#  Privacy Analysis of Affine Transformations in Cloud-based MPC:
Vulnerability to Side-knowledge

Teimour Hosseinalizadeh<EMAIL_ADDRESS>Nils Schlüter
<EMAIL_ADDRESS>Moritz Schulze Darup moritz.schulzedarup@tu-
dortmund.de Nima Monshizadeh<EMAIL_ADDRESS>ENTEG, Faculty of Science
and Engineering, University of Groningen, 9747 AG Groningen, The Netherlands
Department of Mechanical Engineering, TU Dortmund University, Leonhard-Euler-
Str. 2, Dortmund, 44227, Germany

###### Abstract

Search for the optimizer in computationally demanding model predictive control
(MPC) setups can be facilitated by Cloud as a service provider in cyber-
physical systems. This advantage introduces the risk that Cloud can obtain
unauthorized access to the privacy-sensitive parameters of the system and cost
function. To solve this issue, i.e., preventing Cloud from accessing the
parameters while benefiting from Cloud computation, random affine
transformations provide an exact yet light weight in computation solution.
This research deals with analyzing privacy preserving properties of these
transformations when they are adopted for MPC problems. We consider two common
strategies for outsourcing the optimization required in MPC problems, namely
separate and dense forms, and establish that random affine transformations
utilized in these forms are vulnerable to side-knowledge from Cloud.
Specifically, we prove that the privacy guarantees of these methods and their
extensions for separate form are undermined when a mild side-knowledge about
the problem in terms of structure of MPC cost function is available. In
addition, while we prove that outsourcing the MPC problem in the dense form
inherently leads to some degree of privacy for the system and cost function
parameters, we also establish that affine transformations applied to this form
are nevertheless prone to be undermined by a Cloud with mild side-knowledge.
Numerical simulations confirm our results.

###### keywords:

Cyber-Physical Systems, Privacy, Security, Cryptography, Cloud-based Control,
MPC.

, , ,

##  1 Introduction

Cloud computing allows accessing to computing resources such as networks,
servers, storage, applications, and services that can be rapidly provisioned
and released with minimal management effort or service provider interaction
[1]. Researchers in control systems have reaped these benefits for a
computationally demanding controller, namely model predictive control (MPC),
across numerous domains where often interacting with geographically dispersed
sensors and actuators are required. For instance, Cloud-based MPC offers
$53\%$ energy saving and $36\%$ improvement in thermal comfort for an office
building [2], consumption reduction of electrical energy by $71\%$ in
geothermal fields [3], reducing the peak demand during cooling season by
$24\%$ in public schools [4], and flexibility of services in control of an
industrial robot [5]. Nonetheless, numerous security issues arise in Cloud
based MPC due to the nature of Cloud computing, which among them is the
unauthorized access of Could to private data such as system and controller
parameters [6].
To benefit from Cloud based MPC or in general Cloud based optimization and to
preserve the privacy of sensitive parameters against Cloud, numerous solutions
have been proposed which can be categorized into three main classes. The first
class is based on the idea of using noise, where differential privacy (DP) is
the main method in adjusting its amount [7]. DP designs a mechanism for
sufficiently perturbing data using noises with distributions such as Gaussian
and Laplace before releasing the results of computation; for a tutorial in
control systems, see [8]. While DP was used for private filtering in [9], it
was employed in [10] to design a Cloud-enabled deferentially private multi-
agent optimization. The works [11] and [12] also study DP for distributed
optimizations, where perturbing the signals and objective functions are the
tools in achieving DP. Further on, the authors in [13] and [14] utilize Cloud
for designing a linear quadratic controller, where the first study focuses on
system properties and the second is concerned with designing a filter before
applying the privacy mechanism.
The second class of methods for achieving privacy in Cloud based optimizations
relies on adopting tools from cryptography, which among them Homomorphic
Encryption (HE) is dominant. HE refers to cryptosystems that allow addition
and/or multiplication of encrypted data without the need for decryption. While
an optimization problem often needs to be modified to meet the framework of
cryptosystems, the ability of computation over encrypted data enables the
control designer to let Cloud securely solve the problem; for a control
centered tutorial we refer to [15]. While a partially HE was used in [16] for
the design of a privacy preserving Kalman filter and later on for encrypted
control in [17], it was used in [18] and [19] to address the problem of
privacy in quadratic optimizations where the latter also draws on tools from
secure multiparty computation. Along the same line, the authors in [20] and
[21] adopted fully HE and leveled HE for data driven MPC and a Cloud based
distributed optimizations. In another line of research, the private explicit
MPC was studied in [22] using mainly Paillier encryption system, where later
on the method was computationally improved in [23], and further was refined in
[24] using a cryptographic tool known as garbled circuits.
Both of the classes have their own advantages and disadvantages:
differentially private algorithms offer privacy guarantees against Cloud (and
other adversaries) with arbitrary computational power and side-knowledge [7,
p.237], but in general they lead to suboptimal solutions where privacy-
performance trade-offs need to be considered. On the other hand, cryptographic
based methods do not lead to suboptimality and hence performance degradation
[25, p.7], nonetheless they can be computationally and communication wise
prohibitive for real time applications.
To overcome these drawbacks, a third class of methods have been used which in
essence utilize some random transformations as privacy mechanism to change a
problem into an equivalent problem before sharing it with Cloud. One of the
first studies in this research area (in computer science literature) is [26]
where the authors design local preprocessing (disguising) of data for problems
such as matrix multiplication, matrix inversion and convolution of signals
before sending the involved data to Cloud. Along the same line, the authors in
[27], [28] and [29] have studied preserving privacy for linear programs and in
[30] and [31] for quadratic programs for large scale problems where in general
they use affine transformation and permutation techniques to securely
outsource the original problem. We further refer to the survey [32] for other
studies.
In control systems, the idea of using transformations for preserving privacy
in optimization problems started with [33] where a unified framework based on
equivalent optimizations was developed by including the previous studies such
as [27], [28] and [29]. Further on, the approach was adopted in [34], [35] and
[36] and tailored for optimization problems with quadratic costs and linear
constraints. More specifically, an algorithm in [36] for Cloud and system
interactions was designed using isomorphisms and symmetries of control systems
to securely solve an MPC problem. Moreover, the amount of guaranteed privacy
was quantified by considering the dimension of the uncertainty set. In further
development, [37] and [38] have adopted the algebraic transformation method in
[36] for nonlinear and set theoretic MPC, meanwhile [39] and [40] have further
improved it by adding structured noise to the signals in the context of
federated learning and anomaly detection systems.
Contribution. In this research, we analyze the third class of methods for
preserving privacy in an MPC problem (more generally, quadratic
optimizations). The study is along [41] and [42] where the first investigates
random affine transformations from cryptography perspective, and the second
examines the invariant properties of quadratic optimizations under random
affine transformations. Here, we take a different approach, namely we examine
privacy preserving properties of random affine transformations when Cloud has
mild side-knowledge about the problem. This side-knowledge is based on common
characteristics that can be found in control systems. We demonstrate that how
this mild side-knowledge by Cloud weakens some of the privacy guarantees that
these methods in general promise for system and controller parameters.
To this end, we begin with analyzing random affine transformations when they
are applied to the separate form of MPC. We prove that by using the structure
of the MPC cost function, Cloud obtains unauthorized access to private
information about the dynamic of the system under control and cost function
parameters. Furthermore, we show that adding noise to the transformation,
increasing its dimension, changing it to a nonlinear transformation or making
it time-varying will not prevent Cloud from inferring privacy-sensitive
parameters. In addition, we demonstrate that structured noise in high
dimension random affine transformations when it is adopted to preserve privacy
for signals in linear systems is also vulnerable to side-knowledge.
In other direction, we address another strategy for securely outsourcing the
solving of MPC problems and that is the case when the linear system is densely
combined with the cost function and constraints and then random affine
transformations are adopted. We prove that combing a linear system with the
quadratic cost in the MPC problem inherently leads to a better privacy
preserving situation for the cost function parameters (they are uncertain
within a set). Nonetheless, we show that Cloud is still able to infer privacy-
sensitive values about the system and cost function parameters (up to the
inherent uncertainty set) by drawing on side-knowledge such as stability of
the system.
Organization: The rest of the paper is organized as follows: In Section 2 we
present the problem formulation along the main assumption in the study, in
Section 3 we address the privacy preserving guarantees for affine
transformations and its numerous extension when the system dynamics are
separate from cost function. In Section 4 we study the inherent privacy
guarantees for the dense form of MPC, and in Section 5 we analyze the effects
of side-knowledge on privacy guarantees of affine transformations. Numerical
simulations and concluding remarks are presented in Section 6 and 7.
Notation: The set of positive, nonnegative integers and real numbers are
denoted by $\mathbb{N}$, $\mathbb{N}_{0}$ and $\mathbb{R}$, respectively. We
denote the identity matrix of size $n$ by $I_{n}$, the zero matrix of size
$n\times m$ by $0_{n\times m}$, the vector of size $n$ with $1$ in all its
entries by $\mathbb{1}_{n}$ and we drop the index whenever the dimension is
clear from the context. By $A\succ 0$($\succeq 0$), we mean $A$ is a positive
(semi-) definite matrix. With $\otimes$, we denote the Kronecker product. For
a matrix $A\in\mathbb{R}^{m\times n}$, $A^{\ell}$ is a left inverse
($A^{\ell}A=I_{n}$) when it exists, and $A^{\dagger}$ denotes its Moore-
Penrose inverse. Given the elements $\\{a_{i}\\}_{i=1}^{n}$(scalars, vectors
or matrices), we denote
$\begin{bmatrix}a_{1}^{\top},\ldots,a_{n}^{\top}\end{bmatrix}^{\top}$ by
$\operatorname{col}(a_{1},\ldots,a_{n})$ and the block matrix with
$\\{a_{i}\\}_{i=1}^{n}$ on its diagonal by
$\operatorname{blockdiag}(a_{1},\ldots,a_{n})$. With bold symbols, we denote
the secret in transformations.

