{'fraction_non_alphanumeric': 0.02862057241144823, 'fraction_numerical': 0.013060261205224105, 'mean_word_length': 5.046680372475511, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 7, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Differentially Private Event-Triggered Sampling

This paper describes a differentially private event-triggered sampling mechanism to select measurement samples from a data sequence whose dynamics can be modelled by a stochastic linear system. The mechanism produces subsequences that can be used to reestimate the original sequence relatively accurately and the differential privacy constraint guarantees that these subsequences are insensitive to certain variations in the input sequence. The subsampling process can be motivated by the presence of communication bandwidth constraints, but also provides an additional tool to explore achievable privacy-utility tradeoffs in privacypreserving signal processing and control. Event-triggered sampling can offer benefits over periodic subsampling by attempting to select the most useful samples, but the fact that it leaks information when no sampling occurs must be carefully taken into account to meet the differential privacy requirement. We propose a design using a stochastic sampling threshold, leveraging the “sparse vector technique” from differential privacy to incur a privacy loss only when samples are actually released. This design includes a suboptimal but tractable recursive finite-dimensional estimator that can also be used to re-estimate the original sequence from the differentially private noisy subsequence.


INTRODUCTION
Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 andRGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might 1. INTRODUCTION Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might 1. INTRODUCTION Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might Abstract: This paper describes a differentially private event-triggered sampling mechanism to select measurement samples from a data sequence whose dynamics can be modelled by a stochastic linear system. The mechanism produces subsequences that can be used to reestimate the original sequence relatively accurately and the differential privacy constraint guarantees that these subsequences are insensitive to certain variations in the input sequence. The subsampling process can be motivated by the presence of communication bandwidth constraints, but also provides an additional tool to explore achievable privacy-utility tradeoffs in privacypreserving signal processing and control. Event-triggered sampling can offer benefits over periodic subsampling by attempting to select the most useful samples, but the fact that it leaks information when no sampling occurs must be carefully taken into account to meet the differential privacy requirement. We propose a design using a stochastic sampling threshold, leveraging the "sparse vector technique" from differential privacy to incur a privacy loss only when samples are actually released. This design includes a suboptimal but tractable recursive finite-dimensional estimator that can also be used to re-estimate the original sequence from the differentially private noisy subsequence.
Keywords: Data privacy, Event-triggered sampling, Sampling systems, State estimation, Recursive estimation.

INTRODUCTION
Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might Abstract: This paper describes a differentially private event-triggered sampling mechanism to select measurement samples from a data sequence whose dynamics can be modelled by a stochastic linear system. The mechanism produces subsequences that can be used to reestimate the original sequence relatively accurately and the differential privacy constraint guarantees that these subsequences are insensitive to certain variations in the input sequence. The subsampling process can be motivated by the presence of communication bandwidth constraints, but also provides an additional tool to explore achievable privacy-utility tradeoffs in privacypreserving signal processing and control. Event-triggered sampling can offer benefits over periodic subsampling by attempting to select the most useful samples, but the fact that it leaks information when no sampling occurs must be carefully taken into account to meet the differential privacy requirement. We propose a design using a stochastic sampling threshold, leveraging the "sparse vector technique" from differential privacy to incur a privacy loss only when samples are actually released. This design includes a suboptimal but tractable recursive finite-dimensional estimator that can also be used to re-estimate the original sequence from the differentially private noisy subsequence.
Keywords: Data privacy, Event-triggered sampling, Sampling systems, State estimation, Recursive estimation.

INTRODUCTION
Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might Abstract: This paper describes a differentially private event-triggered sampling mechanism to select measurement samples from a data sequence whose dynamics can be modelled by a stochastic linear system. The mechanism produces subsequences that can be used to reestimate the original sequence relatively accurately and the differential privacy constraint guarantees that these subsequences are insensitive to certain variations in the input sequence. The subsampling process can be motivated by the presence of communication bandwidth constraints, but also provides an additional tool to explore achievable privacy-utility tradeoffs in privacypreserving signal processing and control. Event-triggered sampling can offer benefits over periodic subsampling by attempting to select the most useful samples, but the fact that it leaks information when no sampling occurs must be carefully taken into account to meet the differential privacy requirement. We propose a design using a stochastic sampling threshold, leveraging the "sparse vector technique" from differential privacy to incur a privacy loss only when samples are actually released. This design includes a suboptimal but tractable recursive finite-dimensional estimator that can also be used to re-estimate the original sequence from the differentially private noisy subsequence.
Keywords: Data privacy, Event-triggered sampling, Sampling systems, State estimation, Recursive estimation.

