Real-Time Privacy-Preserving Data Release for Smart Meters

Mohammadhadi Shateri, Member, IEEE, Francisco Messina, Member, IEEE, Pablo Piantanida, Senior Member, IEEE, Fabrice Labeau, Senior Member, IEEE

Abstract-Smart Meters (SMs) are able to share the power consumption of users with utility providers almost in real-time. These fine-grained signals carry sensitive information about users, which has raised serious concerns from the privacy viewpoint. In this paper, we focus on real-time privacy threats, i.e., potential attackers that try to infer sensitive information from SMs data in an online fashion. We adopt an information-theoretic privacy measure and show that it e↵ectively limits the performance of any attacker. Then, we propose a general formulation to design a privatization mechanism that can provide a target level of privacy by adding a minimal amount of distortion to the SMs measurements. On the other hand, to cope with di↵erent applications, a flexible distortion measure is considered. This formulation leads to a general loss function, which is optimized using a deep learning adversarial framework, where two neural networks -referred to as the releaser and the adversary-are trained with opposite goals. An exhaustive empirical study is then performed to validate the performance of the proposed approach and compare it with state-of-the-art methods for the occupancy detection privacy problem. Finally, we also investigate the impact of data mismatch between the releaser and the attacker. Index Terms-Privacy-preserving mechanism, Deep learning,

Adversarial training, Time series data, Recurrent Neural Networks, Long-Short Term Memory (LSTM) cell, Directed information, Privacy-utility trade-o↵, Smart meters privacy.

I. Introduction

A. Motivation

S Ms are a cornerstone for the development of smart electrical grids. These devices are able to report power consumption measurements of a house to a utility provider every hour or even every few minutes. This feature generates a considerably amount of useful data which enables several applications in almost real-time such as power quality monitoring, timely fault detection, demand response, energy theft prevention, etc. [START_REF] Alahakoon | Smart electricity meter data intelligence for future energy systems: A survey[END_REF], [START_REF] Wang | Review of smart meter data analytics: Applications, methodologies, and challenges[END_REF]. However, this fine-grained power consumption monitoring poses a threat to consumers privacy. As a matter of fact, it has been shown that simple algorithms, known in general as NonIntrusive Load Monitoring (NILM) methods, can readily be used to infer the types of appliances being used at a household at a given time from the SMs data [START_REF] Molina-Markham | Private memoirs of a smart meter[END_REF]. Since these features are highly correlated with the presence of people at the dwelling and their personal habits, this induces serious privacy concerns which can have an impact on the acceptance M. Shateri, F. Messina, and F. Labeau are with the Department of Electrical and Computer Engineering, McGill University, QC, Canada. Email:{mohammadhadi.shateri,francisco.messina}@mail.mcgill.ca P. Piantanida is with Laboratoire des Signaux et Systèmes, CentraleSupélec-CNRS-Université Paris Sud, Gif-sur-Yvette, France and with Montreal Institute for Learning Algorithms (Mila), Université de Montréal, QC, Canada. and deployment pace of SMs [START_REF] Mckenna | Smart meter data: Balancing consumer privacy concerns with legitimate applications[END_REF]. The natural challenge raised here is: how can privacy be enhanced while preserving the utility of the SMs data? Although the privacy problem has been widely studied in the field of data science [START_REF] Jain | Big data privacy: a technological perspective and review[END_REF], the time series structure of SMs data requires a particular treatment [START_REF] Asghar | Smart meter data privacy: A survey[END_REF]. For a recent survey about SMs privacy, the reader is referred to [START_REF] Giaconi | Privacy-aware smart metering: Progress and challenges[END_REF].

B. Related work

Simple approaches for preservation of privacy in the context of SMs include data aggregation and encryption [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF], [START_REF] Rottondi | Distributed privacy-preserving aggregation of metering data in smart grids[END_REF], the use of pseudonyms rather than the real identities of users [START_REF] Efthymiou | Smart grid privacy via anonymization of smart metering data[END_REF], downsampling of the data [START_REF] Mashima | Authenticated down-sampling for privacy-preserving energy usage data sharing[END_REF], [START_REF] Eibl | Influence of data granularity on smart meter privacy[END_REF] and random noise addition [START_REF] Barbosa | A technique to provide differential privacy for appliance usage in smart metering[END_REF]. However, these methods often restrict the potential applications of the SMs data in an uncontrolled way. For instance, downsampling of the data may incur time delays to detect critical events, while data aggregation degrades the positioning and accuracy of the power measurements.

A formal approach to the privacy problem has been presented in [START_REF] Sankar | Smart meter privacy: A theoretical framework[END_REF] from an information-theoretic perspective, where it has been proposed to assess privacy by the MI between the sensitive variables to be hidden and the power measurements distorted by a privatizer mechanism. More specifically, the authors model the power measurements of SMs with a hidden Markov model in which the distribution of the measurements is controlled by the state of the appliances, and for each particular state, the distribution of power consumption is assumed to be Gaussian. This model is then used to obtain the privacy-utility trade-o↵ using tools from rate-distortion theory [START_REF] Cover | Elements of information theory[END_REF]. Although this approach is very appealing, it has two important limitations for its application to real-time privacy problems using actual data. First, the privacy-preserving data release mechanism works with blocks of samples, which is not well-suited for real-time processing. Second, the Gaussian model may be quite restrictive to model SMs signals. The information-theoretic approach was used in other privacy-aware SMs studies such as [START_REF] Zheng | Privacy-utility trade-o↵ for smart meter data considering tracing household power usage[END_REF] where the MI between the distorted SMs data and sensitive appliance states at time slot t was considered as the privacy measure. However, in this work, the temporal correlation in SMs data is not taken into account.

