A Distributionally Robust Optimal Control Approach for Differentially Private Dynamical Systems

1. Problem Statement

The paper addresses the challenge of controlling a dynamical system in a cloud-based architecture where a resource-limited plant outsources control computation to a semi-honest, untrusted remote server.

• Privacy Constraint: To protect the plant's state trajectory from the server (which may attempt to infer sensitive states), the plant injects calibrated noise into its output measurements to satisfy Differential Privacy (DP) guarantees.
• The Uncertainty Gap: Unlike prior works that assume the server knows the exact noise distribution (e.g., specific Gaussian variance) and parameters, this paper assumes the server does not know the specific mechanism (Gaussian vs. Laplace) or the exact noise parameters chosen by the plant.
• The Ambiguity Set: The server only has access to an ambiguity set ($\Xi$) containing admissible noise distributions. This set is the union of:
  • Gaussian distributions with variance $\sigma^2 \in [\underline{\sigma}^2, \overline{\sigma}^2]$.
  • Laplace distributions with scale parameter $b \in [\underline{b}, \overline{b}]$.
• The Objective: The server must design an optimal output-feedback controller that minimizes the worst-case expected cost over all possible distributions within this ambiguity set.

Key Challenge: The original optimization problem is a minimax problem over a non-convex ambiguity set (the union of Gaussian and Laplace distributions), making it computationally intractable.

2. Methodology

The authors propose a Distributionally Robust Optimal Control (DROC) framework that transforms the intractable problem into a solvable form through relaxation and duality.

A. Relaxation via KL-Divergence Ball

To handle the non-convexity of the ambiguity set $\Xi$, the authors construct a convex Kullback–Leibler (KL) divergence ball ($\mathcal{B}_\eta$) centered at a nominal Gaussian distribution ($P_{nom}$).

• They prove that all admissible distributions in $\Xi$ (both Gaussian and Laplace variants) lie within this KL-divergence ball with a specific radius $\eta$.
• The original problem is relaxed to minimize the worst-case cost over this convex set $\mathcal{B}_\eta$.

B. Reformulation as Risk-Sensitive Control

Using strong duality and the Donsker-Varadhan variational formula, the authors show that the relaxed minimax problem is mathematically equivalent to a Risk-Sensitive Optimal Control problem.

• The inner maximization over the probability distribution is converted into an exponential transformation of the cost function.
• The problem becomes: $\inf_{\tau > 0} \tau (\eta + W_\tau)$, where $W_\tau$ is the optimal value of a risk-sensitive control problem with risk-sensitivity parameter $\theta = 1/\tau$.

C. Closed-Form Solution

For a fixed risk-sensitivity parameter $\tau$, the problem admits a tractable, closed-form solution with an LQG-like structure:

1. State Estimator: A modified Kalman filter where the Riccati equation includes a term dependent on $\tau$ (specifically $-Q/\tau$), coupling the estimation error with the risk sensitivity.
2. Feedback Policy: A linear state-feedback controller derived from a backward Riccati equation, also modified by $\tau$.
3. Optimization: The optimal controller is found by performing a 1D search over $\tau > 0$ to minimize the objective function derived in the reformulation.

3. Key Contributions

1. Novel Problem Formulation: This is the first work to synthesize an optimal controller for differentially private dynamical systems that simultaneously accounts for non-Gaussian noise (Laplace) and distributional ambiguity (unknown parameters).
2. Tractable Reformulation: The paper bridges the gap between distributionally robust control and risk-sensitive control, providing a computationally efficient closed-form solution for a problem that was previously intractable due to non-convexity.
3. Robustness Guarantee: The proposed controller guarantees performance against the worst-case noise distribution within the admissible set, rather than just the nominal distribution.
4. Privacy-Performance Trade-off Analysis: The framework explicitly links the privacy budget ($\epsilon, \delta$) to the controller's risk-sensitivity parameter, showing how stricter privacy requirements (smaller $\epsilon$) necessitate higher noise levels, which in turn alters the optimal control policy.

4. Simulation Results

The authors validated their approach using a numerical example with a discrete-time linear system ($N=20$).

• Comparison: The proposed DROC method was compared against a standard Linear Quadratic Gaussian (LQG) controller designed assuming the nominal noise distribution.
• Performance Metrics:
  • Robustness: The proposed method significantly reduced the 95th percentile and worst-case values of the cost function ($J(K)$) compared to the standard LQG when the true noise parameters deviated from the nominal assumption.
  • Trade-off: This robustness came at the cost of a slight degradation in the mean (average-case) performance, which is expected in risk-averse formulations.
• Privacy Sensitivity: Simulations varying the privacy parameters ($\epsilon, \delta$) showed that as privacy requirements became stricter (lower $\epsilon$), the control cost increased, demonstrating the inherent trade-off between privacy and control performance.

5. Significance

This work is significant for the deployment of secure cloud control systems.

• Practicality: It resolves a critical limitation in existing literature where servers are assumed to know exact noise statistics, which is often unrealistic in privacy-sensitive scenarios where plants withhold such data.
• Flexibility: By accommodating both Gaussian and Laplace mechanisms, the approach supports stronger privacy guarantees (pure $\epsilon$-DP via Laplace) without sacrificing the ability to synthesize optimal controllers.
• Theoretical Advancement: It provides a rigorous mathematical pathway to solve distributionally robust control problems involving non-convex ambiguity sets by leveraging convex relaxations and risk-sensitive control theory.