##  2 Problem formulation

Consider a discrete-time LTI system

$\displaystyle x_{k+1}$ $\displaystyle=Ax_{k}+Bu_{k}$ (1) $\displaystyle
y_{k}$ $\displaystyle=Cx_{k},$

where $x_{k}\in\mathbb{R}^{n}$ is the state, $u_{k}\in\mathbb{R}^{m}$ the
input, $y_{k}\in\mathbb{R}^{p}$ the output at time $k\in\mathbb{N}_{0}$ and
the matrices $A$, $B$, $C$ have consistent dimensions. In this study, we
assume that the system (1) is controllable and observable. For system (1), we
define the quadratic cost function over a finite horizon of $N$ steps as

$J(\boldsymbol{x},\boldsymbol{u})\coloneqq
x_{N}^{\top}Px_{N}+\sum_{k=0}^{N-1}\begin{bmatrix}x_{k}^{\top}&u_{k}^{\top}\end{bmatrix}M\begin{bmatrix}x_{k}\\\
u_{k}\end{bmatrix},$ (2)

where $M=\operatorname{blockdiag}(Q,R)$ with $Q\succeq 0$, $R\succ 0$ and
$P\succeq 0$ determine the cost function matrices and
$\boldsymbol{x}\coloneqq\operatorname{col}(x_{0},x_{1},\ldots,x_{N-1})$ and
$\boldsymbol{u}\coloneqq\operatorname{col}(u_{0},u_{1},\ldots,u_{N-1})$. In an
MPC problem with bounds on inputs and outputs, we need to solve the following
quadratic optimization problem [43]:

$\displaystyle\min_{\boldsymbol{x},\boldsymbol{u}}\quad$ $\displaystyle
J(\boldsymbol{x},\boldsymbol{u})$ (3a) s.t. $\displaystyle\eqref{eq:lin_sys}$
(3b) $\displaystyle u_{\text{min}}\leq u_{k}\leq u_{\text{max}},$
$\displaystyle k=0,\ldots,N-1$ (3c) $\displaystyle y_{\text{min}}\leq
y_{k}\leq y_{\text{max}},$ $\displaystyle k=1,\ldots,N,$ (3d)

where $x_{0}=x(0)$, $u_{\text{min}},u_{\text{max}}\in\mathbb{R}^{m}$ and
$y_{\text{min}},y_{\text{max}}\in\mathbb{R}^{p}$ specify the constraints on
$u_{k}$ and $y_{k}$, and $\boldsymbol{x}$ and $\boldsymbol{u}$ are the
optimization variables. After computing the optimizer $\boldsymbol{u}^{*}$,
MPC typically builds on applying the first block, i.e.
$\boldsymbol{u}^{*}_{0}$, to the system and repeating the optimization at the
next sampling instance[44, p. 89].
The plant owner or simply Plant can outsource computation of the optimizer
pair $(\boldsymbol{x}^{*},\boldsymbol{u}^{*})$ to a service provider (Cloud)
by requiring Cloud to follow a set of instructions (an algorithm). How Cloud
behaves in the algorithm is determined below [45, p.37]:

######  Definition 1 (Cloud model).

Cloud is an honest-but-curious party, meaning that it follows any instructions
given by Plant and does not deviate from them, but it stores the data received
from Plant to learn more than what the algorithm allows.$\hfill\square$

Note that Definition 1 also specifies the adversary model in the language of
secure control [46]. Furthermore, while Cloud in this study is a passive
adversary, it can cooperate with other type of adversaries by sharing
sensitive information about Plant.
In general, Plant and Cloud can interact with each other for solving (3) in
two distinct ways:

  1. (I)

Plant separately transmits to Cloud the system dynamic (1), cost function (2),
and constraints (3c)-(3d).

  2. (II)

Plant densely combines the linear system (1) with cost function (2) and
constraints (3c)-(3d), and then transmits them to Cloud.

For each case, Plant uses random affine transformations (to be determined
later) to conceal privacy-sensitive parameters of the system dynamics and cost
from Cloud before outsourcing the computation of the optimizer
$(\boldsymbol{x}^{*},\boldsymbol{u}^{*})$ of (3). The central problem of
interest that we aim to address in this manuscript is as follows:

######  Problem 1.

Suppose that Plant adopts random affine transformations as its privacy
preserving mechanism. For each case (I) and (II), determine what Cloud infers
about system dynamics and cost parameters. $\hfill\square$

To answer Problem 1 we make the following standing assumption throughout the
manuscript:

######  Standing Assumption 1.

Cloud is aware of the structure of the outsourced problem as well as the
adopted privacy-preserving mechanism, except for the values of the random
affine transformations. $\hfill\square$

The assumption is consistent with the standard assumption in cryptography,
known as Kerckhoffs’ principle or Shannon’s maxim, that an encryption scheme
must be designed to be secure even if the adversary knows all the details of
the scheme except for the key (see, e.g. [25, p.7]). The other reason that
urges us to work under this assumption is the role that knowledge of the
system model plays in performing an attack against CPSs by adversaries. As it
has been reported in the literature of secure control (e.g. [46]) covert, zero
dynamics and false data injection attacks to name but a few, rely largely on
the knowledge that an adversary has about the system under control. Therefore,
it is preferable to work with a comprehensive a priori knowledge for Cloud
(adversary), as in the case of Standing Assumption 1.

##  3 Privacy Analysis of transformations for MPC in separate form

In this section, we provide an answer to Problem 1 for the first case, i.e.,
when Plant transmits to Cloud cost and linear system separately after applying
a transformation.

###  3.1 Privacy mechanism

To preserve the privacy of system and cost parameters in (3), Plant can use
the following transformation

$\displaystyle\tilde{x}_{k}$ $\displaystyle=\boldsymbol{T}x_{k}$ (4a)
$\displaystyle\tilde{u}_{k}$
$\displaystyle=\boldsymbol{F}x_{k}+\boldsymbol{G}u_{k}$ (4b)
$\displaystyle\tilde{y}_{k}$ $\displaystyle=\boldsymbol{S}y_{k},$ (4c)

where the randomly chosen matrices $\boldsymbol{T}\in\mathbb{R}^{n\times n}$,
$\boldsymbol{G}\in\mathbb{R}^{m\times m}$, and
$\boldsymbol{S}\in\mathbb{R}^{p\times p}$ are invertible, and
$\boldsymbol{F}\in\mathbb{R}^{m\times n}$. Under the transformation (4), the
system dynamic is mapped to

$\displaystyle\tilde{x}_{k+1}$
$\displaystyle=\underbrace{\boldsymbol{T}(A-B\boldsymbol{G}^{-1}\boldsymbol{F})\boldsymbol{T}^{-1}}_{\eqqcolon\tilde{A}}\tilde{x}_{k}+\underbrace{\boldsymbol{T}B\boldsymbol{G}^{-1}}_{\eqqcolon\tilde{B}}\tilde{u}_{k}$
(5) $\displaystyle\tilde{y}_{k}$
$\displaystyle=\underbrace{\boldsymbol{S}C\boldsymbol{T}^{-1}}_{\eqqcolon\tilde{C}}\tilde{x}_{k}.$

Similarly, the cost function (2) is modified to

$\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})\coloneqq\tilde{x}_{N}^{\top}\tilde{P}\tilde{x}_{N}+\sum_{k=0}^{N-1}\begin{bmatrix}\tilde{x}_{k}^{\top}&\tilde{u}_{k}^{\top}\end{bmatrix}\tilde{M}\begin{bmatrix}\tilde{x}_{k}\\\
\tilde{u}_{k}\end{bmatrix},$ (6)

where $\tilde{P}\coloneqq\boldsymbol{T}^{-\top}P\boldsymbol{T}^{-1}$ and
$\tilde{M}\coloneqq\boldsymbol{L}^{\top}M\boldsymbol{L}$ with

$\boldsymbol{L}\coloneqq\begin{bmatrix}\boldsymbol{T}^{-1}&0\\\
-\boldsymbol{G}^{-1}\boldsymbol{F}\boldsymbol{T}^{-1}&\boldsymbol{G}^{-1}\end{bmatrix}.$
(7)

Note that we have not included (3c)-(3d) since our privacy analysis in this
section is independent of those constraints.
The transformation (4) has been formally proposed in [36] and based on it an
algorithm for solving (3) has been developed. In the algorithm, Cloud receives
from Plant the transformed system (5) and the cost function (6) in the start
of their interactions (the handshaking phase) and then upon receiving
$\tilde{y}_{k}=\boldsymbol{S}y_{k}$ and estimating $\tilde{x}_{k}$ Cloud
solves the optimization (6) to obtain $\tilde{u}_{k}$. Then, Cloud sends
$\tilde{u}_{k}$ to Plant where it can retrieve $u_{k}$ using the equality in
(4b).