More sophisticated approaches consider the use of Rechargeable Batteries (RBs) and Renewable Energy Sources (RES) in homes in order to modify the actual energy consumption of users with the goal of hiding the sensitive information [START_REF] Kalogridis | Privacy for smart meters: Towards undetectable appliance load signatures[END_REF]- [START_REF] Giaconi | Smart meter privacy with renewable energy and an energy storage device[END_REF]. The main motivation to introduce the use of physical resources into the privacy problem comes from the observation that this strategy does not require any distortion in the actual SMs measurements, which means that there is no loss in terms of utility. However, the incorporation of physical resources may not only make the problem more complex and limited in scope, but can also generate a significant cost to users due to the faster wear and tear of the RBs as a consequence of the increased charging/discharging rate [START_REF] Giaconi | Privacy-aware smart metering: Progress and challenges[END_REF]. On the other hand, the required level of distortion for a specific privacy goal in a realistic scenario in which the attacker threatening privacy has only partial information is still an open question. Thus, the need and convenience of these solutions is still questionable. However, it is also important to note that these approaches are complementary to the ones based on distorting the power measurements.

The use of neural networks to model a privacy attacker has been considered in [START_REF] Wang | On methods for privacy-preserving energy disaggregation[END_REF]. However, a more powerful formulation of the problem is obtained if one assumes that both the releaser (i.e., the privatizer) and the attacker are deep neural networks (DNNs). In this framework, the releaser can be trained by simulating an attacker based on a minimax game, an idea that is inspired by the well-known Generative Adversarial Networks (GANs) [START_REF] Goodfellow | Generative adversarial nets[END_REF]. This concept can be referred to as Generative Adversarial Privacy (GAP) [START_REF] Huang | Generative adversarial privacy[END_REF] and is the basis for the approach taken in the present work. It should be mentioned that the concept of GAP has been studied for di↵erent applications related to image classification [START_REF] Tripathy | Privacy-preserving adversarial networks[END_REF], [START_REF] Feutry | Learning Anonymized Representations with Adversarial Neural Networks[END_REF] but, to the best of our knowledge, not in the context of SMs. In these works, the authors consider independent and identically distributed (i.i.d.) data and deep feed-forward neural networks for the releaser and attacker, which are unable to capture and exploit the time correlation in the time series SMs signals. The idea of time-series generation with an adversarial approach has been considered in [START_REF] Esteban | Real-valued (medical) time series generation with recurrent conditional gans[END_REF] for medical data based in the principle of di↵erential privacy.

C. Contributions

In this paper, we adopt a distortion-based real-time privacypreserving strategy. For simplicity, we assume that no RBs and/or RESs are available and thus, the distortion on power measurements is the only mean to achieve a desired privacy level. The main contributions of this work, which is an extension of a short version in [START_REF] Shateri | Deep directed information-based learning for privacy-preserving smart meter data release[END_REF], are the following:

(i) We applied DI as a privacy measure and show its theoretical relevance for the privacy problem under consideration. It is worth to mention that DI was first used in [START_REF] Erdogdu | Privacy-utility trade-o↵ under continual observation[END_REF] but in a di↵erent manner. In addition, unlike this and other works such as [START_REF] Sankar | Smart meter privacy: A theoretical framework[END_REF] , we impose no explicit assumptions on the generating model of the power measurements, but take a more versatile datadriven approach. (ii) We study di↵erent distortion measures to provide more flexibility to control the specific features to be preserved in the released signals, i.e., the relevant characteristics for the targeted applications of the data. (iii) For the sake of computational tractability, we propose a loss function for training the privacy-preserving releaser based on an upper bound of the DI. Then, considering an attacker that minimizes a Kullback-Leibler divergence between the true and approximate distributions of the sensitive variables given the released signal, we provide a relaxed formulation of the original problem suitable for a deep learning framework. (iv) We perform an extensive statistical study with actual data to characterize the utility-privacy trade-o↵s and the nature of the distortion generated by the releaser network. (v) We investigate the data mismatch problem in the context of SMs privacy, which occurs when the data available to the attacker is not the same as the one used for training the releaser mechanism, and show that it has an important impact on the privacy-utility trade-o↵. This confirms that, under some conditions, the privacy-utility trade-o↵ can indeed be much less severe than expected. (vi) To the best of our knowledge, this is the first time that the concept of the generative adversarial privacy is used in the context of the SMs data privacy preservation. In addition, in this paper we consider deep RNNs to capture and exploit the time correlation of SMs signals.

