This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

A Privacy-Preserving Distributed Control of

Optimal Power Flow
Minseok Ryu and Kibaek Kim, Member, IEEE,

Abstract—We consider a distributed optimal power flow differential privacy for preserving data privacy during
formulated as an optimization problem that maximizes a the algorithmic process [9]. Several DP algorithms have
nondifferentiable concave function. Solving such a problem been proposed to solve various distributed optimization
by the existing distributed algorithms can lead to data
privacy issues because the solution information exchanged problems. For example, (i) a DP alternating direction
within the algorithms can be utilized by an adversary to method of multipliers (ADMM) was proposed for solv-
infer the data. To preserve data privacy, in this paper we ing a distributed empirical risk minimization problem
propose a differentially private projected subgradient (DP- [10], [11], [12] and a distributed DC OPF [13], and
PS) algorithm that includes a solution encryption step. We (ii) a DP stochastic gradient descent (SGD) method
show that a sequence generated by DP-PS converges in
expectation, in probability, and with probability 1. More- was proposed for solving a classification problem [14],
over, we show that the rate of convergence in expectation a resource allocation problem [15], and deep neural
is affected by a target privacy level of DP-PS chosen by the networks [16].
user. We conduct numerical experiments that demonstrate We define target privacy level (TPL) as a user param-
the convergence and data privacy preservation of DP-PS.
eter for DP algorithms to control data privacy. While
Index Terms—Differential privacy, projected subgradient guaranteeing stronger privacy, increasing TPL of the DP
algorithm, optimal power flow, dual decomposition. algorithms may affect the convergence. For example,
I. I NTRODUCTION DP-ADMM with higher TPL is shown to find suboptimal
solutions, implying the need for a trade-off between
Optimal power flow (OPF) is an important problem
data privacy and solution quality [11], [13]. On the
in reliably and economically operating electric grids.
other hand, the numerical results in [14] show that the
Currently, the problem is solved by independent system
solution accuracy from DP-SGD may be close to that
operators in a centralized manner. Recently, however,
of non-private SGD. Also, Huang et al. [12] report
distributed OPF has been spotlighted as a result of the
numerical experiments that DP-SGD has good noise
introduction of microgrids with energy storage [1] and
resilience compared with that of DP-ADMM, but it
increasing penetrations of distributed energy resources
converges slowly. While numerical evidence has been
[2]. Distributed OPF consists of (i) a set of OPF sub-
demonstrated for the trade-off between the convergence
problems defined for each zone of the power grid and
of DP algorithms and TPL, only a few studies (e.g., DP-
(ii) consensus constraints that link the subproblems.
ADMM in [12]) develop the theoretical links.
Distributed OPF can be solved by the existing distributed
algorithms (e.g., [3], [4], [5], [6]), which do not require In this paper we present a DP projected subgradient
sharing private data information (e.g., demand data from (PS) algorithm for solving a distributed OPF while
each zone) but send the local solutions to the central preserving data privacy, and we study how TPL affects
machine. Unfortunately, an adversary may be able to the convergence of DP-PS theoretically and numerically.
estimate the data based on the solutions (e.g., reverse We first formulate the distributed second-order conic
engineering [7]), thus motivating the need for solution (SOC) and alternating current (AC) OPF (see, e.g., [17],
encryption. [18], [19]) based on dual decomposition by taking the
Differential privacy (DP) is a randomization tech- Lagrangian relaxation with respect to the consensus con-
nique that guarantees the existence of multiple datasets straints, where supergradients are computed by solving
with similar probabilities of resulting in the encrypted the OPF subproblems in parallel. Moreover, in order
solution, thus preserving data privacy [8]. A differen- to guarantee data privacy, the supergradients exchanged
tially private algorithm is an algorithm that incorporates within the algorithm are systematically randomized by
adding random noise extracted from a Laplace distri-
M. Ryu and K. Kim are with the Mathematics and Computer Science bution. Under three rules of specifying search direction
Division, Argonne National Laboratory, Lemont, IL, USA (Contact: and step size, we show that a sequence generated by
[email protected]). This material is based upon work supported by the
U.S. Department of Energy, Office of Science, Advanced Scientific DP-PS converges in expectation, in probability, and with
Computing Research, under Contract DE-AC02-06CH11357. probability 1. In particular, we show that the convergence

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

complexity is affected by a constant factor only as TPL For every generator g ∈ Gi , we denote the amounts of
increases. In summary, this paper answers the following active (resp., reactive) power generation by pGg (resp., qgG ).
questions: In the following, we present a SOC OPF formulation:
X X  
• How can we preserve the privacy of the data com- min c1,g pGg + c2,g (pGg )2 (2a)
municated in the distributed OPF setting? i∈N g∈Gi

• Can DP guarantee data privacy? subject to

• What are the implications of adding the DP tech- ∀`ij ∈ L :
nique to the distributed OPF setting? pF` = Gf` (wij
RR II
+ wij ) + B`f (wji
RI RI
+ wij ) + Gcf` (wii
RR II
+ wii ), (2b)
• Can our technical development be numerically q`F = Gf` (wji
RI RI
+ wij ) − B`f (wij
RR II
+ wij ) − B`cf (wii
RR II
+ wii ), (2c)
demonstrated? pT` = Gt` (wji
RR II
+ wji ) + B`t (wij
RI RI
+ wji ) + Gct` (wjj
RR II
+ wjj ), (2d)
The remainder of the paper is organized as follows. q`T = Gt` (wij
RI RI
+ wji ) − B`t (wji
RR II
+ wji ) − B`ct (wjj
RR II
+ wjj ), (2e)
In Section II, we present a distributed OPF problem. In (pF` )2 + (q`F )2 ≤ (s` )2 , (pT` )2 + (q`T )2 ≤ (s` )2 , (2f)
Section III, we describe a differentially private control RI RI II
wji − wij ∈ [tan(θij )(wij + wij RR RR
), tan(θij )(wij II
+ wij )], (2g)
with the proposed DP-PS. In Section IV, we study ∀i ∈ N :
the convergence of DP-PS. We conduct case studies in X
pF` +
X
pT` =
X
RR
pGg − pdi − gis (wii II
+ wii ), (2h)
Section V and summarize our conclusions in Section VI. `∈LFi `∈LT g∈Gi
i
We denote by N a set of natural numbers. For A ∈ N, X X X
q`F + q`T = qgG − qid + bsi (wii
RR II
+ wii ), (2i)
we define [A] := {1, . . . , A}. We use h·, ·i and k · k to g∈Gi
`∈LFi `∈LT
i
denote the scalar product and the Euclidean norm. RR
wii II
+ wii ∈ [v 2i , v 2i ], (2j)
II. D ISTRIBUTED O PTIMAL P OWER F LOW ∀i ∈ N , ∀g ∈ Gi : pGg ∈ [pGg , pGg ], qgG ∈ [q Gg , q Gg ], (2k)
We depict a power network by a graph (N , L), where ∀`ij ∈ L :
N is a set of buses and L is a set of lines. For every RR II 2 RI RI 2
 wRR + wII − wRR − wII 2
ii ii jj jj
(wij + wij ) + (wji − wij ) +
line `ij ∈ L, where i is a from bus and j is a to bus of 2
 wRR + wII + wRR + wII 2
line `, we are given line parameters, including bounds ≤
ii ii jj jj
, (2l)
[θij , θij ] on voltage angle difference, thermal limit s` , 2
resistance r` , reactance x` , impedance z` := r` + ix` , where (2a) is to minimize the generation cost, (2b)–
line charging susceptance bc` , tap ratio τ` , phase shift (2e) represent power flow, (2f) represent line thermal
angle θ`s , and admittance matrix Y` , namely, limit, (2g) represent bounds on voltage angle differences,

bc` 1
 (2h)–(2i) represent power balance, (2j) represent bounds
 ff  (z`−1 + i ) −z`−1 1
−iθ s
Y
Y` := `tf
Y`ft
=
2 τ2
` τ` e ` on voltage magnitudes, (2k) represent bounds on power
,
 
