the original alarm signal by passing the encoded one through function
$\pi_{4}^{L}(\cdot)$. We now have all the machinery required to state the
problem we seek to solve.

######  Problem 1.

_(Privacy-Preserving Anomaly Detector)_ Consider the standard anomaly detector
(14) and the target anomaly detector (15). Design encoding maps,
$\pi_{1}(\cdot)$, $\pi_{2}(\cdot)$, and $\pi_{4}(\cdot)$, the immersion map
$\pi_{3}(\cdot)$, and functions $\tilde{g}(\cdot)$, $\tilde{h}(\cdot)$,
$\tilde{f}(\cdot)$, and $\tilde{m}(\cdot)$ in (15) such that: (a) the initial
condition of estimated state satisfies
$\hat{x}^{\prime}_{0}=\pi_{3}(\hat{x}_{0})$ (start on the manifold); (b) the
dynamics of both algorithms match under the immersion map, i.e., the immersion
condition (19) is satisfied (invariance condition on the manifold); and (c)
there exists a function $\pi_{4}^{L}(\cdot)$ satisfying (20) (left
invertability condition).

##  3 Solution to Problem 1

In this section, we construct a class of the proposed target anomaly detection
algorithms by deriving particular expressions for all functions in Problem
$1$. We start with function $\tilde{g}(\cdot)$ and the immersion condition
(19). Let the coding maps $\pi_{1}(\cdot)$ and $\pi_{2}(\cdot)$, and the
immersion map $\pi_{3}(\cdot)$ be affine functions as follows:

$\left\\{\begin{array}[]{l}\tilde{y}_{k}=\pi_{1}(y_{k}):=\Pi_{1}y_{k}+b^{1}_{k},\\\
\tilde{u}_{k}=\pi_{2}(u_{k}):=\Pi_{2}u_{k}+b^{2}_{k},\\\
\hat{x}^{\prime}_{k}=\pi_{3}(\hat{x}_{k}):=\Pi_{3}\hat{x}_{k},\end{array}\right.$
(21)

for some $\Pi_{1}\in\mathbb{R}^{\tilde{n}_{y}\times n_{y}}$,
$\Pi_{2}\in\mathbb{R}^{\tilde{n}_{u}\times n_{u}}$,
$\Pi_{3}\in\mathbb{R}^{\tilde{n}_{x}\times n_{x}}$, with
$\tilde{n}_{y}>n_{y}$, $\tilde{n}_{u}>n_{u}$, $\tilde{n}_{x}>n_{x}$, and
$b^{1}_{k}\in\mathbb{R}^{\tilde{n}_{y}}$, and
$b^{2}_{k}\in\mathbb{R}^{\tilde{n}_{u}}$ – with slight abuse of notation, we
let $b^{1}_{k}$ and $b^{2}_{k}$ change with $k$ independently of $y_{k}$ and
$u_{k}$. Then, the immersion condition (19) reduces to

$\displaystyle\tilde{g}\left(\Pi_{3}\hat{x}_{k},\Pi_{2}u_{k}+b^{2}_{k},\Pi_{1}y_{k}+b^{1}_{k}\right)$
(22) $\displaystyle\hskip
56.9055pt=\Pi_{3}\left(A\hat{x}_{k}+Bu_{k}+L\left(y_{k}-C\hat{x}_{k}\right)\right).$

Let the function $\tilde{g}(\cdot)$ be of the form

$\displaystyle\tilde{g}\left(\hat{x}_{k}^{\prime},\tilde{u}_{k},\tilde{y}_{k}\right)$
(23) $\displaystyle\hskip
28.45274pt:=\Pi_{3}\left(AM_{3}\hat{x}_{k}^{\prime}+BM_{2}\tilde{u}_{k}+L\left(M_{1}\tilde{y}_{k}-CM_{3}\hat{x}_{k}^{\prime}\right)\right),$

for some $M_{1}\in\mathbb{R}^{n_{y}\times\tilde{n}_{y}}$,
$M_{2}\in\mathbb{R}^{n_{u}\times\tilde{n}_{u}}$, and
$M_{3}\in\mathbb{R}^{n_{x}\times\tilde{n}_{x}}$ to be designed. Hence, the
immersion condition (22) takes the form

$\displaystyle\Pi_{3}\left(AM_{3}\hat{x}_{k}^{\prime}+BM_{2}\tilde{u}_{k}+L\left(M_{1}\tilde{y}_{k}-CM_{3}\hat{x}_{k}^{\prime}\right)\right)$
(24) $\displaystyle\hskip
85.35826pt=\Pi_{3}\left(A\hat{x}_{k}+Bu_{k}+L\left(y_{k}-C\hat{x}_{k}\right)\right).$