D. Organization of the paper

The rest of the paper is organized as follows. In Section II, we present the theoretical formulation of the problem. This leads to the loss functions for the releaser and attacker posed in Section III, where the privacy-preserving adversarial framework is introduced along with the training algorithm. Extensive results are presented and discussed in Section IV. Finally, some concluding remarks are presented in Section V.

II. Problem Formulation

The privacy-preserving framework studied in this paper is presented in Fig. 1. As shown, a data releaser (which is aware of the private attributes that the user wants to hide) manipulates the actual SM measurements before sharing them to the UP to prevent leakage of sensitive information that could be inferred by a malicious attacker such as an eavesdropper.

There are four main types of variables that should be clearly defined in the privacy-preserving data release setting: (i) the private/sensitive attribute which we aim to hide X T (e.g., occupancy state of a house over time); (ii) the useful process for the utility provider Y T (e.g., actual electricity consumption of the household), which is generally highly correlated with the private data; (iii) the observed signal W T , a combination of private and useful variables, which is the input to the data release system; (iv) and the released process Z T , a sanitized version of Y T which is the output of the data release system.

We assume that X t takes values on a fixed discrete alphabet X for each t 2 {1, . . . , T }. At each time t, a releaser produces the released process Z t based on the observation W t , while an attacker attempts to infer X t based on Z t by using an approximation of p X T |Z T , which we shall denote by p XT |Z T . Notice that the releaser must be causal in order to avoid delays in the SMs data report process. In addition, we treat the case in which the attacker is performing the inference in real-time, so that it is also causal. This assumption is reasonable for scenarios in which the sensitive information is valuable in a timely manner (e.g., in the case of targeted burglary based on occupancy detection [START_REF] Asghar | Smart meter data privacy: A survey[END_REF]). However, it should be noted that not all privacy threats fall under this umbrella. Alternative attacker structures, which may be interesting in other scenarios, are left for future work and are out of the scope of this paper. Note that due to the previous assumption the distribution p Z T XT |W T can be decomposed as follows:

p Z T XT |W T (z T , xT |w T ) = T Y t=1 p Zt|W t (z t |w t )p Xt|Z t ( xt |z t ). (1)
In abstract terms, the goal of the releaser is to minimize the information leakage of the sensitive process X T while simultaneously keeping the distortion between the released time series Z T and the useful signal Y T small. On the other hand, the goal of the attacker is to infer p Xt|Z t , for each t, as accurately as possible. Note that after the approximation p Xt|Z t is obtained, the attacker can estimate the private information x t from observations z t in an online (causal) fashion, by solving

argmax xt2X p Xt|Z t ( xt |z t ), (2)
at each t = 1, . . . , T . Thus, the attacker can be interpreted as a classifier or hypothesis test, as stated in [START_REF] Li | Privacy against a hypothesis testing adversary[END_REF]. However, in the present case, we consider the more realistic and general scenario in which the statistical test is sub-optimal due to the fact that the attacker has no access to the actual conditional distributions p Xt|Z t but only to its approximation p Xt|Z t .

In order to take into account the causal relation between X T and XT , the information leakage is quantified by the DI [START_REF] Massey | Causality, feedback and directed information[END_REF]:

I(X T ! XT ) B T X t=1 I(X t ; Xt | Xt 1 ), (3)
where I(X t ; Xt | Xt 1 ) is the conditional MI between X t and Xt conditioned on Xt 1 [START_REF] Cover | Elements of information theory[END_REF]. The normalized expected distortion between Y T and its noisy (or disturbed) observation Z T is defined as:

D(Z T , Y T ) B E[d(Z T , Y T )] T , (4)
where d : R T ⇥ R T ! R is any distortion function (i.e., a metric on R T ). To ensure the quality of the release, it is natural to impose the following constraint: D(Z T , Y T )  " for some given " 0. In previous works, the normalized squared-error was considered as a distortion function (e.g., [START_REF] Sankar | Smart meter privacy: A theoretical framework[END_REF], [START_REF] Shateri | Deep directed information-based learning for privacy-preserving smart meter data release[END_REF]). Nevertheless, other distortion measures can also be relevant within the framework of SMs. For instance, demand response programs usually require an accurate knowledge of peak power consumption, so a distortion function closer to the infinity norm would be more meaningful for those particular applications. Thus, for the sake of generality and to keep the distortion function simple, we propose to use an `p distance:

d(z T , y T ) B kz T y T k p = 0 B B B B B B B @ T X t=1 |z t y t | p 1 C C C C C C C A 1/p , ( 5
)
where p 2 is a fixed parameter. Note that this distortion function leads to the root-mean-squared error when p = 2, while it converges to the maximum error between the components of z T and y T as p ! 1.