Y` Y`tt bc`
−z`−1 1
iθ s
z`−1 + i 2
generation, and (2l) represent SOC constraints that en-
τ` e `
sure linking between auxiliary variables.
Gcf` := <(Y`ff ), B`cf := =(Y`ff ), Gf` := <(Y`ft ), B`f := We remark that this paper uses the SOC OPF for-
=(Y`ft ), Gct` := <(Y`tt ), B`ct := =(Y`tt ), Gt` = <(Y`tf ), mulation for example. The technical development and
and B`t := =(Y`tf ). For every bus i ∈ N , we are given results should remain true with any convex relaxation
bus parameters, including bounds [v i , v i ] on voltage of the OPF problem. For example, one can introduce
magnitude, active (resp., reactive) power demand pdi SOCP strengthening techniques [19], [20], semidefinite
(resp., qid ), shunt conductance gis , and shunt susceptance programming relaxation, or quadratic convex relaxation
bsi . Furthermore, for every i ∈ N , we define subsets [17]. In this work, however, we focus on solving one
LFi := {`ij : j ∈ N , `ij ∈ L} and LTi := {`ji : of the convex relaxation techniques, SOC OPF (2) in a
j ∈ N , `ji ∈ L} of L and a set of generators Gi . distributed and privacy-preserving manner.
For every generator g ∈ Gi , we are given generator We decompose the network into several zones indexed
parameters, including bounds [pGg , pGg ] (resp., [q Gg , q Gg ]) on by Z := {1, . . . , Z}. Specifically, we split a set N of
the amounts of active (resp., reactive) power generation buses into subsets {Nz }z∈Z such that N = ∪z∈Z Nz
and coefficients (c1,g , c2,g ) of the quadratic generation and Nz ∩ Nz0 = ∅ for z, z 0 ∈ Z : z 6= z 0 . For each

z ∈ Z we define a line set Lz := ∪i∈Nz Li ∪
F
cost function. zone
Next we present decision variables. For every line Li ; an extended node set Vz := ∪i∈Nz Ai , where Ai
T

`ij ∈ L, we denote active (resp., reactive) power flow is a set of adjacent buses of i; and a set of cuts Cz =
along line ` by pF` , pT` (resp., q`F , q`T ). For every i ∈ N , ∪z0 ∈Z\{z} (Lz ∩ Lz0 ). Note that {Nz }z∈Z is a collection
we denote the complex voltage by Vi = viR + iviI , and we of disjoint sets, while {Lz }z∈Z and {Vz }z∈Z are not.
introduce the following auxiliary variables: Using these notations, we rewrite problem (2) as
X
RR
wij = viR vjR , wij
II
= viI vjI , wij
RI
= viR vjI , ∀j ∈ N . (1) min fz (xz ) (3a)
z∈Z

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

s.t. (xz , yz ) ∈ Fz (D̄z ), ∀z ∈ Z, (3b)

φi = yzi , ∀z ∈ Z, ∀i ∈ C(z), (3c) λk+1 = ProjΛ (λk + αk y k ), ∀k ∈ [K], (5)
φi ∈ R, ∀i ∈ C, (3d)
where ProjΛ (·) represents the orthogonal projection onto
where Λ, αk is a step size, y k is a search direction, and K is
the total number of iterations.
xz ← pFz` , qz`
F
, pTz` , qz`
T RR II RI RI

, wzij , wzij , wzij , wzji `ij ∈Lz \Cz
 R I  G G 1) Motivating Example (Data Leakage): Throughout
∪ vzi , vzi i∈V ∪ pg , qg i∈N ,g∈G , the paper, we consider a hypothetically strong adversary
 F F T Tz RR z i
II RI RI that can access every but private load data of a control

yz ← pz` , qz` , pz` , qz` , wzij , wzij , wzij , wzji `ij ∈Cz
,
 F F T T RR II RI RI
zone in a power system and tries to infer the data
φ ← ∪z∈Z p` , q` , p` , q` , wij , wij , wij , wji ` ∈C ,
ij z by intercepting the communication among the control
C(z) is an index set that indicates each element of zones. In this example, we demonstrate that the existing
yz , C := ∪z∈Z C(z)Pis an P index set of consensus vari- distributed algorithms are susceptible to inference attacks
able φ, fz (xz ) := i∈Nz g∈Gi c1,g pGg + c2,g (pGg )2 ,

(e.g., [7]). Specifically, the adversary can intercept the
D̄z := {pdl }l∈Nz is a given demand vector, Fz (D̄z ) := communication data {yzk }K k=1 of the PS algorithm (5)
{(xz , yz ) : (2b) − (2g), ∀`ij ∈ Lz ; (2h), (2i), ∀i ∈ and try to infer private demand data D̄z in (4b). Such
Nz ; (2j), ∀i ∈ Vz ; (2k), ∀i ∈ Nz , ∀g ∈ Gi ; (2l), ∀i ∈ inference attack can be easily conducted by solving an
Vz , ∀j ∈ Vz } is a convex feasible region defined for each adversary problem as in [13]. The adversary problem is
zone, and (3c) represents the consensus constraints: described as follows.
Let K be a set of PS iterations observed by an
∀z ∈ Z, `ij ∈ Cz : adversary who aims to infer a demand data at node ˆl in
pF` = pFz` , pT` = pTz` , q`F = qz`
F
, q`T = qz`
T
, zone ẑ, namely D̄ẑl̂ . We assume that the strong adversary
RR
wij RR
= wzij II
, wij II
= wzij RI
, wij RI
= wzij RI
, wji RI
= wzji . knows (i) all the demand information except D̄ẑl̂ , (ii)
all the topological information of zone ẑ, and (iii) the
Note that the consensus constraints with respect to exchanged supergradient {ŷẑk }k∈K and the local solution
RR II RI RI
wij , wij , wij , wji are redundant but numerically benefi- {x̂kẑ }k∈K . Our assumption is justified as to give the most
cial. By introducing a dual vector λ := {λzi }z∈Z,i∈C(z) advantages to the adversary, which can be considered
associated with constraints (3c), one can construct a as the worst-case data leakage scenario to the pravacy-
Lagrangian dual problem: preserving control.
n X o X
fẑ (xkẑ ) + Γ kxkẑ − x̂kẑ k2 + kyẑk − ŷẑk k2