INTRODUCTION
Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might

INTRODUCTION
Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might Abstract: This paper describes a differentially private event-triggered sampling mechanism to select measurement samples from a data sequence whose dynamics can be modelled by a stochastic linear system. The mechanism produces subsequences that can be used to reestimate the original sequence relatively accurately and the differential privacy constraint guarantees that these subsequences are insensitive to certain variations in the input sequence. The subsampling process can be motivated by the presence of communication bandwidth constraints, but also provides an additional tool to explore achievable privacy-utility tradeoffs in privacypreserving signal processing and control. Event-triggered sampling can offer benefits over periodic subsampling by attempting to select the most useful samples, but the fact that it leaks information when no sampling occurs must be carefully taken into account to meet the differential privacy requirement. We propose a design using a stochastic sampling threshold, leveraging the "sparse vector technique" from differential privacy to incur a privacy loss only when samples are actually released. This design includes a suboptimal but tractable recursive finite-dimensional estimator that can also be used to re-estimate the original sequence from the differentially private noisy subsequence.
Keywords: Data privacy, Event-triggered sampling, Sampling systems, State estimation, Recursive estimation.

INTRODUCTION
Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might Abstract: This paper describes a differentially private event-triggered sampling mechanism to select measurement samples from a data sequence whose dynamics can be modelled by a stochastic linear system. The mechanism produces subsequences that can be used to reestimate the original sequence relatively accurately and the differential privacy constraint guarantees that these subsequences are insensitive to certain variations in the input sequence. The subsampling process can be motivated by the presence of communication bandwidth constraints, but also provides an additional tool to explore achievable privacy-utility tradeoffs in privacypreserving signal processing and control. Event-triggered sampling can offer benefits over periodic subsampling by attempting to select the most useful samples, but the fact that it leaks information when no sampling occurs must be carefully taken into account to meet the differential privacy requirement. We propose a design using a stochastic sampling threshold, leveraging the "sparse vector technique" from differential privacy to incur a privacy loss only when samples are actually released. This design includes a suboptimal but tractable recursive finite-dimensional estimator that can also be used to re-estimate the original sequence from the differentially private noisy subsequence.
Keywords: Data privacy, Event-triggered sampling, Sampling systems, State estimation, Recursive estimation.