Therefore, the problem of finding an optimal releaser subject to the optimal (Bayesian) attacker and distortion constraint can be formally written as follows:

inf p Z T |W T I ⇣ X T ! XT ⌘ subject to D(Z T , Y T )  ". (6)
Note that the solution to this optimization problem requires a balance between the attacker p XT |Z T and the releaser p Z T |W T , where the optimal attacker consists in inferring the private information XT ⇡ X T and thus, the attacker attempts to minimize the Kullback-Leibler divergence [START_REF] Cover | Elements of information theory[END_REF]

where the expectation is with respect to p X T Z T . Note that solving [START_REF] Giaconi | Privacy-aware smart metering: Progress and challenges[END_REF]

is equivalent to minimizing E[ log p Xt |Z t (X t |Z t )],
the so-called cross-entropy. Unfortunately, the optimization problem ( 6) is, in general, computationally intractable. For instance, simply computing the DI would take O(|X| T ) operations, where |X| is the size of X, which makes it not scalable for large sequences of data. However, it can be exploited to obtain a more convenient surrogate objective function for the releaser, by considering the following simpler upper bound:

I ⇣ X T ! XT ⌘ = T X t=1 h H( Xt | Xt 1 ) H( Xt | Xt 1 , X t ) i (i)  T X t=1 h H( Xt | Xt 1 ) H( Xt | Xt 1 , X t , Z t ) i (ii) = T X t=1 h H( Xt | Xt 1 ) H( Xt |Z t ) i (iii)  T log|X| T X t=1 H( Xt |Z t ), (8)
where (i) is due to the fact that conditioning reduces entropy; equality (ii) is due to the Markov chain (X t , Xt 1 ) ⌦ Z t ⌦ Xt , which follows from (1); and (iii) is due to the trivial bounds H( Xt | Xt 1 )  H( Xt )  log(|X|). Note that minimizing the upper bound (8) corresponds to maximizing P T t=1 H( Xt |Z t ), which amounts to maximizing the total uncertainty of the attacker. In fact, from Fano's inequality [START_REF] Cover | Elements of information theory[END_REF], we have that f (P e,t ) B h(P e,t ) + P e,t log(|X| 1) H( Xt |X t ) H( Xt |Z t ), [START_REF] Rottondi | Distributed privacy-preserving aggregation of metering data in smart grids[END_REF] where P e,t B P(X t , Xt ) and h(p) B p log(p) (1 p) log(1 p) is the so-called binary entropy function. In addition, the bound is tight (i.e., it can not be strengthened without further assumptions) [START_REF] Cover | Elements of information theory[END_REF], [START_REF] Ho | On the interplay between conditional entropy and error probability[END_REF]. It should be noted that this bound constrains P e,t to be in an interval around P e,t = (|X| 1)/|X|, which corresponds to the performance of an attacker that does uniform random guessing to infer the value of X t . Indeed, in the extreme case in which H( Xt |Z t ) = log(|X|), we have that P e,t = (|X| 1)/|X|. Physically, this means that Z t is not providing any information to the attacker to infer X t . Moreover, the length of this interval decreases monotonically when H( Xt |Z t ) is increased. Fig. 2 is presented to illustrate the proposed scenario for the binary case. From Fig. 2 it can be noticed that as H( Xt |Z t ) increases, the interval over which P e,t lies shrinks. Also, in the extreme case in which H( Xt |Z t ) = log(2), Fano's inequality [START_REF] Rottondi | Distributed privacy-preserving aggregation of metering data in smart grids[END_REF] implies P e,t = 1/2, which corresponds to the performance of random guessing the value of X t , meaning that Z t does not provide any valuable information. Therefore, a releaser which attempts to maximize H( Xt |Z t ) is trying to constrain P e,t to be close to random guessing performance. This can be considered as a universal privacy guarantee and justifies the usefulness of the DI and, in particular, the surrogate upper bound [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF].

Therefore, in this work, the information leakage is measured by the following average conditional entropy (ignoring constant terms):

1 T T X t=1 H( Xt |Z t ), (10)
where the factor 1/T has been introduced for normalization purposes. It is interesting to notice that this is di↵erent from the formulation in [START_REF] Sankar | Smart meter privacy: A theoretical framework[END_REF], in which the authors consider the MI I(X T ; Z T ) = H(X T ) H(X T |Z T ) as the information leakage measure, which can be equivalently written as follows (again ignoring constant terms and normalizing):

1 T T X t=1 H(X t |Z T , X t 1 ). ( 11
)
By comparing [START_REF] Efthymiou | Smart grid privacy via anonymization of smart metering data[END_REF] and [START_REF] Mashima | Authenticated down-sampling for privacy-preserving energy usage data sharing[END_REF], the di↵erences between the two privacy measures are clear. The fact that we have assumed that the attacker has a causal structure explains why Z t appears in [START_REF] Efthymiou | Smart grid privacy via anonymization of smart metering data[END_REF] instead of Z T as in [START_REF] Mashima | Authenticated down-sampling for privacy-preserving energy usage data sharing[END_REF]. More fundamentally, the expression [START_REF] Mashima | Authenticated down-sampling for privacy-preserving energy usage data sharing[END_REF] corresponds to assuming that the attacker is optimal (i.e., p Xt|Z t = p Xt|Z t ) and has access to X t 1 to infer X t . These latter assumptions are not expected to hold in practice.

III. Privacy-Preserving Model

We now shift the focus from the abstract theoretical formulation to a practical one based on deep learning ideas. In particular, in this section, we model the releaser p Z T |W T and attacker p XT |Z T as RNNs, which are well-suited for the timeseries structure of the SMs data and online processing. In the following, we describe in detail the loss functions, the network architectures and the learning algorithm used to train the releaser mechanism.