Note that the choice of $\tilde{g}$ in (23) provides a prescriptive design in
terms of the original estimator dynamics. That is, we exploit the knowledge of
the original dynamics and build the target system on top of it in an algebraic
manner. To satisfy (24), we must have
$M_{1}\left(\Pi_{1}y_{k}+b^{1}_{k}\right)=y_{k}$,
$M_{2}\left(\Pi_{2}u_{k}+b^{2}_{k}\right)=u_{k}$, and
$M_{3}\Pi_{3}\hat{x}_{k}=\hat{x}_{k}$, i.e., $M_{i}\Pi_{i}=I$, for
$i\in\\{1,2,3\\}$, $b^{1}_{k}\in\text{ker}[M_{1}]$, and
$b^{2}_{k}\in\text{ker}[M_{2}]$. It follows that: 1) $\Pi_{i}$,
$i\in\\{1,2,3\\}$, _must be of full column rank_ (i.e.,
$\text{rank}[\Pi_{1}]=n_{y}$, $\text{rank}[\Pi_{2}]=n_{u}$, and
$\text{rank}[\Pi_{3}]=n_{x}$); 2) $M_{i}$ is a left inverse of $\Pi_{i}$, i.e.
$M_{i}=\Pi^{L}_{i}$ (which always exists given the rank of $\Pi_{i}$); and 3)
$b^{1}_{k}\in\text{ker}[\Pi^{L}_{1}]$, $b^{2}_{k}\in\text{ker}[\Pi^{L}_{2}]$,
and these kernels are always nontrivial because $\Pi_{i}$ is full column rank
by construction. So the final form for $\tilde{g}(\cdot)$ in (15) is given as

$\displaystyle\tilde{g}\left(\hat{x}_{k}^{\prime},\tilde{u}_{k},\tilde{y}_{k}\right)$
$\displaystyle=\Pi_{3}(A\Pi_{3}^{L}\hat{x}_{k}^{\prime}+B\Pi_{2}^{L}\tilde{u}_{k}$
(25)
$\displaystyle+L\left(\Pi_{1}^{L}\tilde{y}_{k}-C\Pi_{3}^{L}\hat{x}_{k}^{\prime}\right)).$

At every $k$, vectors $b^{1}_{k}$ and $b^{2}_{k}$ are designed to satisfy
$\Pi_{1}^{L}b^{1}_{k}=0$ and $\Pi_{2}^{L}b^{2}_{k}=0$ and used to construct
the coding maps in (21). To increase privacy, we use these $b^{1}_{k}$ and
$b^{2}_{k}$ to add randomness to the mappings by exploiting the nontrivial
kernels of $\Pi_{1}^{L}$ and $\Pi_{2}^{L}$. Without loss of generality, we let
them be of the form $b^{1}_{k}=N_{1}s^{1}_{k}$ and $b^{2}_{k}=N_{2}s^{2}_{k}$,
for some matrices
$N_{1}\in\mathbb{R}^{\tilde{n}_{y}\times(\tilde{n}_{y}-n_{y})}$ and
$N_{2}\in\mathbb{R}^{\tilde{n}_{u}\times(\tilde{n}_{u}-n_{u})}$ expanding the
kernels of $\Pi_{1}^{L}$ and $\Pi_{2}^{L}$, respectively (i.e.,
$\Pi_{1}^{L}N_{1}=0$, and $\Pi_{2}^{L}N_{2}=0$) and some random vectors
$s^{1}_{k}\in\mathbb{R}^{(\tilde{n}_{y}-n_{y})}$ and
$s^{2}_{k}\in\mathbb{R}^{(\tilde{n}_{u}-n_{u})}$. Hence, we have
$\Pi_{1}^{L}b^{1}_{k}=\Pi_{2}^{L}b^{2}_{k}=\mathbf{0}$ for all $k$ and
$b^{1}_{k}=N_{1}s^{1}_{k}$ and $b^{2}_{k}=N_{2}s^{2}_{k}$ change randomly with
$k$.

So far, we have designed the function $\tilde{g}(\cdot)$, the immersion map
$\pi_{3}(\cdot)$, and encoding maps $\pi_{1}(\cdot)$ and $\pi_{2}(\cdot)$ to
satisfy the immersion condition (19). Next, we seek for functions
$\tilde{h}(\cdot)$, $\tilde{f}(\cdot)$, and $\tilde{m}(\cdot)$ such that the
target anomaly detector (15) encodes $\tilde{r}_{k}$, $\tilde{z}_{k}$, and
$\tilde{a}_{k}$ through affine mappings, and there exists a decoding function
that extracts the true alarm signal ${a}_{k}$ from the encoded $\tilde{a}_{k}$
(the left-invertibility condition (20)).