max H(λ) := hz (λz ) , (4a) min (6)
λ∈Λ Dẑ l̂ ,xk k
ẑ ,yẑ k∈K
z∈Z
 P subject to ∀k ∈ K :
where Λ := λ : z∈F (i) λzi = 0, ∀i ∈ C , F (i) := (2b) − (2g), ∀`ij ∈ Lẑ ; (2i), ∀i ∈ Nẑ ; (2j), ∀i ∈ Vẑ ;
{z ∈ Z : i ∈ C(z)} is a set of zones for every i ∈ C (2k), ∀i ∈ Nẑ , ∀g ∈ Gi ; (2l), ∀i ∈ Vẑ , ∀j ∈ Vẑ ;
and hz (λz ) is the optimal value of the subproblem: X X X
pFkẑ` + pTkẑ` = RR
pGkg − Dẑl̂ − gl̂s (wkẑ l̂l̂
II
+ wkẑ l̂l̂
);
X
`∈LF `∈LT g∈Gl̂
min fz (xz ) + λzi yzi . (4b) l̂ l̂
(xz ,yz )∈Fz (D̄z ) X X X
i∈C(z) F T
pkẑ` + pkẑ` = RR
pGkg − pdi − gl̂s (wkẑ l̂l̂
II
+ wkẑ l̂l̂
),
`∈LF `∈LT g∈Gl̂
We emphasize that, for a given λ, evaluating H(λ) can l̂ l̂

be done by solving the subproblem (4b) in parallel. ∀i ∈ Nẑ \ {l̂},

Let λ∗ be a maximizer of the nondifferentiable concave
where Γ > 0 is a penalty parameter. Note that Dẑl̂ is a
function H(λ). Then H(λ∗ ) is the optimal value of (3)
decision variable as well as {xkẑ , yẑk }k∈K . By solving (6),
by the strong duality from the convexity of Fz (D̄z ).
the adversary aims to obtain the unknown demand Dẑl̂
Remark 1. If (2l) are replaced with (1), then (2) is a that minimizes the distance between {xkẑ , yẑk }k∈K and
rectangular formulation of AC OPF. In this case, (4) may the solutions {x̂kẑ , ŷẑk }k∈K obtained from the PS algo-
not provide a solution that satisfies (3c) because of the rithm. With a sufficiently large Γ , the adversary can find
nonconvexity of Fz (D̄z ). the demand data at node ˆl that produces {x̂kẑ , ŷẑk }k∈K ,
thus identifying D̄ẑl̂ . As the cardinality of K increases,
Remark 2. There exists yiL , yiU ∈ R such that yzi ∈
moreover, the accuracy of the demand estimated by (6)
[yiL , yiU ], ∀i ∈ C, ∀z ∈ F (i).
increases while sacrificing computation. We denote by
III. D IFFERENTIALLY P RIVATE C ONTROL Kb a collection of various K and by D (K) a demand
ẑ l̂
The Lagrangian dual problem (4) can be solved by estimated by (6) with K ∈ K. b
any nonsmooth convex optimization algorithms. In this We demonstrate the effectiveness of adversary prob-
paper we consider the PS algorithm, lem (6) by using an instance “case 14” from Matpower

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

[21] with the decomposition into 3 zones (see Table II). Definition 2. (Laplacian noise) Laplacian noise ξ˜ ∈ R
We solve the distributed OPF of (4) by using PS. At is a random variable following the Laplace distribu-
each iteration k, an approximation error is measured as ˜
tion whose probability density function is L(ξ|b) =
below and reported in Figure 1: 1 |ξ̃|

2b exp − b for b > 0.
AEk = 100|Z ∗ − Z k |/Z ∗ , ∀k ∈ [K], (7) The randomized function R(D) := Q(D) + ξ˜ provides
¯-differential privacy if ξ˜ is drawn from the Laplace dis-
where Z ∗ is the optimal objective value and Z k are tribution with b = max(D0 ,D00 )∈Dβ |Q(D0 ) − Q(D00 )|/¯ .
the objective values computed at the kth iteration of PS, The main idea of DP-PS is to perturb y k with the
respectively. noise ξ˜k such that
We consider the adversary who aims to estimate the
demand at node ˆl = 4 in zone ẑ = 1, namely, D̄14 =
k
ỹzi k
← yzi + ξ˜zi
k
, ∀z ∈ Z, ∀i ∈ C(z), (9)
47.8 MW. For every trial K ∈ K,
b we solve (6) and report
for every iteration k of PS. We describe the algorithmic
in Figure 1 a demand estimation error:
steps of DP-PS in Algorithm 1. In line 3, we find
DE(K) := 100|D̄ẑl̂ − Dẑl̂ (K)|/D̄ẑl̂ , ∀K ∈ K,
b (8) a supergradient y k of the concave function H at λk .
 In lines 6–8, we generate the Laplacian noise ξ˜k and
where K b ← {1}, . . . , {K} (various K b will be dis- the noisy supergradient ỹ k . In line 9, we update dual
cussed in Section V). Figure 1 shows that the adversary variables based on the step size αk and the search
is highly likely to estimate D̄14 , and hence this situation direction sk (ỹ k ) determined in advance (see Section IV).
motivates the need for the solution encryption to preserve
data privacy. Algorithm 1 DP Projected Subgradient Algorithm
1: Set k ← 1 and λ1 ← 0.
102 100 2: for k ∈ {1, . . . , K} do
3: Given λk , find y k by solving (4b) in parallel.
101
50
4: Store Hbest (λk ) ← maxt∈[k] {H(λt )}.
5: # Perturbation of y k
0 6: Solve (11) to find {∆ ¯k }z∈Z,i∈C(z) .
10 zi
0
0 100 200 300 400 500 0 100 200 300 400 500 7: Extract ξ˜zi
k
from L(ξ˜zi
k ¯k
|∆zi /¯
) in Definition 2.
8: Compute ỹ k by (9).
Fig. 1: Approximation error (left) of PS and demand 9: # Update dual variables
estimation error (right) of the adversarial problem.
λk+1 ← ProjΛ λk + αk sk (ỹ k ) .

2) Differential Privacy in PS: The motivating exam- 10: end for

ple suggests that PS for solving (4) might be vulnerable
to data leakage. To preserve data privacy, we introduce Now we describe how to generate the noise ξ˜zi k
in (9)
differential privacy (see [9] for more details). so that the ¯-differential privacy in Definition 1 on D̄ is
Definition 1. (¯ -differential privacy) A randomized ensured. First, we define a query function as follows:
function R that maps data D to some random numbers
Qkzi : Dz 7→ yzi
k
, ∀z ∈ Z, ∀i ∈ C(z), (10)
gives ¯-differential privacy if
k
  0  where yzi is obtained by solving (4b) for given λk
 ln P{R(D ) ∈ S}  ≤ ¯, ∀(D0 , D00 ) ∈ Dβ , ∀S ⊆ Range(R),
 
 P{R(D00 ) ∈ S}  and Dz ∈ R|Nz | . Second, we draw ξ˜zik
in (9) from the
Laplace distribution in Definition 2 with b = ∆¯kzi /¯
 and
where ¯ > 0, the probability taken is over the coin tosses
of R, and Dβ is a collection of two datasets (D0 , D00 ) ¯kzi :=
∆ max |Qkzi (Dz0 ) − Qkzi (D̄z )|, (11)
0 ∈D
Dz b β (D̄z )
differing in one element by β ∈ R+ .
For small ¯ ≈ ln(1 + ¯), we have P{R(D P{R(D )∈S}
∈
0
where D̄z is a given demand and Dbβ (D̄z ) is a collection
00 )∈S}
0
[1 − ¯, 1 + ¯], which implies that distinguishing D from of Dz0 differing in one element from D̄z by β, namely
D00 based on S becomes more difficult as ¯ decreases.
n
bβ (D̄z ) := ∪l∈Nz Dz0 ∈ R|Nz | : Dzj
D 0
= D̄zj , ∀j ∈ Nz \ {l},
To construct R(D) that ensures ¯-differential privacy on o
0
data D, one can utilize a Laplace mechanism [8]. More Dzl ∈ [D̄zl (1 − β), D̄zl (1 + β)] .
specifically, a query function Q : D 7→ R mapping data
to true answer is perturbed by adding Laplacian noise
described in Definition 2. Theorem 1. In the kth iteration of DP-PS, we consider