######  Remark 1.

The privacy-preserving mechanism based on (4) is correct namely the optimizer
of the original problem (3) can be retrieved exactly (unlike most noise-based
methods), and it is light-weight in computations, meaning Plant does not need
to undergo extra computations other than the linear transformation in (4). As
such, the required computation is significantly lower than what is needed for
solving problem (3), in contrast to most standard cryptography-based methods.
It should be mentioned that the transformation and the analysis for its
privacy guarantees are the tailored versions of transformations in [33], [37]
and [38] for quadratic optimizations. This means that while our analysis is
concerned with the transformation in [36] it can be applied to the results in
the related studies. $\hfill\square$

###  3.2 Privacy analysis

Before proceeding with the analysis, we explicitly state the assumption below,
with regard to Cloud’s knowledge about the cost function.

######  Assumption 1.

Cloud knows that the matrix $M$ in (2) has a block diagonal structure.
$\hfill\square$

We emphasize that, consistent with Standing Assumption 1, Cloud does not know
the ground-truth value of $Q$ and $R$ in $M$. Note, the block diagonal $M$
corresponds to the conventional LQR problem [47, p.33]. Next, we state how
Cloud can use the side-knowledge in Assumption 1 to infer privacy-sensitive
information about the system dynamics and cost function.

######  Theorem 1.

Let Assumption 1 hold, and suppose that Cloud knows the transformed matrices
$(\tilde{A},\tilde{B},\tilde{C})$ in (5) and the transformed cost function in
(6). Then, Cloud infers $\hat{A}=\boldsymbol{T}A\boldsymbol{T}^{-1}$ and
$\hat{Q}=\boldsymbol{T}^{-\top}Q\boldsymbol{T}^{-1}$ about the system and cost
parameters.

_Proof_. See Appendix A.$\hfill\blacksquare$
It follows from Theorem 1 that under the mild side-knowledge in Assumption 1,
Cloud can circumvent this transformation and essentially identify the dynamics
up to a similarity $(\boldsymbol{T})$ as well as re-scaling transformations
($\boldsymbol{S}$ and $\boldsymbol{G}$). For instance, using
$\hat{A}=\boldsymbol{T}A\boldsymbol{T}^{-1}$, it finds the eigenvalues of the
state matrix $A$, i.e., poles of the system (1), which in turn can be
leveraged by adversaries for designing additional cyber-attacks.
Next, we present a few remarks to further elaborate on different aspects of
(4):

######  Remark 2 (Treatment of side-knowledge in [36]).

It is worth recasting the result of Theorem 1 in the framework of [36], where
different scenarios concerning the side-knowledge available to Cloud are
treated. The side-knowledge in Assumption 1 translates into the design
constraint that Plant should ensure that the modified cost ($\tilde{M}$) in
(6) conforms with Cloud’s knowledge. This means that the blocks
$\tilde{M}_{2,1}$ and $\tilde{M}_{1,2}$ should be equal to $0$ which are
satisfied if and only if $\boldsymbol{F}=0$. Hence, the set of isomorphism in
the terminology of [36] is reduced to
$\psi=(\boldsymbol{T},\boldsymbol{0},\boldsymbol{G},\boldsymbol{S})$, which
weakens the privacy guarantees in the notable case of the cost function
(2).$\hfill\square$

######  Remark 3 (General cost function).

It must be noted that when the matrix $M$ in cost function has no specific
structure Cloud cannot perform the inference attack described in Theorem 1. To
see this, let the matrix $M$ in (2) be redefined as

$M=\begin{bmatrix}Q&N\\\ N^{\top}&R\end{bmatrix},$

where $M\succeq 0$ and $R\succ 0$. The matrix $\tilde{M}$ in the transformed
cost (6) is then given by:

$\tilde{M}=\begin{bmatrix}\tilde{M}_{1,1}&\star\\\
\boldsymbol{G}^{-\top}N^{\top}\boldsymbol{T}^{-1}-(\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1})\boldsymbol{F}\boldsymbol{T}^{-1}&\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}\end{bmatrix},$

with

$\displaystyle\tilde{M}_{1,1}=\boldsymbol{T}^{-\top}$ $\displaystyle
Q\boldsymbol{T}^{-1}+(\boldsymbol{F}\boldsymbol{T}^{-1})^{\top}(\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1})(\boldsymbol{F}\boldsymbol{T}^{-1})$
$\displaystyle-$
$\displaystyle\boldsymbol{T}^{-\top}N\boldsymbol{G}^{-1}\boldsymbol{F}\boldsymbol{T}^{-1}-(\boldsymbol{F}\boldsymbol{T}^{-1})^{\top}\boldsymbol{G}^{-\top}N^{\top}\boldsymbol{T}^{-1}.$

The additional term $\boldsymbol{G}^{-\top}N^{\top}\boldsymbol{T}^{-1}$ in
block $(2,1)$ hinders Cloud from applying the sequence of observations
detailed in the proof of Theorem 1. In particular, the matrix
$\boldsymbol{F}\boldsymbol{T}^{-1}$ cannot be computed in the second step.
$\hfill\square$

######  Remark 4 (Loss of observability).

Note that if $(A,B,C)$ is controllable and observable, the transformed system
$(\tilde{A},\tilde{B},\tilde{C})$ in (5) is controllable but not necessarily
observable. This is due to the fact that the artificially introduced state
feedback (4b) preserves controllability, but not necessarily observability.
Bearing in mind the discussion preceding Remark 1, state estimation is a part
of the protocol outsourced to Cloud. Hence, loss of observability has a major
consequence in the execution of the algorithm. This means that
$\boldsymbol{F}$ cannot be picked arbitrarily; but rather it should be
selected such that the transformed pair
$(\boldsymbol{T}(A-B\boldsymbol{G}^{-1}\boldsymbol{F})\boldsymbol{T}^{-1},\boldsymbol{S}C\boldsymbol{T}^{-1})$
is observable. An example is provided next. $\hfill\square$

######  Example 1.

Consider a system given by the triple:

$C=\begin{bmatrix}1&0\end{bmatrix},A=\begin{bmatrix}0&1\\\
1&0\end{bmatrix},B=\begin{bmatrix}1\\\ 0\end{bmatrix},$

which is both observable and controllable. Consider a random transformation
according to (4) with $\boldsymbol{F}=[0\quad f]$, $\boldsymbol{G}=1$,
$\boldsymbol{T}=I_{2}$, $\boldsymbol{S}=1$, and some scalar $f$. The
transformed system given by

$\tilde{C}=\begin{bmatrix}1&0\end{bmatrix},\tilde{A}=\begin{bmatrix}0&1-f\\\
1&0\end{bmatrix},\tilde{B}=\begin{bmatrix}1\\\ 0\end{bmatrix},$

is controllable, but it is observable if only if $f\neq 1$. $\hfill\square$

Next, we show that even by using an affine form of transformation (4) or
increasing its dimension, Cloud is still able to infer sensitive information.

###  3.3 Other forms of transformation (4)

We address the privacy analysis when Plant utilizes some variants of
transformation (4) for preserving privacy of linear system and cost function
parameters.