Figure 1: Encoding/decoding scheme.

Let $\tilde{h}(\cdot)$ be of the form
$\tilde{h}\left(\tilde{y}_{k},\hat{x}^{\prime}_{k}\right)=\Pi_{7}\tilde{y}_{k}-M_{4}\hat{x}^{\prime}_{k}$
for some $\Pi_{7}\in\mathbb{R}^{\tilde{n}_{r}\times\tilde{n}_{y}}$ and
$M_{4}\in\mathbb{R}^{\tilde{n}_{r}\times\tilde{n}_{x}}$ to be designed. We aim
to enforce that $\tilde{r}_{k}$ is an affine function of $r_{k}$, i.e.,
$\tilde{r}_{k}=\Pi_{5}{r}_{k}+b^{5}_{k}$ for some matrix $\Pi_{5}$ and
sequence $b_{k}^{5}$. Note that to satisfy the latter, we need to match this
desired expression for $\tilde{r}_{k}$ with
$\tilde{h}(\tilde{y}_{k},\hat{x}^{\prime}_{k})$ above, given (21). Then, we
have

$\displaystyle\Pi_{7}\left(\Pi_{1}y_{k}+b_{k}^{1}\right)-M_{4}\left(\Pi_{3}\hat{x}_{k}\right)=\Pi_{5}(y_{k}-C\hat{x}_{k})+b^{5}_{k}.$
(26)

To satisfy (26), we require $\Pi_{5}=\Pi_{7}\Pi_{1}$,
$M_{4}=\Pi_{7}\Pi_{1}C\Pi_{3}^{L}$, and $b^{5}_{k}=\Pi_{7}b^{1}_{k}$. Hence,
$\tilde{h}(\cdot)$ is constructed as

$\tilde{h}\left(\tilde{y}_{k},\hat{x}^{\prime}_{k}\right):=\Pi_{7}(\tilde{y}_{k}-\Pi_{1}C\Pi_{3}^{L}\hat{x}^{\prime}_{k}),$
(27)

and consequently, $\tilde{r}_{k}$ is an affine function of $r_{k}$ given by

$\tilde{r}_{k}=\Pi_{7}\left(\Pi_{1}r_{k}+b_{k}^{1}\right).$ (28)

Note that the only matrix to be designed with this choice for
$\tilde{h}(\cdot)$ is matrix $\Pi_{7}$. We only require $\Pi_{7}$ to be of
full column rank as we will use its left inverse in what follows. We follow
the same reasoning for the design of $\tilde{f}(\cdot)$, i.e., we design it to
make the encoded $\tilde{z}_{k}$ an affine function of $z_{k}$ given by
$\tilde{z}_{k}=\Pi_{6}{z}_{k}+b^{6}_{k}$. By matching this latter expression
of $\tilde{z}_{k}$ with the affine maps in (21) and the above expression for
$\tilde{r}_{k}$ in (28) yields:

$\tilde{f}\left(\tilde{r}_{k},\tilde{y}_{k}\right):=\Pi_{6}\left(\left(\Pi^{L}_{1}\Pi^{L}_{7}\tilde{r}_{k}\right)^{\top}\Sigma\left(\Pi^{L}_{1}\Pi^{L}_{7}\tilde{r}_{k}\right)\right)+\Pi_{8}\tilde{y}_{k}.$
(29)

Hence, $b_{k}^{6}:=\Pi_{8}\tilde{y}_{k}$. The encoded $\tilde{y}_{k}$ is used
in $\tilde{f}\left(\tilde{r}_{k},\tilde{y}_{k}\right)$ to inject randomness
into $\tilde{z}_{k}$ to increase privacy. Therefore, $\tilde{z}_{k}$ is an
affine function of $z_{k}$ given by

$\tilde{z}_{k}=\Pi_{6}z_{k}+\Pi_{8}\tilde{y}_{k},$ (30)

for some _full rank_ $\Pi_{6}\in\mathbb{R}^{\tilde{n}_{z}\times 1}$ and
$\Pi_{8}\in\mathbb{R}^{\tilde{n}_{z}\times\tilde{n}_{y}}$ to be designed.
Using the same technique for the design of $\tilde{m}(\cdot)$, we have