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

X X n 2
Rkzi (Dz ) := Qkzi (Dz ) + ξ˜zi
k
GU (¯ max |yiL |, |yiU | + ξ˜zi
U
)2 +

, ∀z ∈ Z, ∀i ∈ C(z), (12) ) := (¯
z∈Z i∈C(z)
where Qkzi is defined in (10), ξ˜zi k
is extracted from o
2ξ˜zi
U
) max |yiL |, |yiU | ,

L(ξ˜zi |∆¯zi /¯
k k
) in Definition 2, and ∆¯kzi is from (11). For (¯ (14)
all z ∈ Z, i ∈ C(z), we have and (ii) we have the following basic inequality:
k 0
  
 ln P{Rzi (Dz ) ∈ Sk }  ≤ ¯,
0
  ∀Dz ∈D
b β (D̄z ),
∀Sk ⊆Range(Rk
(13) kλk+1 − λ? k2 ≤ kλk − λ? k2 + αk2 ksk (ỹ k )k2 +
 P{Rk (D̄z ) ∈ Sk } 
zi zi ),
2αk H(λk ) − H(λ? ) + 2αk hsk (ỹ k ) − y k , λk − λ? i. (15)


where Rkzi (D̄z ) is equal to ỹzi
k
in (9). This implies that
¯-differential privacy on D̄ is ensured in the kth iteration Proof. (14) holds from (9), and Remarks 2 and 4.
of DP-PS. Moreover, DP-PS with K total iterations pro- (15) holds because of the nonexpansion property of
vides ¯-differential privacy against an adversary observ- the projection and the supergradient inequality, namely,
ing the information exchanged during the entire process H(λ) − H(λk ) ≤ hy k , λ − λk i for all λ ∈ Λ.
of DP-PS, if ξ˜zik
is extracted from L(ξ˜zik
|K ∆¯kzi /¯
). We emphasize that GU (¯ ) increases as ¯ decreases.
1) Rule 1: Under Rule 1 it follows from (15) that
Proof. See Appendix A.
kλk+1 − λ? k2 ≤ kλk − λ? k2 + αk2 GU (¯
)+
Remark 3. (Target Privacy Level) We denote by 1/¯ a
2αk H(λk ) − H(λ? ) + 2αk hξ˜k , λk − λ? i, ∀k ∈ N. (16)


target privacy level (TPL) inproportional to the privacy
loss ¯. As TPL increases, the variance of ξ˜zi k
, namely,
2(∆¯kzi /¯
)2 , increases for fixed ∆¯kzi and stronger data By taking the conditional expectation on (16), one can
privacy is achieved according to Definition 1. derive the following inequality:
E kλk+1 − λ? k2 | λk ≤ kλk − λ? k2 + αk2 GU (¯
 
IV. C ONVERGENCE OF DP-PS )+
k ?

In this section we study how TPL affects the con- 2αk H(λ ) − H(λ ) , ∀k ∈ [K], (17)
vergence of DP-PS. In Table I we describe three rules where the inequality holds because of E[ξ˜zi
k
|λk ] = 0 for
for determining step size and search direction. Note that all z ∈ Z and i ∈ C(z). By the law of total expectation
the step size in Rule 1 is deterministic and square- with respect to λk in (17), we obtain
summable but not summable and that the step sizes
E kλk+1 − λ? k2 ≤ E kλk − λ? k2 + αk2 GU (¯
   
in Rule 2 and Rule 3 are stochastic and affected by )+
ỹ k , which are a variant of Polyak [22] and CFM [23], k ?
 
2αk E H(λ ) − H(λ ) , ∀k ∈ [K]. (18)
respectively. As compared with the previous work in [12]
that proposes DP-ADMM guaranteeing the convergence We recursively add (18) from k = 1 to k = K to obtain
in expectation, the DP-PS with the three rules provides E kλK+1 − λ? k2 ≤ kλ1 − λ? k2 +
 
the convergence in expectation and probability, and the K
X X K   
almost sure convergence, which is a stronger result. GU (¯ αk2 + 2 αk E H(λk ) − H(λ? ) .

) (19)
k=1 k=1
TABLE I: Three rules for DP-PS.
Since
 ∃λU : λU ≥ kλ1 − λ? k2 by Assumption 1 and
Rule Step size
αk = a/k,
Search direction
E kλK+1 − λ? k2 ≥ 0, (19) can be expressed as
1 sk (ỹ k ) := ỹ k
where a > 0. K K 
? k
X X 
H(λ )−H(λ )
λU + GU (¯ αk2 ≥ 2 αk H(λ? ) − E H(λk )

2 αk := ksk (ỹ k )k2
sk (ỹ k ) := ỹ k )
sk (ỹ k ) := ỹ k + ζk sk−1 (ỹ k−1 ), k=1 k=1
H(λ? )−H(λk ) hsk−1 (ỹ k−1 ),ỹ k i K
3 αk := ksk (ỹ k )k2
ζk := max{0, −χk ksk−1 (ỹk−1 )k2 },  X  
where s0 = 0 and χk ∈ [0, 2] ≥ 2 αk H(λ? ) − max E[H(λk )]
k∈[K]
k=1
K
 X  
Assumption 1. Λ is compact and λ∗ ∈ Λ maximizes H. αk H(λ? ) − E max H(λk ) ,

≥ 2 (20)
k∈[K]
k=1
Remark 4. For the Laplacian noise ξ˜zi k
in (9), we where the last inequality holds due to Jensen’s inequal-
˜ U
) ∈ R+ , which increases
notice that there exists ξzi (¯ ity. By substituting αk = a/k in (20), we obtain
as ¯ decreases, such that ξ˜zi
k
∈ [−ξ˜zi
U
), ξ˜zi
(¯ U
(¯
)] for all
) ∞ (a/k)2
λU + GU (¯
P
k ∈ [K], where K is the total number of iterations. H(λ? ) − E Hbest (λK ) ≤ PK k=1
 
, (21)
2 k=1 (a/k)
Lemma 1. For all k ∈ [K], (i) kỹ k k2 ∈ [GL , GU (¯
)], where Hbest (λK ) := maxk∈[K] H(λk ).
where GL is a small positive number, and

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

Theorem 2. Algorithm 1 with Rule 1 provides a se- increases as ¯ decreases, it implies that there exists a
quence that converges in expectation and probability, trade-off between TPL and solution accuracy.
namely,
We show, however, that the trade-off vanishes under
lim E Hbest (λK ) = H(λ? ),
 
(22a) the following assumption.
K→∞

lim P H(λ? ) − Hbest (λK ) ≥  = 0,


(22b) Assumption 2. (Adapted from Assumption 3.1 in [25])
K→∞
There exists µ > 0 such that
for any  > 0. Furthermore, the rate of convergence in
expectation is O(GU (¯
)/ log(K)), where GU (¯
) increases µkλ − λ? k ≤ H(λ? ) − H(λ), ∀λ ∈ Λ, (27a)
k k k
as ¯ decreases. ks (ỹ ) − y k < µ/2, ∀k ∈ N, (27b)