A. Loss Functions

Considering ( 6) and [START_REF] Efthymiou | Smart grid privacy via anonymization of smart metering data[END_REF], the loss function for the releaser is defined as follows:

L R (✓, , ) B D(Z T , Y T ) T T X t=1 H( Xt |Z t ), (12)
where 0 controls the privacy-utility trade-o↵, ✓ are the parameters of the releaser and are the parameters of the adversary. It should be mentioned that for = 0, the loss function L R (✓, , ) reduces to the expected distortion, being independent from the adversary. In such scenario, the releaser o↵ers no privacy guarantees. Conversely, for very large values of , the loss function L R (✓, , ) is dominated by the second term, so that privacy is the main goal of the releaser. In this regime, we expect the attacker to fail in inferring X T , i.e., to approach to random guessing performance.

On the other hand, from [START_REF] Giaconi | Privacy-aware smart metering: Progress and challenges[END_REF], the adversary loss function is defined as follows:

L A ( ) B 1 T T X t=1 E h log p Xt|Z t (X t |Z t ) i , (13)
where the expectation is with respect to p XtZ t . It should be mentioned that for training the previous loss functions are approximated by evaluating the expectations empirically as shown next. Let {(x (b)T , y (b)T )} B b=1 be a sample of B examples and {z (b)T } B b=1 the corresponding outputs of the releaser. Then, the loss functions are approximated as follows:

L R (✓, , ) ⇡ 1 BT B X b=1 d(z (b)T , y (b)T ) + BT B X b=1 X x(b) t 2X p Xt|Z t ( x(b) t |z (b)t ) log p Xt|Z t ( x(b) t |z (b)t ), (14)
L A ( ) ⇡ 1 BT T X t=1 B X b=1 log p Xt|Z t (x (b) t |z (b)t ). (15)

B. Recurrent Neural Networks and Long Short-Term Memory

RNNs are a class of neural networks that are able to process sequential data by modeling the temporal correlation in data. Therefore, the output of an RNN network at time step t 1 generally a↵ects the output at time t. Training of the RNNs is generally performed by gradient descent using the backpropagation through time algorithm [START_REF] Werbos | Backpropagation through time: what it does and how to do it[END_REF]. However, learning long-term dependencies of time series data by RNNs may lead to the gradient vanishing or exploding problems, thus preventing successful training [START_REF] Bengio | Learning long-term dependencies with gradient descent is di cult[END_REF]. To resolve this issue, the so-called LSTM cell was introduced in [START_REF] Hochreiter | Long short-term memory[END_REF] and further improved in [START_REF] Gers | Learning to forget: continual prediction with lstm[END_REF]. Fig. 3 represents the architecture of a LSTM cell in detail. The LSTM cell includes four gating units to control the flow of information. All the gating units have a sigmoid activation function ( ) except for the input unit that uses an hyperbolic tangent activation function (tanh) by default. Considering w T = (w 1 , w 2 , . . . , w T ) as the input, the formulations of the LSTM nodes at time step t are represented in equation ( 16) where the parameters b, K, V are respectively biases, input weights, and recurrent weights:

f t = (b f + K f h t 1 + V f w t ) g t = (b g + K g h t 1 + V g w t ) i t = (b i + K i h t 1 + V i w t ) o t = (b o + K o h t 1 + V o w t ) C t = f t ⇥ C t 1 + g t ⇥ i t h t = o t ⇥ tanh (C t ) (16)
In the LSTM architecture, the forget gate f t uses the output of the previous cell (which is called hidden state h t 1 ) to control the cell state C t to remove irrelevant information. On the other hand, the input gate g t and input unit i t adds new information to C t from the current input. Finally, the output gate o t generates the output of the cell from the current input and cell state. For more details on RNNs and LSTMs, the reader is referred to [START_REF] Goodfellow | Deep Learning[END_REF] and references therein.

C. Privacy-Preserving Adversarial Learning

Based on the previous formulation, an adversarial modeling framework consisting of two RNNs, a releaser R ✓ and an adversary A , is considered (see Fig. 4). Note that independent noise U T (with dimension m) is appended to W T in order to randomize the released variables Z T , which is a popular approach in privacy-preserving methods. In addition, the available theoretical results show that, for Gaussian distributions, the optimal release contains such a noise component [START_REF] Sankar | Smart meter privacy: A theoretical framework[END_REF], [START_REF] Tripathy | Privacy-preserving adversarial networks[END_REF]. For both networks, a LSTM architecture is selected. Training in the suggested framework is performed using the Algorithm 1 which requires k gradient steps to train A followed by one gradient step to train R ✓ . It is worth to emphasize that k should be large enough in order to ensure that A represents a strong adversary. However, if k is too large, this could lead to overfitting and thus a poor adversary. After the training of both networks is completed, a new network is trained from scratch in order to test the privacy achieved by the releaser network.