$\displaystyle\tilde{a}_{k}=\tilde{m}\left(\tilde{z}_{k},\tilde{y}_{k}\right)$
$\displaystyle:=\Pi_{4}m\left(\Pi^{L}_{6}\left(\tilde{z}_{k}-\Pi_{8}\tilde{y}_{k}\right)\right)+\Pi_{9}\tilde{y}_{k}$
(31) $\displaystyle=\Pi_{4}a_{k}+\Pi_{9}\tilde{y}_{k},$

for some _full rank_ $\Pi_{4}\in\mathbb{R}^{\tilde{n}_{a}\times 1}$ and
$\Pi_{9}\in\mathbb{R}^{\tilde{n}_{a}\times\tilde{n}_{y}}$ to be designed and
$b^{4}_{k}:=\Pi_{9}\tilde{y}_{k}$. Matrix $\Pi^{L}_{6}$ always exists because
$\Pi_{6}$ is full column rank.

Finally, we seek a function $\pi_{4}^{L}(\cdot)$ satisfying (20) (condition
(c) in Problem $1$). Given (31), condition (20) is written as

$\displaystyle\pi_{4}^{L}\left(\Pi_{4}a_{k}+\Pi_{9}\tilde{y}_{k}\right)=a_{k},$
(32)

which trivially leads to

$\pi_{4}^{L}(\tilde{a}_{k},\tilde{y}_{k}):=\Pi_{4}^{L}\left(\tilde{a}_{k}-\Pi_{9}\tilde{y}_{k}\right).$
(33)

Matrix $\Pi_{4}^{L}$ always exists due to the rank of $\Pi_{4}$.

######  Proposition 1.

_(Solution to Problem $1$)_ The encoding maps:

$\left\\{\begin{array}[]{l}\tilde{y}_{k}=\Pi_{1}y_{k}+N_{1}s_{k}^{1},\\\
\tilde{u}_{k}=\Pi_{2}u_{k}+N_{2}s_{k}^{2},\\\
\tilde{a}_{k}=\Pi_{4}a_{k}+\Pi_{9}\tilde{y}_{k},\end{array}\right.$ (34)

the target anomaly detector:

$\left\\{\begin{aligned}
\hat{x}^{\prime}_{k+1}&=\tilde{g}\left(\hat{x}_{k}^{\prime},\tilde{u}_{k},\tilde{y}_{k}\right)\\\
&:=\Pi_{3}\left(A\Pi_{3}^{L}\hat{x}_{k}^{\prime}+B\Pi_{2}^{L}\tilde{u}_{k}+L_{k}(\Pi_{1}^{L}\tilde{y}_{k}-C\Pi_{3}^{L}\hat{x}^{\prime}_{k})\right),\\\
\tilde{r}_{k}&=\tilde{h}\left(\tilde{y}_{k},\hat{x}^{\prime}_{k}\right):=\Pi_{7}(\tilde{y}_{k}-\Pi_{1}C\Pi_{3}^{L}\hat{x}^{\prime}_{k}),\\\
\tilde{z}_{k}&=\tilde{f}\left(\tilde{r}_{k},\tilde{y}_{k}\right)\\\
&:=\Pi_{6}\left(\Pi^{L}_{1}\Pi^{L}_{7}\tilde{r}_{k}\right)^{T}\Sigma^{-1}\left(\Pi^{L}_{1}\Pi^{L}_{7}\tilde{r}_{k}\right)+\Pi_{8}\tilde{y}_{k},\\\
\tilde{a}_{k}&=\tilde{m}\left(\tilde{z}_{k},\tilde{y}_{k}\right)\\\
&:=\begin{cases}\Pi_{9}\tilde{y}_{k}&\text{If}\,\,\,\,\,\left(\Pi^{L}_{6}\left(\tilde{z}_{k}-\Pi_{8}\tilde{y}_{k}\right)\right)\leq\alpha,\\\
\Pi_{4}+\Pi_{9}\tilde{y}_{k}&\text{If}\,\,\,\,\,\left(\Pi^{L}_{6}\left(\tilde{z}_{k}-\Pi_{8}\tilde{y}_{k}\right)\right)>\alpha,\end{cases}\end{aligned}\right.$
(35)

and inverse function:

$a_{k}=\pi_{4}^{L}(\tilde{a}_{k},\tilde{y}_{k}):=\Pi_{4}^{L}\left(\tilde{a}_{k}-\Pi_{9}\tilde{y}_{k}\right),$
(36)

with _full column rank matrices_ $\Pi_{1}\in\mathbb{R}^{\tilde{n}_{y}\times
n_{y}}$, $\Pi_{2}\in\mathbb{R}^{\tilde{n}_{u}\times n_{u}}$,
$\Pi_{3}\in\mathbb{R}^{\tilde{n}_{x}\times n_{x}}$,
$\Pi_{4}\in\mathbb{R}^{\tilde{n}_{a}\times 1}$,
$\Pi_{6}\in\mathbb{R}^{\tilde{n}_{z}\times 1}$, and
$\Pi_{7}\in\mathbb{R}^{\tilde{n}_{r}\times\tilde{n}_{y}}$, and full rank
matrices $\Pi_{8}\in\mathbb{R}^{\tilde{n}_{z}\times\tilde{n}_{y}}$ and
$\Pi_{9}\in\mathbb{R}^{\tilde{n}_{a}\times\tilde{n}_{y}}$ with
$\tilde{n}_{a},\tilde{n}_{z}>1$, provide a solution to Problem $1$.