Proof. See Appendix B. where the first inequality indicates that the function H
To show that Algorithm 1 provides a sequence that has a sharp set of maxima over a convex set Λ and the
converges with probability 1, we introduce the notion of second inequality indicates that the distance between the
the stochastic quasi-Feyer sequence in Definition 3. search direction and the supergradient is bounded.
Definition 3. (Stochastic quasi-Feyer sequence [24]) Assumption 2 is mild since the function H is polyhe-
A sequence of random vectors {z k }∞
k=1 is a stochastic
dral for our case with a reasonable choice of TPL.
quasi-Feyer sequence for a set Z ⊂ Rn if E[kz 1 k2 ] < Theorem 4. Under Assumption 2, Algorithm 1 with Rule
∞, and for any z ∈ Z, 2 provides a sequence that converges in expectation,
E kz − z k+1 k2 | z 1 , . . . , z k ≤ kz − z k k2 + dk , ∀k ∈ N,
 
in probability, and with probability 1.
√ The rate of con-
X∞ vergence in expectation is O(GU (¯)/ K), where GU (¯)
dk ≥ 0, ∀k ∈ N, E[dk ] < ∞. increases as ¯ decreases.
k=1
Proof. See Appendix D.
Theorem 3. Algorithm 1 with Rule 1 provides a se- 3) Rule 3: Under Rule 3 the search direction sk (ỹ k )
quence that converges with probability 1, namely, 0
is a linear combination of {ỹ k }k−1
k0 =1 .
P lim Hbest (λK ) = H(λ? ) = 1.

(23) Lemma 2. Under Rule 3 we have
K→∞

Proof. See Appendix C. ksk (ỹ k )k2 = kỹ k + ζk sk−1 (ỹ k−1 )k2 ≤ kỹ k k2 , ∀k ∈ N.
2) Rule 2: Under Rule 2 it follows from (15) that

2 Proof. If ζk = 0, then sk (ỹ k ) = ỹ k . If ζk > 0, then
k+1 ? 2 k H(λ? ) − H(λk )
? 2
kλ − λ k ≤ kλ − λ k − + kỹ k + ζk sk−1 k2 − kỹ k k2 = ζk2 ksk−1 k2 + 2ζk hsk−1 , ỹ k i
kỹ k k2
? k
H(λ ) − H(λ ) ˜k hsk−1 , ỹ k i2 hsk−1 , ỹ k i2
2 kξ k · kλk − λ? k (24) = χ2k − 2χk ≤ 0,
kỹ k k2 ks k−1 k 2 ksk−1 k2

2
k ? 2 H(λ? ) − H(λk ) where the last inequality holds since χk ∈ [0, 2] as
≤ kλ − λ k − + M (¯ ), defined in Table I.
GU (¯
)
From Lemma 2, similar results from Rule 2 can be
where the first inequality holds due to the Cauchy–
derived. Under Rule 3 it follows from (15) that
Schwarz inequality and the last inequality holds due to
2
) ∈ (0, ∞) based on Remark 4,
the existence of M (¯ k+1 ? 2 k H(λ? ) − H(λk )
? 2
kλ − λ k ≤ kλ − λ k − +
Lemma 1, and Assumption 1. By taking the expectation ksk (ỹ k )k2
and applying Jensen’s inequality, we have ? k
H(λ ) − H(λ ) k k
2 ks (ỹ ) − y k k · kλk − λ? k (28)
ksk (ỹ k )k2
E kλk+1 − λ? k2 ≤ E kλk − λ? k2 −
   

2

2 H(λ? ) − H(λk )
H(λ? ) − E H(λk ) /GU (¯ k ? 2

) + M (¯). (25) ≤ kλ − λ k − + R(¯ ),
GU (¯
)
Following the similar derivation from Rule 1, we obtain where the last inequality holds due to Lemma 2 and the
existence of R(¯ ) ∈ (0, ∞) based on the boundness of
s

λU + KM (¯
) GU (¯
)
H(λ? ) − E Hbest (λK ) ≤ sk (ỹ k ) by its construction, Lemma 1, and Assumption 1.
 
. (26)
K
We emphasize that (28) is similar to (24). Thus one can
Based on (26), we state the following proposition. derive results similar to (26), Proposition 1, and Theorem
4 under Rule 3.
Proposition 1. Algorithm 1 with Rule 2 produces a
sequence that converges in expectation to a point within
p Remark 5. We remark that all the results related to the
M (¯
)GU (¯
) of the optimal value. Since M (¯ )GU (¯
) convergence of DP-PS also hold when solving AC OPF

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

described in Remark 1. However, the strong duality does 15000 15000

not hold for AC OPF, so the consensus constraints may 10000 10000
not be satisfied at termination. 5000 5000
V. N UMERICAL E XPERIMENTS 0 0
To support our findings from Sections III and IV, -5000 -5000
we showcase that increasing TPL of DP-PS does not 1 10 100 500 3000 1 10 100 500 3000
affect the solution accuracy, although it does affect com- 10
5
10
5

putation. In all the experiments, we solve optimization 1.3 1.3

models by IPOPT [26] via Julia 1.5.0 on a personal
1.25 1.25
laptop with an Intel Core i9 CPU and 64 GB of RAM.
1) Experimental Settings: For the power network 1.2 1.2
instances, we consider case 14 and case 118 from
1.15 1.15
Matpower [21]. The optimal objective values of SOC 1 10 100 1 10 100
OPF (2) are obtained by utilizing IPOPT: Z ∗ = 8075.1
for case 14 and Z ∗ = 129341.9 for case 118. The (a) DP-PS (b) DP-ADMM
networks are decomposed as described in Table II. Fig. 2: Objective values computed by DP-PS (left) and
TABLE II: Set Nz of buses for each zone z ∈ Z. DP-ADMM (right) that solve case 14 (top) and case 118
(bottom) under various ¯.
case 14 case 118 [27]
Zone 1 {1–5} {1–33}, {113–115},{117}
Zone 2 {7–10} {34–75}, {116}, {118}
Zone 3 {6}, {11–14} {76–112} 3) Convergence of DP-PS: We demonstrate the nu-
merical support for Theorem 4 that increasing TPL does
We consider an adversary who aims to estimate D̄14 = not affect the solution accuracy of DP-PS, although it
47.8 MW for case 14 and D̄13 = 39 MW for case 118, does affect computation.
respectively, by solving the adversarial problem (6) for Solution Accuracy: In Figure 3 we report the optimality
|K(T
b )| times, where T is any integer number less than
gap at each iteration k of DP-PS. The results show that
total iterations K of DP-PS and the sequence generated by DP-PS converges regardless
b ) := ∪bK/T c {(t − 1)T + 1, . . . , tT }.
K(T (29) of the ¯ value. We also discuss the impact of the number
t=1
of zones on the convergence of DP-PS in Section V-6.
Recall that K
b in Section III-1 is K(1).
b
Computation: Figure 3 demonstrates that DP-PS with
On the other hand, we aim to protect demand data smaller ¯ requires more iterations to converge. In Figure
from the adversary by using the proposed DP-PS. First, 4 we report the total number of iterations required for
we compute ∆¯kzi in (11) with β = 5%. Second, we DP-PS to converge to a solution within 1% of the
consider various ¯ ∈ {0.01, 0.05, 0.1, 1, 10, ∞} of DP- optimality gap. The results show the decreasing trends
PS, where ¯ = ∞ represents a non-private PS and of total iterations as ¯ increases. This implies that there
smaller ¯ ensures stronger data privacy. Note that DP- exists a trade-off between TPL and computation.
PS with K total iterations and 1/¯  TPL provides ¯-DP
(resp., K¯-DP) against an adversary with T = 1 (resp., 102 102
T = K) in (29). We use Rule 3 depicted in Section IV
for our experiments.
101 101
2) Comparison with DP-ADMM: We compare the
proposed DP-PS with the existing DP-ADMM [13] (see
Appendix E for details on DP-ADMM). 100 100
In Figure 2 we report the objective values resulting 0 1000 2000 3000 0 50 100
by DP-PS and DP-ADMM for solving the case-14 and
case-118 instances. When ¯ = 0.01 (i.e., larger noises Fig. 3: Optimality gap of DP-PS that solves case 14 (left)
are introduced for stronger data privacy), the objective and case 118 (right) under various ¯.
value of DP-ADMM significantly fluctuates and is even
larger than the optimal objective value Z ∗ of the SOC 4) Data Privacy Preservation: We numerically show
OPF model. This implies that the sequence provided by that increasing TPL provides higher data privacy.
DP-ADMM does not converge especially when stronger First, we consider various K(Tb ) when construct-
data privacy is required. In contrast, the proposed DP-PS ing the adversarial problem (6). As T increases, the-
always provides a lower bound on Z ∗ and the sequence oretically, the accuracy of the demand estimated by
converges to Z ∗ . solving (6) with K ∈ K(T b ) increases. We report in