####  3.3.1 Affine form of (4)

Let Plant adopt the following transformation

$\displaystyle\tilde{x}_{k}$
$\displaystyle=\boldsymbol{T}x_{k}+\boldsymbol{r_{1}}$ (8)
$\displaystyle\tilde{u}_{k}$
$\displaystyle=\boldsymbol{F}x_{k}+\boldsymbol{G}u_{k}+\boldsymbol{r_{2}}$
$\displaystyle\tilde{y}_{k}$
$\displaystyle=\boldsymbol{S}y_{k}+\boldsymbol{r_{3}},$

where $\boldsymbol{r_{1}}\in\mathbb{R}^{n}$,
$\boldsymbol{r_{2}}\in\mathbb{R}^{m}$, and
$\boldsymbol{r_{3}}\in\mathbb{R}^{p}$ are random vectors and the matrices
$\boldsymbol{T}$, $\boldsymbol{F}$, $\boldsymbol{G}$ and $\boldsymbol{S}$ are
as in (4). Note that the difference with (4) arises from the vectors
$\boldsymbol{r_{1}}$, $\boldsymbol{r_{2}}$, and $\boldsymbol{r_{3}}$. Under
the transformation (8), the linear system (1) is modified to

$\displaystyle\tilde{x}_{k+1}$
$\displaystyle=\tilde{A}\tilde{x}_{k}+\tilde{B}\tilde{u}_{k}+\boldsymbol{T}Ar_{x}+\boldsymbol{T}Br_{u}+\boldsymbol{r_{1}}$
(9) $\displaystyle\tilde{y}_{k}$
$\displaystyle=\tilde{C}\tilde{x}_{k}+\boldsymbol{S}Cr_{x}+\boldsymbol{r_{3}},$

where $\tilde{A}$, $\tilde{B}$, and $\tilde{C}$ are given in (5) and
$r_{x}\coloneqq-\boldsymbol{T}^{-1}\boldsymbol{r_{1}}$ and
$r_{u}\coloneqq\boldsymbol{G}^{-1}\boldsymbol{F}\boldsymbol{T}^{-1}\boldsymbol{r_{1}}-\boldsymbol{G}^{-1}\boldsymbol{r_{2}}$.
Similarly, the cost function (2) is modified to

$\displaystyle\tilde{J}_{r}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})\coloneqq\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})+2\sum_{k=0}^{N-1}\begin{bmatrix}\tilde{x}_{k}^{\top}&\tilde{u}_{k}^{\top}\end{bmatrix}\boldsymbol{L}^{\top}M\begin{bmatrix}r_{x}\\\
r_{u}\end{bmatrix}$ (10)
$\displaystyle+2\tilde{x}_{N}^{\top}\boldsymbol{T}^{-\top}Pr_{x}+r_{x}^{\top}Pr_{x}+N\begin{bmatrix}r_{x}^{\top}&r_{u}^{\top}\end{bmatrix}M\begin{bmatrix}r_{x}\\\
r_{u}\end{bmatrix},$

where $\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$ and
$\boldsymbol{L}$ are given in (6) and (7). We have the following result:

######  Corollary 1.

Let Assumption 1 hold, and suppose that Cloud knows the transformed system (9)
and cost function (10). Cloud infers
$\hat{A}=\boldsymbol{T}A\boldsymbol{T}^{-1}$ and
$\hat{Q}=\boldsymbol{T}^{-\top}Q\boldsymbol{T}^{-1}$ about the system and the
cost parameters.

_Proof_. See Appendix A.$\hfill\blacksquare$

####  3.3.2 Increasing the dimension of (4)

Let Plant adopt for the optimization (3) the following higher-dimensional
transformation

$\displaystyle\tilde{x}_{k}$ $\displaystyle=\boldsymbol{\bar{T}}x_{k}$ (11a)
$\displaystyle\tilde{u}_{k}$
$\displaystyle=\boldsymbol{\bar{F}}x_{k}+\boldsymbol{\bar{G}}u_{k}$ (11b)
$\displaystyle\tilde{y}_{k}$ $\displaystyle=\boldsymbol{\bar{S}}y_{k},$ (11c)

where $\boldsymbol{\bar{T}}\in\mathbb{R}^{\bar{n}\times n}$,
$\boldsymbol{\bar{G}}\in\mathbb{R}^{\bar{m}\times m}$,
$\boldsymbol{\bar{S}}\in\mathbb{R}^{\bar{p}\times p}$ are randomly chosen full
column rank matrices with $\bar{n}>n$, $\bar{m}>m$, and $\bar{p}>p$, and
$\boldsymbol{\bar{F}}\in\mathbb{R}^{\bar{m}\times n}$. Under this
transformation, the system (4) turns into

$\displaystyle\tilde{x}_{k+1}$
$\displaystyle=\underbrace{\boldsymbol{\bar{T}}(A-B\boldsymbol{\bar{G}}^{\ell}\boldsymbol{\bar{F}})\boldsymbol{\bar{T}}^{\ell}}_{\eqqcolon\tilde{A}}\tilde{x}_{k}+\underbrace{\boldsymbol{\bar{T}}B\boldsymbol{\bar{G}}^{\ell}}_{\eqqcolon\tilde{B}}\tilde{u}_{k}$
(12) $\displaystyle\tilde{y}_{k}$
$\displaystyle=\underbrace{\boldsymbol{\bar{S}}C\boldsymbol{\bar{T}}^{\ell}}_{\eqqcolon\tilde{C}}\tilde{x}_{k},$

where $\boldsymbol{\bar{T}}^{\ell}$, $\boldsymbol{\bar{G}}^{\ell}$ and
$\boldsymbol{\bar{S}}^{\ell}$ are any left inverse of their corresponding
matrices. The cost function (2) is transformed into

$\tilde{J}_{h}(\tilde{\boldsymbol{x}},\tilde{\boldsymbol{u}})\coloneqq\tilde{x}_{N}^{\top}(\boldsymbol{\bar{T}}^{\ell})^{\top}P\boldsymbol{\bar{T}}^{\ell}\tilde{x}_{N}+\sum_{k=0}^{N-1}\begin{bmatrix}\tilde{x}_{k}^{\top}&\tilde{u}_{k}^{\top}\end{bmatrix}\tilde{M}\begin{bmatrix}\tilde{x}_{k}\\\
\tilde{u}_{k}\end{bmatrix},$ (13)

where $\tilde{M}$ is given by

$\displaystyle\tilde{M}=\begin{bmatrix}\tilde{M}_{1,1}&\star\\\
-((\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell})(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})&(\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell}\end{bmatrix},$
(14)

with
$\tilde{M}_{1,1}=(\boldsymbol{\bar{T}}^{\ell})^{\top}Q\boldsymbol{\bar{T}}^{\ell}+(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})^{\top}((\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell})(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})$,
and $(\star)$ denotes the transpose of block $\tilde{M}_{2,1}$.

######  Corollary 2.

Let Assumption 1 hold, and suppose that Cloud knows the transformed system
(12) and cost function (13). Cloud infers
$\hat{A}=\boldsymbol{\bar{T}}A\boldsymbol{\bar{T}}^{\ell}$ and
$\hat{Q}=(\boldsymbol{\bar{T}}^{\ell})^{\top}Q\boldsymbol{\bar{T}}^{\ell}$
about the system and cost parameters. Furthermore, Cloud infers
$\operatorname{mspec}_{nz}(A)$, where $\operatorname{mspec}_{nz}(A)$ denotes
the multiset of nonzero eigenvalues of $A$.

_Proof_. See Appendix A.$\hfill\blacksquare$
We present two other forms of (4) in two separate remarks.

######  Remark 5 (Time-varying high dimensional affine transformations).

It should be noted that Plant can adopt for each instance of optimization (3)
a time dependent transformation given by quadruple
$(\boldsymbol{T}_{k},\boldsymbol{G}_{k},\boldsymbol{S}_{k},\boldsymbol{F}_{k})$
in (4) justified by the recommendation in privacy literature to use random
transformation only once [32]. Nonetheless, it is clear that Cloud can still
follow the steps in Theorem 1 mainly because it does not rely on accumulated
information from previous interactions with Plant and hence it is able to
infer $\hat{A}=\boldsymbol{T}_{k}A\boldsymbol{T}_{k}^{-1}$ and
$\hat{Q}=\boldsymbol{T}_{k}^{-\top}Q\boldsymbol{T}_{k}^{-1}$ and
$\hat{R}=\boldsymbol{G}_{k}^{-\top}R\boldsymbol{G}_{k}^{-1}$. We also point
out that using time-varying transformation along with added randomly chosen
vectors and increasing its dimension as in (8) and (11) does not prevent Cloud
from applying the arguments in Corollaries 1 and 2 to infer privacy-sensitive
quantities of the system. $\hfill\square$

######  Remark 6 (Polynomial form of (4)).

Consider the following nonlinear transformation

$\tilde{u}_{k}=\boldsymbol{f}(x_{k})+\boldsymbol{G}u_{k},$ (15)

where $\boldsymbol{f}(\cdot):\mathbb{R}^{n}\to\mathbb{R}^{m}$ is a polynomial
function of degree $d\in\mathbb{N}$. The map $\boldsymbol{f}(\cdot)$ can be
rewritten as

$\boldsymbol{f}(x)=\boldsymbol{r_{2}}+\boldsymbol{F}x+\boldsymbol{F}_{1}Z(x),$

for some constant vector $\boldsymbol{r_{2}}\in\mathbb{R}^{m}$ and matrices
$\boldsymbol{F}\in\mathbb{R}^{m\times n}$,
$\boldsymbol{F}_{1}\in\mathbb{R}^{m\times z}$, with
$Z(x):\mathbb{R}^{n}\to\mathbb{R}^{z}$ including all the $z$ monomials with
degree greater than $1$. Let Plant use the transformation (4) with (4b)
replaced by (15), where the vectors/matrices $\boldsymbol{r_{2}}$,
$\boldsymbol{F}_{1}$, and $\boldsymbol{F}$ are randomly chosen. Under this
transformation, the linear system (1) is modified to