INTRODUCTION
Because many initiatives to build a more intelligent infrastructure rely on the collection and processing of a large amount of personal information, often continuously and in real time, there is a growing interest in being able to better measure and control the impact of large-scale automated systems such as intelligent transportation systems or smart grids on the privacy of individuals (President's Council of Advisors on Science and Technology, 2014). Among various definitions of privacy that have been proposed in the past two decades for privacy-preserving data release and analysis, differential privacy (Dwork et al., 2006;Dwork and Roth, 2014) is one of the most successful notions and has been applied to the analysis of datasets ranging from data collected via web browsers (Erlingsson et al., 2014) to the U.S. Census Data (Abowd, 2018). Differentially private algorithms publish statistics about a protected dataset that are insensitive to specific variations in the dataset (e.g., adding or removing a single person's data), to ensure that certain inferences about this dataset become provably difficult (e.g., detecting if someone's data is present in the dataset). These inferences could be based on the published statistics and any source of side information.
This work was performed while the first author was on sabbatical leave at the Technical University of Munich, and supported by NSERC under Grants RGPAS-522686-2018 and RGPIN-5287-2018, and by a fellowship from the Alexander von Humboldt Foundation.
For the differentially private real-time processing of signals, previous work has focused on signal perturbation schemes using additive noise, see, e.g., Le Ny and Pappas (2014). The potential benefits of first selecting a subset of a sensitive signal's samples, especially when a model is available to estimate and predict this signal, are comparatively unexplored except in Fan and Xiong (2014), although (random) subsampling is known to enhance differential privacy guarantees for the analysis of static datasets (Li et al., 2012). This motivates the problem considered in this paper, which is to select in real-time which samples of a sensitive data stream to release to simultaneously meet a differential privacy requirement and maintain the ability to reestimate the initial data stream relatively accurately. In addition to offering an additional tool to explore privacyaccuracy tradeoffs, subsampling might also be necessary in the context of networked monitoring and control systems to meet certain communication bandwidth constraints for example.
We focus here on an event-triggered sampling approach (Heemels et al., 2012), where a data sample is only released when it deviates sufficiently from a value that can be predicted based on previously released samples together with a dynamic model assumed to be publicly available. Our work is motivated by the following idea: in situations where publishing more samples of a signal in a differentially private way requires more noise, the overall impact on accuracy of having one more sample might become negative due to the additional noise, especially if the sample can be predicted accurately by the model. The paper is organized as follows. Section 2 states the problem of designing a differentially private eventtriggered sampling mechanism and recalls some basic facts about differential privacy. The proposed mechanism is described in Section 3, together with a proof of the differential privacy guarantees it provides. Finally, Section 4 focuses on the design of an estimator embedded in the sampling mechanism to compute the triggering condition at each period.
Notation. The Laplace distribution with mean zero and variance 2/λ 2 is denoted Lap(λ) and has probability density function (pdf) λ 2 exp(−λ|x|) for x ∈ R. The exponential distribution with mean 1/λ and variance 1/λ 2 is denoted exp(λ) and has pdf λ exp(−λx) for x ≥ 0. We use the notation M 1 for the induced 1-norm of an m × n For M symmetric positive definite, M −1/2 denotes the inverse of the principal square root of M . A finite sequence {x k } s≤k≤t is denoted x s:t .

PROBLEM STATEMENT
Consider a private signal x := {x k } k≥0 , with x k ∈ R n , captured over time by a data aggregator. A mathematical model taking the form of a stochastic linear time-invariant system is publicly known for this observed signal where the initial state x 0 ∈ R n is assumed to have mean x 0 and covariance matrixΣ 0 , the matrix A ∈ R n×n is known, and w k is a zero-mean white noise signal with known covariance matrix W . The data aggregator would like to release publicly a (perturbed) subsequence of the whole sequence {x k } k≥0 . More precisely, it needs to decide at each period k if the sample x k should be released or not. This could be due for example to the necessity of transmitting the samples over a communication network subject to a bandwidth constraint. In addition, it is required that the released subsequence be differentially private, as defined in the next subsection. In that regard, subsampling might also be beneficial to meet the privacy constraint, independently of any other communication bandwidth constraint.