_Proof_ : The proof follows from the analysis provided in the solution section
above, Section $3$. $\blacksquare$
Based on Problem $1$ and the solution in Proposition $1$, there are no
conditions on coding matrices $\Pi_{i}$, $i\in\\{1,2,\dots,9\\}$. Moreover,
the random processes $s_{k}^{1}$ and $s^{2}_{k}$ are arbitrary and potentially
unbounded. Therefore, they can be chosen to maximize privacy. Since this
algorithm eliminates the encoding-induced distortion in the decoding step, we
maximize privacy without sacrificing the anomaly detection performance. We
maximize privacy by properly selecting the encoding matrices and random
processes.
Intuitively, from (34) and (35), it is apparent that by making $\Pi_{1}$,
$\Pi_{2}$, $\Pi_{3}$, $\Pi_{4}$, $\Pi_{6}$ and $\Pi_{7}$ small, and
$b_{k}^{1}$, $b_{k}^{2}$, $\Pi_{8}$, and $\Pi_{9}$ large, the encoded data
$\tilde{y}_{k}$, $\tilde{u}_{k}$, $\tilde{r}_{k}$, $\tilde{z}_{k}$, and
$\tilde{a}_{k}$ ‘converge’ to their random terms $b^{1}_{k}$, $b^{2}_{k}$,
$\Pi_{7}b_{k}^{1}$, $\Pi_{8}b^{1}_{k}$, and $\Pi_{9}b^{1}_{k}$, and diverge
from the actual signals ${y}_{k}$, ${u}_{k}$, $r_{k}$, $z_{k}$, and $a_{k}$,
respectively. Subsequently, inferring information about private data from
disclosing data $\tilde{y}_{k}$, $\tilde{u}_{k}$, and $\tilde{a}_{k}$ would be
more difficult for adversaries.
The flowchart of the proposed scheme is shown in Figure 1. As can be seen in
this figure, all the shared information through the communication network
($\tilde{y}_{k}$, $\tilde{u}_{k}$, and $\tilde{a}_{k}$) between the user and
the remote anomaly detector is encoded.

##  4 General Guidelines for Implementation

The summary of the implementation procedure of the proposed algorithm is as
follows:

Synthesis and Operation Procedure:

  * $\bullet$

Randomly select ‘small’ full rank matrices $\Pi_{1}$-$\Pi_{4}$, and
$\Pi_{6}$-$\Pi_{7}$ of appropriate dimensions (see Proposition $1$).

  * $\bullet$

Randomly select ‘large’ full rank matrices $\Pi_{8}$-$\Pi_{9}$ of appropriate
dimensions (see Proposition $1$).

  * $\bullet$

Compute bases $N_{1}$ and $N_{2}$ of the kernels of $\Pi_{1}^{L}$ and
$\Pi_{2}^{L}$, respectively.

  * $\bullet$

Fix the distributions of the random processes $s_{k}^{1}$ and $s_{k}^{2}$ in
(34).

  * $\bullet$

At every time step $k\in\mathbb{N}$, encode $y_{k}$ and $u_{k}$ according to
(34) at the user side and send $\tilde{y}_{k}$ and $\tilde{u}_{k}$ to the
remote station.

  * $\bullet$

Have the remote station run the target anomaly detector in (35) using the
received encoded $\tilde{y}_{k}$ and $\tilde{u}_{k}$.

  * $\bullet$

The remote station sends $\tilde{a}_{k}$ back to the user.

  * $\bullet$

The user decodes the encoded alarm signal using the inverse function in (36).