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

2000 50 100 100

1500 45
1000
40 50 50

500 35
0 0

10

10

10

10
01

05
1

01

05
1

01

05
1

01

05
1
0.

0.

0.

0.
0.

0.

0.

0.

0.

0.

0.

0.
Fig. 4: Total iterations of DP-PS for solving case 14 Fig. 6: Summary for case 14 (left) and case 118 (right).
(left) and case 118 (right) required to enter within 1%
of the optimality gap.
2 buses for each zone of case 14 and case 118 systems
when |Z| = 7 and |Z| = 50, respectively. We observe
Figure
P 5 an average demand estimation error (DEE): that the optimality gap slightly increases as the number
b ) DE(K)/|K(T )|, where DE(K) is defined in of zones increases, but not significantly.
b
K∈K(T
(8). The results show (i) decreasing trends of the average
DEE as ¯ increases for fixed T and (ii) decreasing trends 102 102
of the average DEE as T increases for fixed ¯. Moreover,
the average DEE for fixed ¯ seems to converge to a 101 101
point as T increases. The results imply that increasing
0
TPL produces stronger data privacy (e.g., see K(100)
b in 10 100
Figure 5 (right) when ¯ = 0.01).
0 1000 2000 3000 0 50 100
100 30
Fig. 7: The impact of the number of zones on the
20 convergence when ¯ = 0.1 for case 14 (left) and case
50
10
118 (right).

0 0 7) AC OPF: In this section we show that the con-

1

10

10
01

05
1

01

05
1

vergence and the data privacy preservation of DP-PS

0.

0.
0.

0.

0.

0.

are also achieved when solving AC OPF (see Remarks

Fig. 5: Average demand estimation error under various 1 and 5). To this end we present Figures 8 and 9,
K(T
b ) for case 14 (left) and case 118 (right). which are counterparts of Figures 3 and 5, respectively.
When ¯ = 0.01, more iterations may be required for the
5) Summary: We report in Figure 6 the optimality convergence. Again, the sequence produced by DP-PS
gap at the termination of DP-PS and the adversarial’s may converge to an infeasible point for AC OPF.
chance of success (CoS) defined as follow:
102 102
X X X
CoS(G) = 100 × I(DE(K)) ≤ G)/ |K(T
b )|,
T ∈T K∈K(T
b ) T ∈T

101 101
where G is a prespecified value (e.g., G = 1%), T
is a collection of various T , K(Tb ) is in (29), DE(K)
is in (8), I(DE(K) ≤ G) = 1 if DE(K) ≤ G and 100 100

I(DE(K) ≤ G) = 0 otherwise. The results demonstrate 0 1000 2000 3000 0 50 100

that as ¯ decreases, the adversarial’s chance of successful

demand estimation decreases while the optimality gap Fig. 8: Approximation error of DP-PS that solves case
still remains the same. 14 (left) and case 118 (right) under various ¯.
6) The impact of the number of zones on the con-
vergence: As the number of zones increases, the con-
vergence of DP-PS can become slower. To see this, we VI. C ONCLUSION
use a partitioning algorithm [28] to generate different We studied a privacy-preserving distributed OPF and
zones of the power systems. This algorithm is available proposed a differentially private projected subgradient
at Metis.jl. In Figure 7, we report the optimality (DP-PS) algorithm that includes a solution encryption
gap produced by DP-PS with ¯ = 0.1 for case 14 and step. In this algorithm Laplacian noise is introduced to
case 118 instances decomposed by |Z| ∈ {3, 5, 7} and encrypt solution exchanged within the algorithm, which
|Z| ∈ {3, 10, 50}, respectively. Note that there are about leads to ¯-differential privacy on data. The target privacy

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

100
[12] Z. Huang, R. Hu, Y. Guo, E. Chan-Tin, and Y. Gong, “DP-
30
ADMM: ADMM-based distributed learning with differential pri-
20 vacy,” IEEE Transactions on Information Forensics and Security,
50 vol. 15, pp. 1002–1012, 2019.
10 [13] V. Dvorkin, P. Van Hentenryck, J. Kazempour, and P. Pinson,
“Differentially private distributed optimal power flow,” in 2020
0 0 59th IEEE Conference on Decision and Control (CDC). IEEE,

10

5
10
01

05
1

01

05
1
2020, pp. 2092–2097.
0.

0.
0.

0.

0.