$\displaystyle\tilde{x}_{k+1}$
$\displaystyle=\tilde{A}\tilde{x}_{k}+\tilde{B}\tilde{u}_{k}+\boldsymbol{T}B\phi(\tilde{x}_{k})+\boldsymbol{T}Br_{u}$
(16) $\displaystyle\tilde{y}_{k}$ $\displaystyle=\tilde{C}\tilde{x}_{k},$

where $\tilde{A}$, $\tilde{B}$, and $\tilde{C}$ are given in (5) and
$\phi(\tilde{x}_{k})\coloneqq-\boldsymbol{G}^{-1}\boldsymbol{F}_{1}Z(\boldsymbol{T}^{-1}\tilde{x}_{k})$
and $r_{u}\coloneqq-\boldsymbol{G}^{-1}\boldsymbol{r_{2}}$. Analogously, the
transformed cost is:

$\displaystyle\tilde{J}_{nl}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$
$\displaystyle\coloneqq\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$
$\displaystyle+2\sum_{k=0}^{N-1}\begin{bmatrix}\tilde{x}_{k}^{\top}&\tilde{u}_{k}^{\top}\end{bmatrix}\begin{bmatrix}-(R\boldsymbol{G}^{-1}\boldsymbol{F}\boldsymbol{T}^{-1})^{\top}\\\
\boldsymbol{G}^{-\top}R\end{bmatrix}\phi(\tilde{x}_{k})$
$\displaystyle+2\sum_{k=0}^{N-1}\begin{bmatrix}\tilde{x}_{k}^{\top}&\tilde{u}_{k}^{\top}\end{bmatrix}\begin{bmatrix}-(R\boldsymbol{G}^{-1}\boldsymbol{F}\boldsymbol{T}^{-1})^{\top}\\\
\boldsymbol{G}^{-\top}R\end{bmatrix}r_{u}$
$\displaystyle+\sum_{k=0}^{N-1}\phi(\tilde{x}_{k})^{\top}R\phi(\tilde{x}_{k})+{2r_{u}^{\top}R\phi(\tilde{x}_{k})}+r_{u}^{\top}Rr_{u},$
(17)

where $\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$ is given by
(6).
Bearing in mind that $\phi(\cdot)$ contains only high degree monomials, the
values of the matrices $\tilde{A}$, $\tilde{B}$ can be inferred from (16).
Furthermore, due to the structure of (17), Cloud can isolate the terms
$-\tilde{x}_{k}^{\top}(\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1})(\boldsymbol{F}\boldsymbol{T}^{-1})\tilde{u}_{k}$
and
$\tilde{u}_{k}^{\top}\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}\tilde{u}_{k}$,
embedded in $\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$, from
the rest of the terms in (17), and subsequently infer the values of
$\hat{R}=\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}$ and
$\boldsymbol{F}\boldsymbol{T}^{-1}$. The latter, using the expression of
$\tilde{A}$, reveals the matrix $\hat{A}=\boldsymbol{T}A\boldsymbol{T}^{-1}$
to Cloud. $\hfill\square$

The previously discussed results concerned with system level privacy along
with privacy of the cost parameters. In certain applications, privacy of input
and/or output signals should be protected. While those scenarios do not
directly deal with Problem 1, the side-knowledge analysis pursued here can
shed some lights on the information leaked to Cloud. An example of such
scenarios is provided in the remark below.

######  Remark 7 (Structured noise and signal privacy).

Consider a transformation of $(x_{k},y_{k},u_{k})$ given by (11a), (11c) and

$\tilde{u}_{k}=\boldsymbol{\bar{G}}u_{k}+\boldsymbol{b}_{k},\quad\text{with}\quad\boldsymbol{b}_{k}\in\ker\boldsymbol{\bar{G}}^{\ell},$
(18)

where $\boldsymbol{\bar{G}}\in\mathbb{R}^{\bar{m}\times m}$ has full column
rank with $\bar{m}>m$. The vector $\boldsymbol{b}_{k}$ is selected randomly
from $\ker\boldsymbol{\bar{G}}^{\ell}$ by Plant. The system dynamic (1) under
transformation (11a), (11c) and (18) is mapped to

$\displaystyle\tilde{x}_{k+1}$
$\displaystyle=\underbrace{\boldsymbol{\bar{T}}A\boldsymbol{\bar{T}}^{\ell}}_{\eqqcolon{A_{h}}}\tilde{x}_{k}+\underbrace{\boldsymbol{\bar{T}}B\boldsymbol{\bar{G}}^{\ell}}_{\eqqcolon{B_{h}}}\tilde{u}_{k}$
(19) $\displaystyle\tilde{y}_{k}$
$\displaystyle=\underbrace{\boldsymbol{\bar{S}}C\boldsymbol{\bar{T}}^{\ell}}_{\eqqcolon{C_{h}}}\tilde{x}_{k}.$

The immersed dynamic (19) is transmitted to Cloud for computing the output
$\tilde{y}$. For doing so, Cloud first receives the value of matrices $A_{h}$,
$B_{h}$, $C_{h}$ and $\tilde{x}_{0}=\boldsymbol{\bar{T}}x_{0}$ and later on,
it receives the signal $\tilde{u}_{k}$ which is a randomly encoded version of
$u_{k}$ and performs the computation of $\tilde{y}_{k}$. The random
transformation including (11a), (11c) and (18) has been proposed in [39] and
[40] in the context of privacy preserving federated learning and detector
systems. Note, under this transformation, the signal $\tilde{u}_{k}$
constructed by the random mapping (18) ($\boldsymbol{b}_{k}$ is a random value
for each $k$) can differ significantly from plaint-text $u_{k}$ in (4b). This
feature makes the transformed system (19) a suitable candidate for
applications such as securely implementing a linear dynamical controller over
Cloud similar to [48]. However, the effects of the noise $\boldsymbol{b}_{k}$
can be removed by having a mild assumption that the matrix $B$ in the system
(19) is full column rank and Cloud knows this.
Under this assumption, it follows that $\ker\boldsymbol{\bar{G}}^{\ell}=\ker
B_{h}$ with $B_{h}=\boldsymbol{\bar{T}}B\boldsymbol{\bar{G}}^{\ell}$ in (19).
Hence, Cloud selects an arbitrary basis for $\ker\boldsymbol{\bar{G}}^{\ell}$
as
$\boldsymbol{\bar{G}}^{\ell}_{kn}\coloneqq\begin{bmatrix}v_{1}&v_{2}&\cdots&v_{r}\end{bmatrix}\in\mathbb{R}^{\bar{m}\times
r}$, and consistently a basis for row space of $\boldsymbol{\bar{G}}^{\ell}$
as $\boldsymbol{\bar{G}}^{\ell}_{rs}\in\mathbb{R}^{(\bar{m}-r)\times\bar{m}}$.
Note $\boldsymbol{\bar{G}}^{\ell}$ must be full row rank since from its
definition it holds that
$\boldsymbol{\bar{G}}^{\ell}\boldsymbol{\bar{G}}=I_{m}$. Therefore, Cloud
finds $\bar{m}-r\eqqcolon m$ as the hidden underlying number of rows of
$\boldsymbol{\bar{G}}^{\ell}$ and hence number of columns of
$\boldsymbol{\bar{G}}$. Thus, Cloud can write
$\boldsymbol{\bar{G}}^{\ell}_{rs}=\boldsymbol{Q}\boldsymbol{\bar{G}}^{\ell}$
for some unknown invertible $\boldsymbol{Q}\in\mathbb{R}^{m\times m}$ [49,
p.13]. Multiplying both sides of (18) from the left by
$\boldsymbol{\bar{G}}^{\ell}_{rs}$ yields

$\boldsymbol{\bar{G}}^{\ell}_{rs}\tilde{u}_{k}=\boldsymbol{Q}u_{k},$ (20)

where Cloud knows its left-side. From (20) we can see that Cloud faces
$\boldsymbol{Q}u_{k}$ as the ultimate uncertainty with regard to $u_{k}$ when
it receives “noisy” $\tilde{u}_{k}$. This means that $u_{k}$ becomes known to
Cloud up to a constant matrix.$\hfill\square$

In the rest of the study we provide an answer to Problem 1 for the second
case, namely when Plant densely combines the linear system (1) with the cost
function (2) and constraints (3c)-(3d), and then transmits them to Cloud.

##  4  Analysis of inherent privacy for MPC in dense form

First, we present the dense optimization form of (3).