IV. Results and Discussion

We will validate our results on the Electricity Consumption & Occupancy (ECO) dataset. ECO is collected and published by [START_REF] Beckel | The eco data set and the performance of non-intrusive load monitoring algorithms[END_REF], which includes 1 Hz power consumption measurements and occupancy information of five houses in Switzerland over a period of 8 months. Occupancy labels are determined as 1 for the case that someone is at home and 0 otherwise. Thus, for this application, the privacy attacker is a binary classifier that attempts to infer if a household is occupied or not at a given time. In this study, we resampled the data to have hourly samples. We model the time dependency over each day, so the dataset is reshaped to sample sequences of length 24. A total number of 11225 sample sequences were collected. The datasets are split into training and test sets with a ratio of roughly 85:15 while 10% of training data is dedicated to validation which intended to set the hyperparameters. The network architectures and hyperparameters values are summarized in Table I. A stronger attacker composed of 3 LSTM layers is used for the test.

To clearly assess the distortion with respect to the actual power consumption measurements, we define the Normalized Error (NE) for the di↵erent `p distortion functions as follows:

NE p B E h kY T Z T k p i E h kY T k p i . ( 17
)
In addition, performance of the attacker on inferring the private attributes is quantified based on the balanced accuracy. This is common in classification problems to deal with the data imbalance problem, which occurs when the number of samples for k steps do Compute the gradient of L A ( ), empirically approximated with the minibatch B, with respect to .

5:

Update by applying the RMSprop optimizer [START_REF] Hinton | Neural networks for machine learning lecture 6a overview of mini-batch gradient descent[END_REF] with clipping value C. Compute the gradient of L R (✓, , ), approximated with the minibatch B, with respect to ✓.

9:

Use Ridge(L 2 ) regularization [START_REF] Hastie | The elements of statistical learning: data mining, inference and prediction[END_REF] with value and update ✓ by applying RMSprop optimizer with clipping value C. 10: end for for each class is quite di↵erent. Balanced accuracy is defined as the average recall calculated for each class [START_REF] Mosley | A balanced approach to the multi-class imbalance problem[END_REF]. Concretely, let c i j represent the fraction of examples of class i classified as class j. Then, the balanced accuracy can be defined as Balanced Accuracy B 1 2

c 11 c 11 + c 12 + c 22 c 22 + c 21 ! . (18)
This metric provides a fair assessment of the quality of the attacker independently from the degree of data unbalance. Thus, simplifying the analysis of the results. In the following we use the term accuracy to refer to the balanced accuracy.

A. `2 Distortion

In this section, we consider the `2 distortion function (i.e., p = 2 in (5)). Fig. 5 shows the empirically found privacyutility trade-o↵ for this scenario. Note that by increasing the distortion of the release, the accuracy of the attacker changes from more than 80% (almost no privacy) to 50% (full privacy).

To assess the quality of the release signal, utility providers may be interested in several di↵erent indicators. These include, for instance, the mean, skewness, kurtosis, standard deviation to mean ratio, and maximum to mean ratio [START_REF] Shen | Power quality disturbance monitoring and classification based on improved pca and convolution neural network for wind-grid distribution systems[END_REF]. Thus, for completeness, we present these indicators in Table II for three di↵erent cases along the privacy-utility trade-o↵ curve. We observe that in general the errors in these indicators are small when the privacy constraints are lax and increase as they become stricter. Nevertheless, no simple relation can be expected between NE 2 and the values of those indicators.

1) Comparison with regular random noise addition approach:

As it was discussed in Section III, the proposed model in this study provides privacy through distorting the SMs data. However, in contrast with the regular random noise addition approaches [START_REF] Barbosa | A technique to provide differential privacy for appliance usage in smart metering[END_REF] where a random noise E t is added to the SMs data (i.e. Z t = Y t + E t , for t 2 {1, 2, . . . , T }), our model distorts the SMs data by performing a noisy recurrent transformation on Z T . To compare our method with the regular random noise addition method, four di↵erent cases for random noise E t were considered: Laplacian, Gaussian, Uniform, and U-quadratic. In all cases, the amount of distortion is controlled by the variance of noise. The same type of attacker as the one presented in Table I is used to infer the private data out of the distorted one. Fig. 6 shows the privacy-utility trade-o↵ for these random noise addition approaches as compared with our model. It can be seen clearly that, for the same amount of distortion, our method is more successful in preventing the attacker from inferring the private information. This is expected, as our method is able to learn the noise distribution to fit the actual demand load and the sensitive information that is being hidden from the attacker, which is a much more powerful approach than just using a fixed noise distribution. Notice also that, as expected, all results are similar as the distortion approaches to zero. For some of the random noise addition cases, the fitted curves cross over the one of our model, but in the low distortion low privacy area of the graph, which is not of interest.

Fig. 6. Privacy-utility trade-o↵ for house occupancy inference using the random noise addition approach.

