Project: #406 Towards Privacy-Preserving Networked Autonomous Mobility: Analysis, Tools Development, and Real-World Evaluation Progress Report - Reporting Period Ending: Sept. 30, 2022 Principal Investigator: Ding Zhao Status: Active Start Date: July 1, 2022 End Date: June 30, 2023 Research Type: Advanced Grant Type: Research Grant Program: FAST Act - Mobility National (2016 - 2022) Grant Cycle: 2022 Mobility21 UTC Progress Report (Last Updated: Sept. 30, 2022, 7:47 p.m.) % Project Completed to Date: 15 % Grant Award Expended: 0 % Match Expended & Document: 0 USDOT Requirements Accomplishments Task 1 aims to provide a summary of privacy theories and privacy issues in networked autonomous mobility, especially the works about differential privacy. Currently, we’ve completed the survey of these topics and found multiple acceleration methods for differential privacy, one of which is applicable for our future work. Privacy issues can be categorized into 3 levels: individual-level privacy, population-level privacy, and proprietary-level privacy. We mainly focus on individual-level privacy in this project. Intuitively, a better privacy-enhancing algorithm is expected to provide more ambiguous information while preserving the accuracy of downstream tasks, which makes the potential adversary less likely to reveal the identity of the data source. For example, some privacy metrics request lower confidence or a higher error of the adversary or attack algorithm. Based on this principle, Differential privacy (DP), as a widely used privacy-preserving mathematical framework, adapts probably approximation correct learning (PAC) to privacy-preserving tasks, which assures the distribution of the sanitized data only shifts a small step from the true distribution bounded by ? and ?. In practice, this goal is usually achieved by adding rigorously calculated noise terms, resulting in fake data which serves as a neighboring dataset in DP. While the pure-DP and vanilla DP use Gaussian noise or Laplace noise bounded by ?-DP and (?,?)-DP, amounts of variants of DP have been proposed and introduced different noise bounds as well as privacy guarantees. Some methods use Rényi-divergence to measure the similarity of the sanitized distribution instead of the linear transformation in the original DP, called RDP, which provides a unified view of multiple DP methods and a stronger privacy guarantee. Besides, other privacy-enhancing techniques are introduced and combined with the DP to achieve better privacy, such as the shuffle model and randomized subsampling. DP requires neighboring datasets with only one entry different from the true dataset, which current deep-learning-based algorithms interpret as data samples with noise. The noise can be added to data in the execution phase or gradient in the optimization phase. DP-SGD first introduced DP to gradient descent, which is later used both in deep learning and reinforcement learning. Perturbation of data is also widely used, especially in visual tasks and NLP. As for DP-SGD-based algorithms, differential privacy libraries are published. Meta AI has developed a privacy engine opacus, which accelerates the training process of DP-SGD-based methods in Torch. In the future, we’ll focus on the active perception task, which utilizes the mobility of robots to get a better perception of scenarios and objects. In this task, the continuous scenarios may raise challenges to the current DP methods. Although some methods already use DP for sequential models and sequential data, these methods still treat each entry as an independent component and may compromise the effectiveness in our environment. and we’ll improve the current DP methods to achieve better results. Specifically, we plan to use Decision Transformer as the backbone and DP-SGD and input perturbation as the privacy-preserving method’s prototype. Impacts n/a Other n/a Outcomes New Partners n/a Issues No changes