0.
[14] S. Song, K. Chaudhuri, and A. D. Sarwate, “Stochastic gradient
descent with differentially private updates,” in 2013 IEEE Global
Fig. 9: Average demand estimation error under various Conference on Signal and Information Processing. IEEE, 2013,
K(T
b ) for case 14 (left) and case 118 (right). pp. 245–248.
[15] S. Han, U. Topcu, and G. J. Pappas, “Differentially private
distributed constrained optimization,” IEEE Transactions on Au-
tomatic Control, vol. 62, no. 1, pp. 50–64, 2016.
level of DP-PS is chosen by users, which affects not [16] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov,
only the data privacy but also the convergence of the K. Talwar, and L. Zhang, “Deep learning with differential pri-
vacy,” in Proceedings of the 2016 ACM SIGSAC Conference on
algorithm. We showed that a sequence provided by Computer and Communications Security, 2016, pp. 308–318.
DP-PS converges to an optimal solution regardless of [17] C. Coffrin, H. L. Hijazi, and P. Van Hentenryck, “The QC
the ¯ value, but more iterations are required for the relaxation: A theoretical and computational study on optimal
power flow,” IEEE Transactions on Power Systems, vol. 31, no. 4,
convergence as ¯ decreases. Also, we demonstrated that, pp. 3008–3018, 2015.
as ¯ decreases, the adversarial’s chance of successful [18] ——, “Strengthening the SDP relaxation of AC power flows with
demand data inference decreases while the optimality convex envelopes, bound tightening, and valid inequalities,” IEEE
Transactions on Power Systems, vol. 32, no. 5, pp. 3549–3558,
gap remains the same. Finally, as stated in Remarks 1 2016.
and 5, the proposed DP-PS can lead to an infeasible [19] B. Kocuk, S. S. Dey, and X. A. Sun, “Strong SOCP relaxations
solution with respect to the AC OPF model, calling for for the optimal power flow problem,” Operations Research,
vol. 64, no. 6, pp. 1177–1196, 2016.
privacy-preserving algorithms for the model. [20] M. Bynum, A. Castillo, J.-P. Watson, and C. D. Laird, “Strength-
ened SOCP relaxations for AC OPF with McCormick envelopes
and bounds tightening,” in Computer Aided Chemical Engineer-
R EFERENCES ing. Elsevier, 2018, vol. 44, pp. 1555–1560.
[21] R. D. Zimmerman, C. E. Murillo-Sánchez, and R. J. Thomas,
[1] Y. Levron, J. M. Guerrero, and Y. Beck, “Optimal power flow
“MATPOWER: steady-state operations, planning, and analysis
in microgrids with energy storage,” IEEE Transactions on Power
tools for power systems research and education,” IEEE Transac-
Systems, vol. 28, no. 3, pp. 3226–3234, 2013.
tions on power systems, vol. 26, no. 1, pp. 12–19, 2010.
[2] D. K. Molzahn, F. Dörfler, H. Sandberg, S. H. Low, [22] B. T. Polyak, “Introduction to optimization. 1987,” Optimization
S. Chakrabarti, R. Baldick, and J. Lavaei, “A survey of distributed Software, Inc, New York.
optimization and control algorithms for electric power systems,” [23] P. M. Camerini, L. Fratta, and F. Maffioli, “On improving
IEEE Transactions on Smart Grid, vol. 8, no. 6, pp. 2941–2962, relaxation methods by modified gradient techniques,” in Non-
2017. differentiable optimization. Springer, 1975, pp. 26–34.
[3] A. X. Sun, D. T. Phan, and S. Ghosh, “Fully decentralized ac [24] Y. M. Ermoliev and R.-B. Wets, Numerical techniques for
optimal power flow algorithms,” in 2013 IEEE Power & Energy stochastic optimization. Springer-Verlag, 1988.
Society General Meeting. IEEE, 2013, pp. 1–5. [25] A. Nedić and D. P. Bertsekas, “The effect of deterministic noise
[4] S. Mhanna, G. Verbič, and A. C. Chapman, “Adaptive ADMM in subgradient methods,” Mathematical programming, vol. 125,
for distributed AC optimal power flow,” IEEE Transactions on no. 1, pp. 75–99, 2010.
Power Systems, vol. 34, no. 3, pp. 2025–2035, 2018. [26] A. Wächter and L. T. Biegler, “On the implementation of an
[5] S. Mhanna, A. C. Chapman, and G. Verbič, “Component-based interior-point filter line-search algorithm for large-scale nonlinear
dual decomposition methods for the OPF problem,” Sustainable programming,” Mathematical programming, vol. 106, no. 1, pp.
Energy, Grids and Networks, vol. 16, pp. 91–110, 2018. 25–57, 2006.
[6] K. Sun and X. A. Sun, “A two-level ADMM algorithm for AC [27] J. Guo, G. Hug, and O. K. Tonguz, “Intelligent partitioning
OPF with convergence guarantees,” IEEE Transactions on Power in distributed optimization of electric power systems,” IEEE
Systems, 2021. Transactions on Smart Grid, vol. 7, no. 3, pp. 1249–1258, 2015.
[7] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership [28] G. Karypis and V. Kumar, “Multilevel k-way partitioning scheme
inference attacks against machine learning models,” in 2017 IEEE for irregular graphs,” Journal of Parallel and Distributed com-
Symposium on Security and Privacy (SP). IEEE, 2017, pp. 3–18. puting, vol. 48, no. 1, pp. 96–129, 1998.
[8] C. Dwork, F. McSherry, K. Nissim, and A. Smith, “Calibrating
noise to sensitivity in private data analysis,” in Theory of cryp-
tography conference. Springer, 2006, pp. 265–284.
[9] C. Dwork, A. Roth et al., “The algorithmic foundations of differ-
ential privacy.” Foundations and Trends in Theoretical Computer
Science, vol. 9, no. 3-4, pp. 211–407, 2014.
[10] T. Zhang and Q. Zhu, “Dynamic differential privacy for ADMM-
based distributed classification learning,” IEEE Transactions on
Information Forensics and Security, vol. 12, no. 1, pp. 172–187,
2016.
[11] ——, “A dual perturbation approach for differential private
ADMM-based distributed empirical risk minimization,” in Pro-
ceedings of the 2016 ACM Workshop on Artificial Intelligence
and Security, 2016, pp. 129–137.

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

10

K
A PPENDIX A =
Y k
L(ỹzi ¯kzi /¯
− Qkzi (Dz )|K ∆ )
P ROOF OF T HEOREM 1 k=1

First, in the kth iteration of DP-PS, for all z ∈ Z and K

Y 1 |ỹ k − Qk (Dz )|
k
i ∈ C(z), we denote by PRkzi (Dz ) (ỹzi ) the probability = ¯ k
exp(− zi ¯kzi ).
k=1
2K ∆zi /¯
 K ∆zi /¯

k k
density at any ỹzi ∈ Sk , where Rzi is defined in (12)
and Sk is any subset of Range(Rkzi ). Then we have Taking similar steps in the first part of this proof, we
Z obtain
P{Rkzi (Dz ) ∈ Sk } = PRk k
(ỹzi k
)dỹzi . PRzi (Dz0 ) (ỹzi )
zi (Dz )
Sk ) ≤
exp(−¯ ), ∀Dz0 ∈ D
≤ exp(¯ bβ (D̄z ),
PRzi (D̄z ) (ỹzi )
Now consider the following ratio:
PRk k
(ỹzi ) ¯kzi /¯ and integrating ỹzi over S yields (30). This completes
0
zi (Dz )
k
L(ỹzi − Qkzi (Dz0 )|∆ )
k
= k k ¯k /¯
the proof.
PRk (ỹzi ) L(ỹzi − Qzi (D̄z )|∆ zi )
zi (D̄z )


¯kzi |ỹzi − Qkzi (Dz0 )|

k
= exp ¯/∆ − Qkzi (D̄z )| − |ỹzi
k
A PPENDIX B

¯kzi |Qkzi (Dz0 ) − Qkzi (D̄z )|


 P ROOF OF T HEOREM 2
≤ exp ¯/∆
Since H(λ∗ ) − E[Hbest (λk )] ≥ 0 and the right-hand
), ∀Dz0 ∈ D
≤ exp(¯ bβ (D̄z ),
side of (21) goes to 0 as K → ∞, (22a) holds. Also,
where L is from Definition 2, the first inequality (22b) holds due to Markov’s inequality, namely, for  >
holds due to the reverse triangle inequality, namely, 0,
|a| − |b| ≤ |a − b|, and the last inequality holds since P H(λ? ) − Hbest (λK ) ≥  ≤ E H(λ? ) − Hbest (λK ) /, (31)
  
∆¯kzi ≥ |Qkzi (Dz0 ) − Qkzi (D̄z )| for all Dz0 ∈ D
bβ (D̄z ) from
(11). Similarly, one can obtain a lower bound as follows: where the right-hand side of (31) goes to 0 as K → ∞.

 From the right-hand side of (21), the rate of convergence
¯kzi (β̄) |ỹzi − Qkzi (Dz0 )|

k
exp ¯/∆ − Qkzi (D̄z )| − |ỹzi
k
in expectation is O(GU (¯
)/ log(K)). This completes the
proof.