2) Comparison with PPAN model:

The main limitation of the random noise addition approach is that the noise mechanism is independent of the SMs data. A more sophisticated strategy that address this issue would be the PPAN model [START_REF] Tripathy | Privacy-preserving adversarial networks[END_REF]. This method uses a variational lower bound on I(X t ; Z t ) to train a releaser using an adversarial learning approach. For more details of this approach the readers are referred to [START_REF] Tripathy | Privacy-preserving adversarial networks[END_REF]. Fig. 7 shows the privacy-utility trade-o↵ of the PPAN model as compared with our method using the same type of attacker as presented in Table I. For the PPAN, both the mechanism and adversary networks are deep neural networks including three hidden layers with 64 nodes and a rectified linear unit (ReLU) activation function, while the RMSprop optimizer [START_REF] Tieleman | Lecture 6.5-rmsprop: Divide the gradient by a running average of its recent magnitude[END_REF] with learning rate 0.01 is used. From Fig. 7 it can be seen that our method can clearly outperform the PPAN. The reason for this gap can be attributed to both the di↵erent cost function formulation (i.e., the fact that we are using an upper bound on I(X T ! XT ) instead of a lower bound on I(X t ; Z t )) and the recurrent structure of the proposed releaser mechanism.

B. `p Distortion

As already discussed in Section II, the distortion function should be properly matched to the intended application of the released variables Z T in order to preserve the characteristics of the target variables Y T that are considered essential. In this section, we consider the `p distortion (5) with p = 4, 5 as an alternative to the `2 distortion function used in the previous section and study their potential benefits.

The privacy-utility trade-o↵ curve for these distortion functions is shown in Fig. 8. As a first observation, it is clear that the choice of the distortion measure has a non-negligible impact on the privacy-utility trade-o↵ curve. In fact, it can be seen that for a given amount of normalized distortion, the releaser trained with the `4 and `5 distortion measures achieve a higher level of privacy than the one trained with the `2 distortion function. It should also be mentioned that we also considered other norms, such as the `10 , and the privacy-utility trade-o↵ was observed to be similar, but slightly di↵erent, than the one corresponding to the `4 norm. As we discussed in Section II, in some applications, such as demand response programs, the utilities are mostly interested in the peak power consumption of the customers. It is also expected that higher-order `p norms are better at preserving these signal characteristics than the `2 norm. To verify this notion, we considered 60 random days of the ECO dataset in a full privacy scenario (i.e., with an attacker accuracy very close to 50%) and plotted the actual power consumption along with the corresponding release signals for both the `4 and `2 distortion functions. Results shown in Fig. 9 clearly indicate that the number of peaks preserved by the releaser trained with the `4 distortion function is much higher than the ones kept by the releaser trained with the `2 distortion function. This suggests that for these applications, higher order `p distortion functions should be considered.

C. Attacker with Data Mismatch Problem

All the previous results are based on the assumption that the attacker has access to exactly the same training dataset used by the releaser-adversary system. This case should be considered as a worst-case analysis of the performance of the releaser. However, this assumption may not be true in practice. To examine the impact of this hypothesis, we consider two di↵erent cases. It should be noted that the total number of samples used for training and testing was kept fixed in all the di↵erent scenarios. In the first case, we assume that, out of the dataset of the five houses in the ECO dataset, the releaser uses the data of all the houses for training while the attacker has only access to the data of houses 1 and 3. In the second case, we assume that releaser is trained with the data of houses {1, 2, 4, 5} but the attacker has only access to data from house 3. These scenarios try to capture di↵erent degrees of the data mismatch problem, which could have an impact on the privacy-utility trade-o↵ due to the di↵erent generalization errors. The results are presented in Fig. 10 along with the worst-case scenario. We conclude that the overlapping of the training datasets of the releaser and the attacker can strongly a↵ect the performance of the model. In fact, in the case where the attacker does not have access to the same dataset as the releaser, its performance largely degrades, which means that a target level of privacy requires much less distortion. In the extreme case where the attacker has no access to the releaser training dataset, a very high level of privacy can be achieved with negligible distortion. It should be mentioned that we repeated this experiment with di↵erent choices of these 5 houses and similar results were obtained.

V. Discussion and Concluding Remarks

Privacy concerns associated with SMs data-sharing are an important problem since these can have an impact on their deployment pace and the advancement of smart grid technologies. As a consequence, it is essential to understand and to palliate real privacy risks in order to provide an adequate solution to conveniently share SMs data. A summary of the privacy-aware SMs methodology proposed in this study and the key findings are provided below:

• We proposed to measure the privacy based on the DI between the sensitive time series and its inference by a potential attacker optimized for the dedicated task. This captures the causal time dependencies present in the time series data and its sequential processing. For the sake of computational tractability, we propose an upper bound to the DI which leads to our training objective. Then, using Fano's inequality, it was shown that this bound can constrain the performance of the optimal (Bayesian) attacker.

• We explored a data release framework that balances the trade-o↵ between privacy of the sensitive information and distortion of the useful data. The desired releaser was trained using RNNs in an adversarial framework to optimize such objective, while an adversary mimics a real attacker. After convergence, an actual attacker was trained to test the level of privacy achieved by the releaser. • A detailed study of the inference of households occupancy using actual SMs dataset was performed. The performance of the proposed model was compared with two methodologies: random noise addition and PPANbased. In both cases, the results show that our method clearly outperforms the other algorithms in limiting the attacker inference ability. This is not surprising, as our method is able to fit the noise distribution to the actual consumer load and the sensitive feature that is trying to be hidden by the releaser in a more e↵ective manner. • We showed that the choice of the distortion measure can have a significant impact on the privacy-utility trade-o↵ curve. Indeed, it is shown that the `4 distortion measure generates a release that preserves most of the power consumption peaks even under a full privacy regime, which is not the case for the `2 distortion function. This result may be of considerable importance for some applications such as demand response. More generally, our formulation is amenable to train di↵erent release systems tailored for several potential applications based on SMs data. • We studied the impact of the data mismatch problem in this application, which occurs when the training dataset of the attacker is not exactly the same as the one used by the releaser. These results have shown that this e↵ect can greatly a↵ect the privacy-utility trade-o↵. Since this phenomenon is expected in practice, at least to some degree, these findings suggest that the level of required distortion to achieve desired privacy targets may be negligible in several cases of interest.