Differential Privacy
In this section we define formally the differential privacy requirement for the published subsequence. A mechanism publishing the result of a computation performed on a protected dataset is differentially private (Dwork et al., 2006) if: i) it randomizes its answer and ii) its answer's probability distribution does not depend too strongly on certain specified variations in the dataset. These variations can be interpreted as the impact that a single individual's data has on the dataset. More precisely, given a space D of datasets, we start by defining a binary symmetric relation on D, called adjacency and denoted Adj, which captures which varations we allow. A typical example would be to define adjacent datasets as those for which the data of exactly one individual has been added or removed. For an algorithm (also called mechanism) to be differential private, it should be hard for a third party to decide, based on observing only the output of the mechanism, if the dataset used was d or d , for any two adjacent d and d . For this purpose, denoting M the mechanism, M (d) is a random variable and differential privacy asks that the distributions M (d) and M (d ) for any two adjacent datasets d and d be close, as expressed in (2) below. Definition 1. Let D be a space equipped with a given symmetric binary relation Adj, and (R, M) be a measurable space, where M is a given σ-algebra over R.
In this paper, we take D = (R n ) N and we consider that two data sequences x, x in D are adjacent if an only if (3) In other words, we allow at each period a variation of at most ρ in 1-norm for the sample x k . For example, x might represents counts reported by by n motion detection sensors and a single individual is assumed to activate at most ρ of these sensors at each period to satisfy (3). See Dwork et al. (2010) or Le Ny and Mohammady (2018) for a discussion of some application examples.
We now informally state a few required results. First, an important property of differential privacy is its "resilience to post-processing", which says that further transforming the output M (d) of a differentially private mechanism, without re-accessing the dataset d, cannot weaken the differential privacy guarantee provided by M (Dwork and Roth, 2014), (Le Ny and Pappas, 2014, Theorem 1). Hence, post-processing a released subsequence of samples by an estimator does not change the privacy guarantee. Second, we can compose differentially private mechanisms, with the following degradation of the privacy parameter. If we have N mechanisms M 1 : D → R 1 , M k : D × R 1 × . . . × R k−1 → R k , 2 ≤ k ≤ N , and each M i is i -diffentially privacy with respect to its first argument for each fixed value of its subsequent arguments, then the composed mechanism releasing (d 1 , . . . , d N ) with each output defined recursively as (Dwork and Roth, 2014, Corollary B.2). Finally, the sensitivity (also called 1-sensitivity) of a function q : D → R n is defined as ∆q := sup d,d :Adj(d,d ) q(d) − q(d ) 1 . Then, the Laplace mechanism (Dwork et al., 2006) M : D → R n defined as M (d) = q(d) + ξ, with ξ ∈ R n a random vector with iid components ξ i ∼ Lap( /∆q), is -differentially private. Note that this noise has variance 2∆q 2 / 2 on each component.

Event-Triggered Sampling Approach
We are concerned in this paper with the problem of selecting which samples of the sequence x to release, while guaranteeing that the released subsequence be differentially private for the adjacency relation (3). Consider the following three possible mechanisms.
(i) Subsample the signal x periodically and perturb the selected samples using to the Laplace mechanism. 2019IFAC NecSys Chicago, IL, USA, September 16-17, 2019 (ii) Perturb the whole sequence x using the Laplace mechanism, then subsample that perturbed sequence using an event-triggered mechanism. (iii) Subsample x using an event-triggered mechanism, and perturb the selected samples using to the Laplace mechanism.
Scheme (i) is the most straightfoward to implement, but as with any periodic sampling scheme, not considering the value of the samples in their selection process might result in suboptimal performance for networked monitoring and control systems (Heemels et al., 2012). Scheme (ii) has the important drawback that the privacy-preserving noise is introduced before sampling, hence the Laplace mechanism will result in a degradation of the privacy parameter proportional to the length of the whole sequence, not the number of ultimately selected samples. An alternative is explored by Fan and Xiong (2014), where a self-triggering scheme is proposed to adapt the sampling rate to the size of the innovations at the sampling times only. Scheme (iii) is the focus of this paper. The difficulty is to be able to subsample based on considering the values of the samples, yet avoid the same worst-case privacy degradation as with scheme (ii). A direct application of the composition mechanism recalled above would give a degradation proportional to the length of the whole sequence. Our goal instead is to obtain an event-triggered mechanism with privacy degradation proportional to the number of selected samples.

DIFFERENTIALLY PRIVATE EVENT-TRIGGERED SAMPLER
The architecture of the proposed event-triggered sampler is shown on Fig. 1. A sample x t is first selected or rejected by the event detector based on a condition involving the size of the difference x k −x k between the value of the sample and a value predicted based on past selected samples, after a sanitization process involving additive noise ξ to enforce differential privacy. Let γ k ∈ { , ⊥} be a variable representing the output of the event detector, with γ k = if a sample x k is selected at period k, and γ k = ⊥ otherwise. The subsampled sequencex s k on the figure is defined as In particular, if no sampling occurs at period k, then this information is passed to the subsequent estimator.
If sampling occurs at period k, then a random variable ξ k is added to the sample. The estimator produces an estimatex based on the sequencex s , which therefore includes the past selected and perturbed samples, as well as the information about the periods at which no sampling occurred. The signalsx s ,x, γ (or a subset of these) can be published by the mechanism, as these signals are differentially private. In particular, since our estimator is suboptimal, it can be useful to output the noisy samples x s k , if another estimator with possibly better performance is to be implemented outside of the proposed sampling scheme. In a remote estimation scenario with bandwidth constraints, as in Wu et al. (2016) for example, one can also transmit just the noisy samples and reproduce the estimator at the remote location. Note that by the resilience to post-processing property, any such subsequent estimator still produces differentially private outputs.
The rest of this section is dedicated to describing more precisely the sample selection method (event detector) and to proving the differential privacy property of the sequences γ,x s ,x. Section 4 describes in more details our estimator design.