##  5 Security Analysis

In the proposed scheme, because private data (input and measurement signals
and anomaly detection alarms) is encoded in all iterations, adversaries can
only obtain distorted data. Therefore, adversaries need to break the coding
system to infer information about private data. Since the coding keys are
random and changed at each time step (random additive terms), even if they
manage to break some coding matrices at some time steps, they cannot infer the
actual data due to the inclusion of randomness.
An unconditionally secure cryptosystem is a system that is secure against
adversaries with unlimited computing resources and time, see Diffie and
Hellman (2019). In Shannon (1949), Shannon proves that a necessary condition
for an encryption method to be unconditionally secure is that the uncertainty
of the secret key is larger than or equal to the uncertainty of the plaintext,
see Wang and Ju (2008). He proposes a one-time pad encryption scheme in which
the key is randomly selected and never used again. The one-time pad gives
unbounded entropy of the key space, i.e., infinite key space, which provides
unconditional security. Unconditional secrecy is lost when the key is not
random or if it is reused. The unconditional security idea can be extended to
the proposed coding mechanism. Since in the proposed I&I-based privacy-
preserving anomaly detection, the encoding keys are random and only used once,
it provides infinite key space, and thus, it can be considered unconditionally
secure.

##  6 Illustrative Case Study

The authors of Murguia and Ruths (2019) studied the anomaly detection problem
for a well-stirred chemical reactor with a heat exchanger. We use this case
study to demonstrate our results. The state, input, and output vectors of the
considered reactor are:

$\displaystyle\left\\{\begin{array}[]{ll}x_{k}=\begin{pmatrix}C_{0}\\\
T_{0}\\\ T_{w}\\\ T_{m}\end{pmatrix},u_{k}=\begin{pmatrix}C_{u}\\\ T_{u}\\\
T_{w,u}\end{pmatrix},y_{k}=\begin{pmatrix}C_{0}\\\ T_{0}\\\
T_{w}\end{pmatrix},\end{array}\right.$

where

$\displaystyle\left\\{\begin{array}[]{ll}C_{0}&:\text{Concentration of the
chemical product},\\\ T_{0}&:\text{Temperature of the product},\\\
T_{w}&:\text{Temperature of the jacket water of the heat exchanger},\\\
T_{m}&:\text{Coolant temperature},\\\ C_{u}&:\text{Inlet concentration of the
reactant}.\\\ T_{u}&:\text{Inlet temperature},\\\ T_{w,u}&:\text{Coolant water
inlet temperature}.\end{array}\right.$

$\left\\{\begin{array}[]{l}A=\left(\begin{array}[]{cccc}0.8353&0&0&0\\\
0&0.8324&0&0.0031\\\ 0&0.0001&0.1633&0\\\
0&0.0280&0.0172&0.9320\end{array}\right),\quad
B=\left(\begin{array}[]{ccc}0.0458&0&0\\\ 0&0.0457&0\\\ 0&0&0.0231\\\
0&0.0007&0.0006\end{array}\right),\quad
C=\left(\begin{array}[]{cccc}1&0&0&0\\\ 0&1&0&0\\\
0&0&1&0\end{array}\right),\quad\Sigma^{w}=0.001I_{n_{y}},\\\
\Sigma^{t}=0.001I_{n_{x}},\quad L=\left(\begin{array}[]{ccc}0.8271&0&0\\\
0&0.8243&0.0002\\\ 0&0.0002&0.1619\\\
0&0.0481&0.0543\end{array}\right),\quad\Sigma=\left(\begin{array}[]{ccc}1.0169&0&0\\\
0&1.0169&0.0001\\\ 0&0.0001&1.0105\end{array}\right),\quad
D=\left(\begin{array}[]{cccc}1\\\ 2\\\ 3\\\ 4\end{array}\right),\quad
F=\left(\begin{array}[]{cccc}1\\\ 2\\\ 3\end{array}\right).\end{array}\right.$
(37)

We use the discrete-time dynamics of the reactor introduced in Murguia et al.
(2021) for our simulation-based case study with matrices as given in (37),
normally distributed initial condition
$x_{1}\sim\mathcal{N}[(6.94;13.76;1;1)^{\top},0.001I]$, and reference signal
$u_{k}=50\cos[0.5k]^{2}$. For anomaly detection variables, we design the
desired false alarm rate $\mathcal{A}^{*}=0.1$, and the induced threshold
$\alpha^{*}=6.2514$ satisfying $\mathcal{A}=\mathcal{A}^{*}$. For the
dimensions of the target anomaly detector algorithm matrices, we consider
$\tilde{n}_{x}=8$, $\tilde{n}_{y}=4$, $\tilde{n}_{u}=4$, and
$\tilde{n}_{a}=2$. Also, for designing target anomaly detector algorithm
matrices, we randomly select small full rank matrices $\Pi_{1}$-$\Pi_{4}$ and
$\Pi_{6}$-$\Pi_{7}$, and large full rank matrices $\Pi_{8}$-$\Pi_{9}$ based on
the designed dimensions. Then, we compute bases $N_{1}$ and $N_{2}$ of the
kernels of $\Pi_{1}^{L}$ and $\Pi_{2}^{L}$, respectively. The random processes
$s_{k}^{1}$ and $s_{k}^{2}$ are defined as multivariate Gaussian variables
with large mean and covariances.
First, in Figure 2, we show the effect of the proposed coding mechanisms,
where we contrast actual and encoded measurement data. As can be seen in this
figure, since the encoded measurement $\tilde{y}_{k}$ is based on random term
$b_{k}^{1}$ for very small $\Pi_{1}$ and large $s^{1}_{k}$ in (34), it is
completely different from actual measurement $y_{k}$. Besides, the dimension
of the measurement vector $y_{k}$ is increased from three to four in the
encoded measurement $\tilde{y}_{k}$. Therefore, adversaries can not even
access the actual dimension of the measurement vector. The same result is
achieved for the comparison between actual and encoded input $u_{k}$ and
$\tilde{u}_{k}$.