###  4.1 Dense form of MPC

We can rewrite the optimization problem (3) by expressing all future states
$x_{1},x_{2},\ldots,x_{N}$ as the function of future inputs
$u_{0},u_{1},\ldots,u_{N-1}$ and initial condition $x_{0}$. This gives rise to
[43]

$\displaystyle\min_{z}\quad$
$\displaystyle\frac{1}{2}z^{\top}Hz+x_{0}^{\top}Fz+{x_{0}^{\top}Yx_{0}}$ (21a)
s.t. $\displaystyle Gz\leq W+Ox_{0},$ (21b)

where
$z\coloneqq\operatorname{col}(u_{0},u_{1},\ldots,u_{N-1})\in\mathbb{R}^{Nm}$
is the optimization variable, and $H\coloneqq
2{\mathcal{R}}+2{\mathcal{S}}^{\top}{\mathcal{Q}}{\mathcal{S}}$, $F\coloneqq
2{\mathcal{T}}^{\top}{\mathcal{Q}}{\mathcal{S}}$, and $Y\coloneqq
Q+{\mathcal{T}}^{\top}{\mathcal{Q}}{\mathcal{T}}$ are the cost matrices in
(21a) with

$\displaystyle{\mathcal{R}}\coloneqq I_{N}\otimes
R,\,\,{\mathcal{Q}}\coloneqq\operatorname{blockdiag}({Q},\cdots,{Q},{P})\in\mathbb{R}^{N(n\times
n)},$ (22) $\displaystyle{\mathcal{S}}\coloneqq\begin{bmatrix}B&0&\cdots&0\\\
AB&B&\cdots&0\\\ \vdots&\vdots&\ddots&\vdots\\\
A^{N-1}B&A^{N-2}B&\cdots&B\end{bmatrix},\quad{\mathcal{T}}\coloneqq\begin{bmatrix}A\\\
A^{2}\\\ \vdots\\\ A^{N}\end{bmatrix}.$

The expanded form of $H$, $F$ and $Y$ are also given in Appendix B. The
matrices in the constraint (21b) are

$\displaystyle\mathcal{G}$ $\displaystyle\coloneqq(I_{N}\otimes
C)\mathcal{S},\,\,G\coloneqq\operatorname{col}(I_{Nm},-I_{Nm},{\mathcal{G}},-{\mathcal{G}}),$
(23) $\displaystyle W$
$\displaystyle\coloneqq\begin{bmatrix}\color[rgb]{1,1,1}\definecolor[named]{pgfstrokecolor}{rgb}{1,1,1}\pgfsys@color@gray@stroke{1}\pgfsys@color@gray@fill{1}-\mathbb{1}_{N}\otimes
u_{\text{max}}\\\ -\mathbb{1}_{N}\otimes u_{\text{min}}\\\
\color[rgb]{1,1,1}\definecolor[named]{pgfstrokecolor}{rgb}{1,1,1}\pgfsys@color@gray@stroke{1}\pgfsys@color@gray@fill{1}-\mathbb{1}_{N}\otimes
y_{\text{max}}\\\ -\mathbb{1}_{N}\otimes
y_{\text{min}}\end{bmatrix},\,\,{\mathcal{O}}\coloneqq\begin{bmatrix}CA\\\
CA^{2}\\\ \vdots\\\
CA^{N}\end{bmatrix},\,\,O\coloneqq\begin{bmatrix}0_{Nm\times n}\\\ 0_{Nm\times
n}\\\ -{\mathcal{O}}\\\
\color[rgb]{1,1,1}\definecolor[named]{pgfstrokecolor}{rgb}{1,1,1}\pgfsys@color@gray@stroke{1}\pgfsys@color<EMAIL_ADDRESS>
We are interested in the knowledge that Cloud obtains about the system and
cost matrices by using the received parameters from Plant. For doing so, we
make the following assumption for the rest of the manuscript:

######  Assumption 2.

The state matrix $A\in\mathbb{R}^{n\times n}$ in (1) is non-
singular.$\hfill\square$

This assumption always holds in the case where matrix $A$ is obtained as a
result of discretizing a linear continuous time system [47, p.80].
To determine the benefits of random affine transformations for the dense form
of MPC (21), we first examine (any) inherent privacy guarantees of the scheme,
i.e., those without performing any privacy-preserving mechanism other than the
local computations that led to the dense form (21). To this end, we
distinguish between several cases based on the knowledge of Cloud on the
parameters in (21).

###  4.2 Privacy analysis when Cloud knows $H$, $F$, $G$, $W$ and $O$ in (21)

In the first case, we address the privacy analysis when Plant transmits $H$,
$F$, $G$, $W$ and $O$ to Cloud for solving (21). The result of this case is
summarized in the following theorem:

######  Theorem 2.

Suppose that Cloud knows the matrices $H$, $F$, $G$, $W$ and $O$ in (21). If
$N>n$ then Cloud recovers the system matrices $A$, $B$, $C$ in (1) and the
matrix $R$ in (2). Furthermore, from the obtained set of matrices, Cloud
infers the cost matrices $Q$ and $P$ if and only if the following set is a
singleton:

$\displaystyle\mathcal{J}=\big{\\{}X\in\mathbb{R}^{n\times
n}|\,\,\,\hat{Q}+X-A^{\top}XA$ $\displaystyle\succeq 0,$ (24)
$\displaystyle\hat{P}+X$ $\displaystyle\succeq 0,$ $\displaystyle XB$
$\displaystyle=0\big{\\}},$

where $(\hat{Q},\hat{P})$ are any positive semi-definite matrices consistent
with the structure of the matrices $H$ and $F$ in (21).111More explicitly, the
pair $(\hat{Q},\hat{P})$ can be picked from the set given in (49).

_Proof_. See Appendix A.$\hfill\blacksquare$

######  Remark 8 (privacy of $P\succeq 0$ and $Q\succeq 0$).

It should be noted that in control systems the matrix $B$ is generally not
invertible, namely $B\in\mathbb{R}^{n\times m}$, $\operatorname{rank}B=m$, and
$m<n$. In that case, if the cost matrices $P$ and $Q$ are positive definite,
it is straightforward to see that the set $\mathcal{J}$ in (24) is not a
singleton. To see this, note that for an arbitrary $X$ with $XB=0$, we have
$P+\epsilon X\succeq 0$ and $Q+\epsilon(X-A^{\top}XA)\succeq 0$ for
sufficiently small $\epsilon$. From the perspective of privacy, this means
that the dense form of MPC given in (21) inherently enjoys a certain degree of
privacy for the cost matrices $P$ and $Q$ even if the matrices $A$, $B$, and
$R$ are publicly known. An analogous argument also applies to the case
$P\succeq 0$, $Q\succ 0$. $\hfill\square$

###  4.3 Privacy analysis when Cloud knows $H$, $x_{0}^{\top}F$, $G$ and
$W+Ox_{0}$ in (21)

We address the case when Plant merges $x_{0}$ with $F$ and $O$ matrices in
(21) and transmits $x_{0}^{\top}F$ and $W+Ox_{0}$ along $H$ and $G$ to Cloud.
To do so, first, we analyze the values that can be obtained from the matrix
$G$. Recall that the Markov parameters of the system are defined as [50, p.
72]

$h(k)\coloneqq CA^{k-1}B,\quad k=1,2,\ldots\,\,.$ (25)

It is clear that Cloud has access to Markov parameters through $G$ from which
it is well-known that the system parameters can be recovered under certain
conditions.

######  Lemma 1 (Identifying $(A,B,C)$ from $G$).

Suppose that Cloud knows the matrix $G$ in (21). If $N\geq 2n+1$, then Cloud
infers $A_{t}=T^{-1}AT$, $B_{t}=T^{-1}B$ and $C_{t}=CT$ about the system
matrices with known $A_{t}$, $B_{t}$, $C_{t}$ and an unknown non-singular
matrix $T\in\mathbb{R}^{n\times n}$.

_Proof_. See Appendix A.$\hfill\blacksquare$
By Lemma 1, the system matrices are revealed to Cloud up to a similarity
transformation. We will show next that, under an additional assumption, some
information about the cost matrices are also revealed.

######  Assumption 3.

The MPC problem (21) is solved for $I\in\mathbb{N}$ instances
$\mathcal{I}=\\{1,2,3,\ldots,I\\}$ with the same matrices $H$, $F$, $G$, $W$,
and $O$ and (different) initial states $x_{0|1}$, $x_{0|2}$, $\ldots$,
$x_{0|I}$. $\hfill\square$

The assumption is consistent with an MPC setup where Plant applies the first
step of $z^{*}$ (the optimizer in (21)) to the system (1) and then asks Cloud
for a new optimizer based on the current state of the system.
To state the next result, we collect the initial states in the following
matrix

$X_{0}\coloneqq\begin{bmatrix}x_{0|1}&x_{0|2}&\ldots&x_{0|I}\end{bmatrix}\in\mathbb{R}^{n\times
I}.$ (26)

######  Theorem 3.

Let Assumption 3 hold, and suppose that Cloud knows the matrices $H$,
$x_{0}^{\top}F$, $G$ and $W+Ox_{0}$ in (21). If $N\geq 2n+1$,
$\operatorname{rank}X_{0}=n$, and
$\mathbb{1}_{I}\notin\operatorname{im}X_{0}^{\top}$, then Cloud recovers the
system matrices $A=TA_{t}T^{-1}$, $B=TB_{t}$ and $C=C_{t}T^{-1}$ with known
$A_{t}$, $B_{t}$, $C_{t}$ and an unknown non-singular matrix
$T\in\mathbb{R}^{n\times n}$, and identifies the cost matrix $R$. Furthermore,
from the obtained set of matrices, Cloud infers $Q=T^{-\top}Q_{t}T^{-1}$ and
$P=T^{-\top}P_{t}T^{-1}$ if and only if the following set is a singleton:

$\displaystyle\mathcal{J}_{t}=\big{\\{}X\in\mathbb{R}^{n\times
n}|\,\,\,Q_{t}+X-A_{t}^{\top}XA_{t}$ $\displaystyle\succeq 0,$ (27)
$\displaystyle P_{t}+X$ $\displaystyle\succeq 0,$ $\displaystyle XB_{t}$
$\displaystyle=0\big{\\}},$

where $(Q_{t},P_{t})$ are any positive semi-definite matrices consistent with
the structure of the matrices $H$ and $F$ in (21).222More explicitly, the pair
$(Q_{t},P_{t})$ can be picked from the consistency set given by (70) in
Appendix A

_Proof_. See Appendix A. $\hfill\blacksquare$
It follows from Theorem 3 that Cloud can recover (depending on the set (27))
the system and cost matrices up to an unknown invertible matrix $T$ as

$\displaystyle\big{(}A,B,C\big{)}=\big{(}TA_{t}T^{-1},TB_{t},C_{t}T^{-1}\big{)}$
$\displaystyle\big{(}P,Q,R\big{)}=\big{(}T^{-\top}P_{t}T^{-1},T^{-\top}Q_{t}T^{-1},R\big{)}.$

Interestingly, this is the same information that Cloud obtains when Plant
adopts the transformation given in (4) with $G=I_{m}$ and $S=I_{p}$. This
means that transmitting the matrices $H$, $x_{0}^{\top}F$, $G$ and $W+Ox_{0}$
to Cloud leads to the same privacy guarantees as in Theorem 1.

######  Remark 9.

It should be noted that the conditions $\operatorname{rank}X_{0}=n$ and
$\mathbb{1}_{I}\notin\operatorname{im}X_{0}^{\top}$ with $X_{0}$ in (26) in
Theorem 3 are satisfied only if $I\geq n+1$. This imposes a lower bound on the
number of instances in Assumption 3.

###  4.4 Privacy analysis when Cloud knows $H$ and $F$ in (21)

We analyze the situation when Cloud has access to the matrices $H$ and $F$ (or
$x_{0}^{\top}F$) in (21). This case most notably arises when Plant reorders
the constraints in (21) (as a computationally light privacy mechanism) since
as we have shown in Lemma 1 the constraints reveal the system dynamics.
Another notable example is the case where the constraints are not present in
(21), i.e., there are no a priori bounds on input and output in (3). For
treating this case, we make the following assumption:

######  Assumption 4.

The following conditions hold:

  1. (i).

The matrix $A$ in (1) is Schur stable

  2. (ii).

The horizon parameter $N\to\infty$ in (2)$\hfill\square$

As for the second part of the assumption, consideration of control properties
in MPC generally favors large horizon $N$ [44, p. 374]. We further elaborate
on this assumption and the roles that non-minimum phase zeros play for the MPC
problem in Section 6.
Under Assumption 4, the matrix
$Y={Q+{\mathcal{T}}^{\top}{\mathcal{Q}}{\mathcal{T}}}$ in cost function (21a),
i.e., $Y=\sum_{i=0}^{N-1}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N}PA^{N},$
converges to a matrix $\bar{Y}\in\mathbb{R}^{n\times n}$ [47, p.36], namely

$\lim_{N\to\infty}Y=\bar{Y}.$ (28)

Note that $Y$ and its limit $\bar{Y}$ are unknown to Cloud. We have the
following result.

######  Theorem 4.

Let Assumption 4 hold, and suppose that Cloud knows the matrices $H$ and $F$
in (21). If the pair $(A,B^{\top}\bar{Y})$ with $\bar{Y}$ in (28) is
observable, then Cloud recovers the system matrices $A$, $B$ in (1) and the
matrix $R$ in (2). Furthermore, from the obtained set of matrices, Cloud
infers the cost matrices $Q$ and $P$ if and only if the set given in (24) is a
singleton.

_Proof_. See Appendix A.$\hfill\blacksquare$
We address next the case when Cloud has only received the true value of $H$
and $x_{0}^{\top}F$ in (21).

######  Theorem 5.

Let Assumptions 3 and 4 hold, and suppose that Cloud knows the matrices $H$
and $x_{0}^{\top}F$ in (21). If $\operatorname{rank}X_{0}=n$ and the pair
$(A,B^{\top}\bar{Y})$ is observable where $X_{0}$ is given in (26) and
$\bar{Y}$ in (28), then Cloud infers the system matrices $A$ and $B$, and the
cost matrices $R$, $Q$, and $P$ as in Theorem 3.

_Proof_. See Appendix A. $\hfill\blacksquare$
Now that we have established the results for inherent privacy guarantees of
the dense form of MPC in various side-knowledge scenarios, we shift our
attention to adopting random affine transformations in (21), consistent with
Problem 1.

##  5 Privacy analysis of affine transformation for MPC in dense form

We study privacy preserving properties of random affine transformation when it
is applied to the dense form of MPC given in (21).

###  5.1 Affine transformation $(\boldsymbol{R},\boldsymbol{r})$

Recall the program (21) for obtaining $z^{*}$

$\displaystyle\min_{z}$ $\displaystyle\frac{1}{2}z^{\top}Hz+x_{0}^{\top}Fz$
(29) s.t. $\displaystyle Gz\leq W+Ox_{0},$

where we have dropped the constant term $x_{0}^{\top}Yx_{0}$ from the cost
function (21a). Plant uses the random affine transformation

$z=\boldsymbol{R}\zeta+\boldsymbol{r},$ (30)

as its privacy preserving mechanism where
$\boldsymbol{R}\in\mathbb{R}^{Nm\times Nm}$ is a randomly chosen invertible
matrix and $\boldsymbol{r}\in\mathbb{R}^{Nm}$ is a randomly chosen vector. The
program (29) under (30) is transformed to

$\displaystyle\min_{\zeta}$
$\displaystyle\frac{1}{2}\zeta^{\top}\tilde{H}\zeta+\tilde{f}^{\top}\zeta$
(31) s.t. $\displaystyle\tilde{G}\zeta\leq\tilde{e},$

where $\tilde{H}\coloneqq\boldsymbol{R}^{\top}H\boldsymbol{R}$,
$\tilde{f}\coloneqq\boldsymbol{R}^{\top}(F^{\top}x_{0}+H\boldsymbol{r})$,
$\tilde{G}\coloneqq G\boldsymbol{R}$, and
$\tilde{e}\coloneqq(W+Ox_{0}-G\boldsymbol{r})$. Note that Plant outsources the
computation of the optimizer $\zeta^{*}$ for the transformed program (31) to
Cloud. Clearly, by receiving $\zeta^{*}$ Plant recovers $z^{*}$ (the optimizer
of (29)) since the mechanism (30) is accurate.
The following proposition shows what Cloud infers about the key
$(\boldsymbol{R},\boldsymbol{r})$ of the transformation.

######  Proposition 1.

Suppose that Cloud knows the matrices $\tilde{G}$ and $\tilde{e}$ in (31).
Cloud infers the transformation parameter as
$(\hat{}\boldsymbol{R},\hat{}\boldsymbol{r})=(\boldsymbol{R},(L\otimes
I_{m})\boldsymbol{r})$ where
$L=I_{N}-(\frac{1}{N})\mathbb{1}_{N}\mathbb{1}_{N}^{\top}$.

_Proof_. See Appendix A.$\hfill\blacksquare$
It follows from Proposition 1 that Cloud infers the key for the privacy
preserving mechanism, which enables it to remove the effect of the mechanism
and later on to use the results in Lemma 1 and Theorem 3 for obtaining
sensitive parameters. This motivates Plant to hide the constraints from Cloud.
Notably, Plant can permute the constraints as

$\displaystyle\tilde{G}\coloneqq\boldsymbol{P}G,\,\tilde{e}\coloneqq\boldsymbol{P}(W+Ox_{0}),$

where $\mathbf{P}$ is a permutation matrix whose rows are uniform random
rearrangement of the rows of the identity matrix of size $2N(m+p)$. The
resulting privacy guarantees in this case will be discussed next.