Detecting the First Event
The event detector relies on a stochastic thresholding policy. This is reminiscent of recent work discussing how stochastic thresholding simplifies the design of subsequent Bayesian state estimators for certain linear systems driven by Gaussian noise (Han et al., 2015;Wu et al., 2016). However, the main motivation in this work for using a stochastic thresholding policy is for the purpose of guaranteeing differential privacy with a privacy degradation that depends only on the number of ultimately selected samples, following the "sparse vector technique" idea from the differential privacy literature (Dwork et al., 2009;Dwork and Roth, 2014;Lyu et al., 2017), In order to present the formal privacy results, we first describe how the event detector operates from period k = 0 until the first time a sample is selected, assuming for now that the detector stops releasing outputs at that time. Let λ τ , λ ν be two positive parameters, with λ τ = λ ν . Initially, we set z 0 = x 0 −x 0 and we generate a random variable τ ∼ exp(λ τ ), whose value is not published. Note that the covariance matrix of z 0 is provided by the model, equal tō Σ 0 . Then, at each subsequent period k ≥ 0, given some values for z k ,Σ k , we generate a fresh random variable ν k ∼ Lap(λ ν ) and output the following decision If γ k = ⊥, we update the parameters for the next period, as followsx wherex k is a state estimate and η k (λ τ , λ ν ) ∈ R + is a positive scalar coefficient, strictly smaller than 1, which is computed in Section 4. Note that the iterations (5) and (7) do not depend on the values x k of the data sequence. 2019IFAC NecSys Chicago, IL, USA, September 16-17, 2019 Denote by k s ≥ 0 the time period at which the event detector stops, i.e., γ ks = . The following proposition is an immediate consequence of the triangle inequality. Proposition 2. The sensitivity of f k is bounded above by ρ, for all 0 ≤ k ≤ k s .
Proof. Define z k = x k −x k and z k = x k −x k , for x, x adjacent sequences according to (3) andx k defined from x 0 and the iterations (5). Then Theorem 3. If the first event time k s is finite, the event detector described above, publishing the sequence γ 0:ks , is -differentially private, with = ρ(λ τ + 2λ ν ).
Remark 4. Compared to other event-triggered sampling schemes described in the networked control literature (see, e.g., Wu et al. (2016)), the introduction of the random variable τ (which is not updated with k), as well as the choice of the Laplace distribution for ν k , are crucial here to obtain a differential privacy guarantee. The sparse vector technique normally uses also the Laplace distribution for τ (Lyu et al., 2017), but the exponential distribution we use here is also appropriate and leads to a slightly simpler estimator design in Section 4.

COMPLETING THE ESTIMATOR DESIGN
The task of the estimator is to generate a sequence of state estimatesx k givenx s 0:k . The indication that no sampling was triggered provides some useful information about the state distribution (sometimes called "negative information" in the event-triggered sampling literature), and we describe in this section how we leverage this information in our estimation procedure.
Before the first detected event, givenx 0 ,Σ 0 , and a sequence of observed decisions of no event detected γ 0 = ⊥, . . . , γ k = ⊥, for some k ≥ 0, the goal of the estimator is to construct at period k a current state estimatex k . In fact, we already described with (5) and (7) the equations for our recursive estimation procedure. We complete this description in this section, providing the expression of the parameter η k , as well as the assumptions and approximations underlying our design.
In summary, the approximation involved in the proposed estimator consists in approximating the distribution of z k given γ 0:k−1 at each "propagation step" of the filter by a distribution of the form (11), with the covarianceΣ k computed recursively. Note that all the covariance matrix computations are independent of the values of the sensitive data x k , hence no additional loss of privacy is involved. is shown here). An full version of this paper will study the performance of this sampling scheme in details.