To wrap up the paper, two possible extensions for future work are briefly discussed. The first one is modeling the availability of side information at the attacker side to model prior knowledge of sensitive information as in [START_REF] Salehkalaibar | Hypothesis testing for privacy of smart meters with side information[END_REF], which cannot be distorted by the releaser, and study its impact on the privacy-utility trade-o↵s. The second is combining this SM data distortion approach with the ones which rely on physical resources for demand shaping. This would require us to incorporate the electricity cost consideration, leading to the study of the privacy-utility-cost trade-o↵s.

Fig. 1 .

 1 Fig. 1. Privacy-preserving data release framework for SMs.

Fig. 2 .

 2 Fig. 2. Plot of the Fano's function f (P e,t ) for the case |X|= 2.

Fig. 3 .

 3 Fig. 3. LSTM recurrent network cell diagram at time step t.

3 :

 3 Sample minibatch of B examples {w (b)T = (x (b)T , y (b)T , u (b)T )} B b=1 and generate releases {z (b)T } B b=1 .4:

7 :

 7 Sample minibatch of B examples {w(b)T = (x (b)T , y (b)T , u (b)T )} Bb=1 and generate releases {z (b)T } B b=1 .8:

Fig. 4 .

 4 Fig. 4. Privacy-Preserving framework. The seed noise U T is generated from i.i.d. samples according to a uniform distribution: U t ⇠ U[0, 1].

Fig. 5 .

 5 Fig. 5. Privacy-utility trade-o↵ for house occupancy inference using `2 distortion function. The fitted curve is based on an exponential function and is included only for illustration purposes.

Fig. 7 .

 7 Fig. 7. Privacy-utility trade-o↵ for house occupancy inference using the PPAN approach.

Fig. 8 .

 8 Fig. 8. Privacy-utility trade-o↵ for house occupancy inference based on the di↵erent `p distortion functions. For each figure, the dashed line, shown for comparison purposes, is the fitted curve found in Fig. 5 for the `2 distortion function.

Fig. 9 .

 9 Fig. 9. Example of the release power consumption in the time domain compared with the actual power consumption over 60 random days with almost full privacy for the `4 and `2 distortion functions.

Fig. 10 .

 10 Fig. 10. E↵ect of data mismatch between the releaser and the attacker on the privacy-utility trade-o↵ for house occupancy inference.

Fabrice

  Labeau (Senior Member, IEEE) is the Deputy Provost (Student Life and Learning) at McGill University, where he also holds the NSERC/Hydro-Québec Industrial Research Chair in Interactive Information Infrastructure for the Power Grid. His research interests are in applications of signal processing. He has (co-)authored more than 200 papers in refereed journals and conference proceedings in these areas. He is the Director of Operations of STARaCom, an interuniversity research center grouping 50 professors and 500 researchers from 10 universities in the province of Quebec, Canada. He is Past President of the IEEE Sensors Council, a former President of the IEEE Vehicular Technology Society, ad former chair of the Montreal IEEE Section. He was a recipient in 2015 and 2017 of the McGill University Equity and Community Building Award (team category), of the 2008 and 2016 Outstanding Service Award from the IEEE Vehicular Technology Society and of the 2017 W.S. Read Outstanding Service Award form IEEE Canada.

  Algorithm 1 Algorithm for training privacy-preserving data releaser neural network. Input: Dataset (which includes samples of useful data y T , sensitive data x t ); seed noise samples u T ; seed noise dimension m; batch size B; number of steps to apply to the Adversary k; gradient clipping value C; `2 regularization parameter .

Output: Releaser network R ✓ .

1: for number of training iterations do 2:

TABLE I Model

 I architectures and hyperparameters values.

TABLE II Errors

 II in power quality indicators along the privacy-utility trade-off.

	NE 2	Accuracy(%)		Absolute relative error of quality indicators(%)
			Mean Skewness Kurtosis Std. Dev./Mean Max./Mean
	0.04 0.12 0.18	78 65 57	1.42 9.69 13.26	1.06 4.32 12.83	0.70 5.81 2.57	0.67 4.58 16.44	0.46 4.92 13.89

Acknowledgment This work was supported by Hydro-Quebec, the Natural Sciences and Engineering Research Council of Canada, and McGill University in the framework of the NSERC/Hydro-Quebec Industrial Research Chair in Interactive Information Infrastructure for the Power Grid (IRCPJ406021-14). This project has received funding from the European Union's Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No 792464.