(a)

(b)

Figure 2: Comparison between the measurement vector $y_{k}$ and the encoded
measurements $\tilde{y}_{k}$.

In Figure 3, the original anomaly detector alarm $a_{k}$, the encoded alarm
signal $\tilde{a}_{k}$, and the decoded alarm signal at the user $\hat{a}_{k}$
are compared. We assume that a deterministic additive fault $\delta=0.9$ is
introduced into the system from $k=20$. As can be seen in this figure, the
original alarm signal $a_{k}$ is a vector of zeros and ones, and it turns to
$1$ from $k=20$, with some misdetections. Then, the encoded alarm
$\tilde{a}_{k}$ is depicted, which is completely different from the original
one and based on its random term $\Pi_{9}b_{k}^{1}$. Besides, the dimension of
the alarm signal is increased from one to two in the encoded alarm signal
$\tilde{u}_{k}$. Then, the alarm is decoded at the user side as $\hat{a}_{k}$,
which is the same as the original alarm ${a}_{k}$. Therefore, although encoded
private signals $\tilde{y}_{k}$, $\tilde{u}_{k}$, and $\tilde{a}_{k}$ are
totally different from original signals $y_{k}$, $u_{k}$, and $a_{k}$, the
exact alarm signal can be encoded at the user side, and the proposed privacy-
preserving anomaly detection algorithm has the same detection performance as
standard anomaly detector.

Figure 3: Comparison between the alarm signal $a_{k}$, the encoded alarm
$\tilde{a}_{k}$, and the decoded one $\hat{a}_{k}$.

##  7 Conclusion

In this paper, we have developed a privacy-preserving anomaly detection
framework built on the synergy of random coding and immersion and invariance
tools from control theory. We have devised a synthesis procedure to design the
dynamics of a coding scheme for privacy and a target anomaly detector such
that trajectories of the standard detector are immersed/embedded in its
trajectories, and it works on encoded data. Random coding was formulated at
the user side as a random change of coordinates that maps original private
data to a higher-dimensional space. Such coding enforces that the target
system produces an encoded version of the standard anomaly detector alarms.
The proposed (I&I)-based anomaly detector provides the same performance as the
standard anomaly detector, reveals no information about private data, and is
computationally efficient. It provides a high level of privacy without
degrading the anomaly detection performance.