¯kzi (β̄) |Qkzi (Dz0 ) − Qkzi (D̄z )|


≥ exp − ¯/∆
), ∀Dz0 ∈ D
≥ exp(−¯ bβ (D̄z ),
A PPENDIX C
where the first inequality holds due to the reverse trian- P ROOF OF T HEOREM 3
gle inequality, namely, |a| − |b| ≥ −|a − b|. Therefore, By taking a conditional expectation on (16), we obtain
we have
E kλk+1 − λ? k2 |λ1 , . . . , λk ≤ kλk − λ? k2 + αk2 GU (¯
 
k ),
PRk 0 (ỹzi )
zi (Dz )
) ≤
exp(−¯ k
), ∀Dz0 ∈ D
≤ exp(¯ bβ (D̄z ),
where the inequality holds since αk (H(λk )−H(λ? )) ≤
PRk (D̄z ) (ỹzi )
0 and E[ξ˜zi
zi k
|λk ] = 0, ∀z ∈ Z, ∀i ∈ C(z). Since
k
and integrating ỹzi over Sk yields (13). This proves 1
λ is P bounded by Assumption 2, αk2 GU (¯ ) ≥ 0, and
that ¯-differential privacy on data is guaranteed for each ∞
U
G (¯ ) k=1 αk2 < ∞, the sequence {λk } generated by
iteration k of DP-PS. Algorithm 1 with Rule 1 is a stochastic quasi-Feyer
Second, for all z ∈ Z and i ∈ C(z), we denote by Rzi sequence for a set Λ? of maximizers. Based on Theorem
a randomized function that maps the dataset Dz ∈ R|Nz | 6.1 in [24] and the existence of a subsequence {λks }
k K
to ỹzi := {ỹzi }k=1 , where K is the total number of such that Hbest (λks ) converges to H(λ? ) with probability
iterations consumed by DP-PS. It suffices to show that 1 due to (22b), one can conclude that the sequence {λk }
 
P{Rzi (Dz0 ) ∈ S}  0
∀Dz ∈D
b β (D̄z ), converges to a point in Λ? . For more details, we refer
 ln  ≤ ¯, (30)

P{Rzi (D̄z ) ∈ S} ∀S⊆Range(Rzi ). the reader to the proof of Theorem 6.2 in [24].
We denote by PRzi (Dz ) (ỹzi ) the joint density at any
ỹzi ∈ S. Then we have A PPENDIX D
Z P ROOF OF T HEOREM 4
P{Rzi (Dz ) ∈ S} = PRzi (Dz ) (ỹzi )dỹzi .
S
Under Assumption 2, it follows from (24) that

2
The joint density function can be expressed by the k+1 ? 2 k ? 2 H(λ? ) − H(λk )
conditional density functions: kλ − λ k ≤ kλ − λ k − +
kỹ k k2
PRzi (Dz ) (ỹzi ) = PR1 1
(ỹzi K
, . . . , ỹzi ) H(λ? ) − H(λk ) k k
K
zi (Dz ),...,Rzi (Dz ) 2 ks (ỹ ) − y k k · kλk − λ? k
K 1 K−1 kỹ k k2
=PRK (Dz )|R1 K−1 (ỹzi |ỹzi , . . . , ỹzi ) × ... k 2
zi (Dz ),...,Rzi (Dz ) ?


zi
k ? 2
 2ksk (ỹ k ) − y k k  H(λ ) − H(λ )
× PR1 1
(ỹzi ) ≤ kλ − λ k − 1 −
zi (Dz ) µ kỹ k k2

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TPWRS.2021.3120056, IEEE
Transactions on Power Systems

11

2
≤ kλk − λ? k2 − GL /GU (¯
) H(λ? ) − H(λk ) ,


(32) Algorithm 2 DP-ADMM

where the first inequality holds since ξ˜k = sk (ỹ k ) − y k , 1: Set k ← 1, λ1 ← 0, and φ1 ← 0.
the second inequality holds due to Assumption 2, and the 2: for k ∈ {1, . . . , K} do
last inequality holds due to (1 − 2ksk − ŷ k k/µ) ∈ (0, 1] 3: Given λk and φk , find y k+1 by solving (34a).
from Assumption 2 and Lemma 1. By taking similar 4: # Perturbation of y k+1
steps in Section IV-2, we obtain 5: Solve (11) to find {∆¯kzi }z∈Z,i∈C(z) .
r 6: Extract ξ˜zi
k
from L(ξ˜zi
k ¯k
|∆zi /¯
) in Definition 2.
0 ≤ H(λ ) − E max H(λk ) ≤
?  λU GU (¯
)
. (33) 7: ỹzi ← yzi + ξ˜zi , ∀z ∈ Z, ∀i ∈ C(z)..
k+1 k+1 k
k∈[K] GL K 8: # Solve the second-block problem
Taking similar steps in the proof of Theorem 2, we 9: Solve (34b) with ỹ k+1 .
conclude from (33) that the sequence produced by DP- 10: # Update dual variables
PS with Rule 2 under Assumption 2 converges in expec- λk+1 = λkzi + ρ(φk+1 k+1
− ỹzi ), ∀z ∈ Z, ∀i ∈ C(z).
zi i
tation and in probability. Also, the rate of convergence
in expectation is O(GU (¯
)/K). It follows from (32) that 11: end for
kλk+1 − λ? k2 ≤ kλk − λ? k2 . By taking a conditional
expectation, we obtain
E kλk+1 − λ? k2 |λ1 , . . . , λk ≤ kλk − λ? k2 .
 

Thus, the sequence {λk } generated by DP-PS with

Rule 2 under Assumption 2 is a stochastic quasi-Feyer
sequence for a set Λ? of maximizers. As discussed in
the proof of Theorem 3, it proves the convergence with
probability 1. This completes the proof.

A PPENDIX E
DP-ADMM
We present the augmented Lagrangian dual problem
given by
Xn X  ρ 2
o
max min fz (xz ) + λzi (φi − yzi ) + (φi − yzi )
λ
z∈Z
2
i∈C(z)

s.t. (xz , yz ) ∈ Fz (D̄z ), ∀z ∈ Z,

φi ∈ R, ∀i ∈ C,

where λ is a dual vector associated with constraint (3c).

For every iteration k of the ADMM algorithm, it
updates (y k , φk , λk ) → (y k+1 , φk+1 , λk+1 ) by solving
a sequence of the following subproblems:
k+1
X n k
yz ← arg min fz (xz ) + − λzi yzi +
(xz ,yz )∈Fz (D̄z ) i∈C(z)
ρ k 2
o
(φ − yzi ) , ∀z ∈ Z, (34a)
2 i
k+1
X k ρ k+1 2
φi ← arg min λzi φi + (φi − yzi ) , ∀i ∈ C, (34b)
φi 2
z∈F (i)
k+1 k k+1 k+1
λzi = λzi + ρ(φi − yzi ), ∀z ∈ Z, ∀i ∈ C(z). (34c)

In Algorithm 2, we describe DP-ADMM. In line 3,

we solve the subproblem (34a) to find y k+1 , which is
perturbed by adding the Laplacian noise ξ˜k in line 7. In
line 9, we solve the subproblem (34b) with ỹ k+1 to find
φk+1 . In line 10, the dual variable is updated from λk
to λk+1 .

0885-8950 (c) 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.