## References

  * Astolfi and Ortega (2003) Astolfi, A. and Ortega, R. (2003).  Immersion and invariance: A new tool for stabilization and adaptive control of nonlinear systems.  _IEEE Transactions on Automatic control_ , 48(4), 590–606.
  * Aström and Wittenmark (1997) Aström, K.J. and Wittenmark, B. (1997).  _Computer-controlled Systems (3rd Ed.)_.  Prentice-Hall, Inc., Upper Saddle River, NJ, USA.
  * Basseville (1988) Basseville, M. (1988).  Detecting changes in signals and systems—a survey.  _Automatica_ , 24(3), 309–326.
  * Diffie and Hellman (2019) Diffie, W. and Hellman, M.E. (2019).  New directions in cryptography.  In _Secure communications and asymmetric cryptosystems_ , 143–180. Routledge.
  * Dwork (2008) Dwork, C. (2008).  Differential privacy: A survey of results.  In _Theory and Applications of Models of Computation_ , 1–19. Springer Berlin Heidelberg, Berlin, Heidelberg.
  * Farokhi and Sandberg (2017) Farokhi, F. and Sandberg, H. (2017).  Optimal privacy-preserving policy using constrained additive noise to minimize the fisher information.  In _Proceedings of the IEEE 56th Annual Conference on Decision and Control (CDC)_.
  * Farokhi (2020) Farokhi, F. (2020).  _Privacy in Dynamical Systems_.  Springer.
  * Ferrari et al. (2021) Ferrari, R.M., Degue, K.H., and Le Ny, J. (2021).  Differentially private anomaly detection for interconnected systems.  In _Safety, Security and Privacy for Cyber-Physical Systems_ , 203–230. Springer.
  * Ferrari and Teixeira (2021) Ferrari, R.M. and Teixeira, A.M. (2021).  _Safety, Security and Privacy for Cyber-Physical Systems_.  Springer.
  * Gertler (1988) Gertler, J.J. (1988).  Survey of model-based failure detection and isolation in complex plants.  _IEEE Control systems magazine_ , 8(6), 3–11.
  * Hayati et al. (2021) Hayati, H., Murguia, C., and Van De Wouw, N. (2021).  Finite horizon privacy of stochastic dynamical systems: A synthesis framework for gaussian mechanisms.  In _2021 60th IEEE Conference on Decision and Control (CDC)_ , 5607–5613. IEEE.
  * Hayati et al. (2022) Hayati, H., Murguia, C., and van de Wouw, N. (2022).  Privacy-preserving federated learning via system immersion and random matrix encryption.  _arXiv preprint arXiv:2204.02497_.
  * Kim et al. (2022) Kim, J., Kim, D., Song, Y., Shim, H., Sandberg, H., and Johansson, K.H. (2022).  Comparison of encrypted control approaches and tutorial on dynamic systems using lwe-based homomorphic encryption.  _arXiv preprint arXiv:2210.05560_.
  * Murguia et al. (2020) Murguia, C., Farokhi, F., and Shames, I. (2020).  Secure and private implementation of dynamic controllers using semihomomorphic encryption.  _IEEE Transactions on Automatic Control_ , 65(9), 3950–3957.
  * Murguia and Ruths (2016) Murguia, C. and Ruths, J. (2016).  Characterization of a cusum model-based sensor attack detector.  In _2016 IEEE 55th Conference on Decision and Control (CDC)_ , 1303–1309. IEEE.
  * Murguia and Ruths (2019) Murguia, C. and Ruths, J. (2019).  On model-based detectors for linear time-invariant stochastic systems under sensor attacks.  _IET Control Theory & Applications_, 13(8), 1051–1061.
  * Murguia et al. (2021) Murguia, C., Shames, I., Farokhi, F., Nešić, D., and Poor, H.V. (2021).  On privacy of dynamical systems: An optimal probabilistic mapping approach.  _IEEE Transactions on Information Forensics and Security_.
  * Murguia et al. (2018) Murguia, C., Shames, I., Farokhi, F., and Nešić, D. (2018).  On privacy of quantized sensor measurements through additive noise.  In _Proceedings of the 57th IEEE Conference on Decision and Control (CDC)_.
  * Ny and Pappas (2014) Ny, J.L. and Pappas, G.J. (2014).  Differentially private filtering.  _IEEE Transactions on Automatic Control_ , 59, 341–354.
  * Paillier (1999) Paillier, P. (1999).  Public-key cryptosystems based on composite degree residuosity classes.  In _International conference on the theory and applications of cryptographic techniques_ , 223–238. Springer.
  * Ross (2014) Ross, S.M. (2014).  _Introduction to probability models_.  Academic press.
  * Shannon (1949) Shannon, C.E. (1949).  Communication theory of secrecy systems.  _The Bell system technical journal_ , 28(4), 656–715.
  * Shoukry et al. (2016) Shoukry, Y., Gatsis, K., Alanwar, A., Pappas, G.J., Seshia, S.A., Srivastava, M., and Tabuada, P. (2016).  Privacy-aware quadratic optimization using partially homomorphic encryption.  In _Proceedings of the IEEE 55th Conference on Decision and Control (CDC)_ , 5053–5058.
  * Tanaka et al. (2017) Tanaka, T., Skoglund, M., Sandberg, H., and Johansson, K.H. (2017).  Directed information as privacy measure in cloud-based control.  _arXiv preprint arXiv:1705.02802_.
  * Wan et al. (2018) Wan, J., Lopez, A., and Faruque, M.A.A. (2018).  Physical layer key generation: Securing wireless communication in automotive cyber-physical systems.  _ACM Transactions on Cyber-Physical Systems_ , 3(2), 1–26.
  * Wang and Ju (2008) Wang, C. and Ju, S. (2008).  Book cipher with infinite key space.  In _2008 International Symposium on Information Science and Engineering_ , volume 1, 456–459. IEEE.