###  5.2 Affine transformation and permutation
$(\boldsymbol{R},\boldsymbol{r},\boldsymbol{P})$

Let Plant first apply the transformation (30) and then the permutation matrix
$\boldsymbol{P}$ for the constraints as its privacy mechanism. It is easy to
verify that the transformed program (31) has the following parameters:

$\displaystyle\tilde{H}$
$\displaystyle=\boldsymbol{R}^{\top}H\boldsymbol{R},\qquad\tilde{f}=\boldsymbol{R}^{\top}(F^{\top}x_{0}+H\boldsymbol{r})$
(32) $\displaystyle\tilde{G}$
$\displaystyle=\boldsymbol{P}G\boldsymbol{R},\qquad\tilde{e}=\boldsymbol{P}(W+Ox_{0}-G\boldsymbol{r}).$

Note that the above quantities are independent of the order in which Plant
applies the transformation (30) and the permutation $\boldsymbol{P}$. Let
Assumption 3 hold. Then, for each $i\in\mathcal{I}=\\{1,2,\ldots,I\\}$, Cloud
can form the following equations

$\displaystyle\tilde{f}_{i}$
$\displaystyle=\boldsymbol{R}^{\top}(F^{\top}x_{0|i}+H\boldsymbol{r})$ (33a)
$\displaystyle z_{i}^{*}$
$\displaystyle=\boldsymbol{R}\zeta_{i}^{*}+\boldsymbol{r},$ (33b)

where $z_{i}^{*}$ and $\zeta_{i}^{*}$ are the optimizer of the original (29)
and the transformed program (31), for $x_{0}\equiv x_{0|i}$, respectively.
Note that Cloud receives the value $\tilde{f}_{i}$ (33a) from Plant and
obtains $\zeta_{i}^{*}$ (33b) after solving the optimization. By using (33),
Cloud writes

$\displaystyle\tilde{f}_{i+1}$
$\displaystyle=\boldsymbol{R}^{\top}(F^{\top}x_{0|i+1}+H\boldsymbol{r})$ (34)
$\displaystyle=\boldsymbol{R}^{\top}F^{\top}Ax_{0|i}+\boldsymbol{R}^{\top}F^{\top}\bar{B}z_{i}^{*}+\boldsymbol{R}^{\top}H\boldsymbol{r},$

where we have substituted the system dynamics and denoted
$\bar{B}\coloneqq[B\quad 0]\in\mathbb{R}^{n\times Nm}$. Furthermore, by using
(33) and assuming that the matrix $F\in\mathbb{R}^{n\times Nm}$ has full row
rank, it follows that (34) can be rewritten as

$\displaystyle\tilde{f}_{i+1}$
$\displaystyle=\boldsymbol{R}^{\top}F^{\top}A(F^{\top})^{\dagger}(\boldsymbol{R}^{-\top}\tilde{f}_{i}-H\boldsymbol{r})$
(35)
$\displaystyle\qquad+\boldsymbol{R}^{\top}F^{\top}\bar{B}(\boldsymbol{R}\zeta_{i}^{*}+\boldsymbol{r})+\boldsymbol{R}^{\top}H\boldsymbol{r}$
$\displaystyle=\boldsymbol{R}^{\top}F^{\top}A(F^{\top})^{\dagger}\boldsymbol{R}^{-\top}\tilde{f}_{i}+\boldsymbol{R}^{\top}F^{\top}\bar{B}\boldsymbol{R}\zeta_{i}^{*}+d,$

where

$d\coloneqq-\boldsymbol{R}^{\top}F^{\top}A(F^{\top})^{\dagger}H\boldsymbol{r}+\boldsymbol{R}^{\top}F^{\top}\bar{B}\boldsymbol{r}+\boldsymbol{R}^{\top}H\boldsymbol{r}.$

To proceed further, for each $i=1,\ldots,I-1$ define

$\displaystyle\delta\tilde{f}_{i}\coloneqq\tilde{f}_{i+1}-\tilde{f}_{i},\qquad\delta\zeta_{i}^{*}\coloneqq\zeta_{i+1}^{*}-\zeta_{i}^{*},$
(36)

and rewrite the dynamics (35) as

$\delta\tilde{f}_{i+1}=\tilde{A}\delta\tilde{f}_{i}+\tilde{B}\delta\zeta_{i}^{*},$
(37)

where
$\tilde{A}\coloneqq\boldsymbol{R}^{\top}F^{\top}A(F^{\top})^{\dagger}\boldsymbol{R}^{-\top}$
and $\tilde{B}\coloneqq\boldsymbol{R}^{\top}F^{\top}\bar{B}\boldsymbol{R}$.
For further simplification, denote the data matrices

$\displaystyle\Delta\tilde{F}_{0}$
$\displaystyle\coloneqq\begin{bmatrix}\delta\tilde{f}_{1}&\cdots&\delta\tilde{f}_{I-2}\end{bmatrix}\in\mathbb{R}^{Nm\times(I-2)}$
(38) $\displaystyle\Delta\tilde{F}_{1}$
$\displaystyle\coloneqq\begin{bmatrix}\delta\tilde{f}_{2}&\cdots&\delta\tilde{f}_{I-1}\end{bmatrix}\in\mathbb{R}^{Nm\times(I-2)}$
$\displaystyle\Delta\tilde{Z}^{*}$
$\displaystyle\coloneqq\begin{bmatrix}\delta\zeta_{1}^{*}&\cdots&\delta\zeta_{I-2}^{*}\end{bmatrix}\in\mathbb{R}^{Nm\times(I-2)}.$

Note that these matrices are known to Cloud. Bearing in mind Assumption 3, the
following holds:

$\Delta\tilde{F}_{1}=\tilde{A}\Delta\tilde{F}_{0}+\tilde{B}\Delta\tilde{Z}^{*},$
(39)

where $\Delta\tilde{F}_{1}$, $\Delta\tilde{F}_{0}$ and $\Delta\tilde{Z}^{*}$
are given in (38).
We have the following result:

######  Theorem 6.

Let Assumption 3 hold and suppose that Cloud knows the transformed program
(31) with $\tilde{H}$, $\tilde{f}$, $\tilde{G}$ and $\tilde{e}$ given in (32).
Assume that $\operatorname{rank}F=n$ and
$\operatorname{rank}\Delta\tilde{F}_{0}=n$ with $F$ given in (21a) and
$\Delta\tilde{F}_{0}$ in (38). Let $\Delta\tilde{F}_{0}$ be decomposed as

$\Delta\tilde{F}_{0}={\Delta F_{b}}E_{0},$ (40)

where ${\Delta F_{b}}\in\mathbb{R}^{Nm\times n}$ and
$E_{0}\in\mathbb{R}^{n\times(I-2)}$ are full column rank and full row rank
matrices, respectively.333Note that such a decomposition is always feasible
due to $\operatorname{rank}\Delta\tilde{F}_{0}=n.$ Then Cloud identifies
$\hat{A}\coloneqq TAT^{-1}$ with an unknown invertible matrix
$T\in\mathbb{R}^{n\times n}$ if there exists $\Theta\in\mathbb{R}^{(I-2)\times
n}$ such that

$\displaystyle E_{0}\Theta$ $\displaystyle=I_{n}$ (41a)
$\displaystyle\Delta\tilde{Z}^{*}\Theta$ $\displaystyle=0,$ (41b)

with $\Delta\tilde{Z}^{*}$ in (38).

_Proof_. See Appendix A.$\hfill\blacksquare$
It follows from Theorem 6 that under suitable conditions Cloud is able to
identify the spectrum of the matrix $A$ in (1) even if Plant is using the
transformation triple $(\boldsymbol{R},\boldsymbol{r},\boldsymbol{P})$ as its
privacy mechanism. We conclude this section with a discussion on how the
result of Theorem 6 can be stated for identifying $T\bar{B}\boldsymbol{R}$ in
(82) and how the case of time-varying affine transformations can be handled.

######  Remark 10.

It should be noted that Theorem 6 emphasizes the condition under which the
eigenvalues of the system can be identified (through $TAT^{-1}$) in the light
of their privacy-sensitive values. The condition (41) can be extended for also
identifying $T\bar{B}\boldsymbol{R}$ in (82), which includes $\boldsymbol{R}$
the key of the transformation (30) and also the $B$ matrix of the system (1).
For this case we need to replace the condition (41) with the existence of a
matrix $\Theta_{e}\in\mathbb{R}^{(I-2)\times(n+Nm)}$ such that

$\begin{bmatrix}E_{0}\\\
\Delta\tilde{Z}^{*}\end{bmatrix}\Theta_{e}=\operatorname{blockdiag}(I_{n},I_{Nm}),$
(42)

which is equivalent to the matrix on the left-hand side of above to be full
row rank. It is worth mentioning that if $\delta\zeta_{i}^{*}$ for
$i\in\mathcal{I}=\\{1,2,\ldots,I-2\\}$ is persistently exciting of order
$n+1$, then the mentioned full row rank condition holds [51]. Nonetheless, for
cost function (2) with large prediction horizon $N$, the condition (42) can be
conservative. This is specially true since the input sequence
$\\{\delta\zeta_{i}^{*}\\}_{i=1}^{I-2}$ are constrained to be the solution of
the MPC problem (31). $\hfill\square$

######  Remark 11 (Time-varying transformation
$(\boldsymbol{R}_{i},\boldsymbol{r}_{i},\boldsymbol{P}_{i})$).

Plant can adopt $(\boldsymbol{R}_{i},\boldsymbol{r}_{i},\boldsymbol{P}_{i})$,
i.e. a time-varying transformation, for preserving privacy of the parameters
in the program (29), meaning for each instance
$i\in\mathcal{I}=\\{1,2,\cdots,I\\}$ of the program, Plant uses a different
affine transformation. Two points need to be raised in this case: First, the
results in Theorem 6 also hold for time-varying permutation
$\boldsymbol{P}_{i}$. Second: applying time varying affine transformation
$(\boldsymbol{R}_{i},\boldsymbol{r}_{i})$ can lead to a computationally
inefficient program unsuitable for real-time applications of MPC. This is
specially noticeable since solving MPC in the dense least square already put
some extra local computational burden on Plant. It is worth mentioning that
the results can be applied to the “sufficiently slow” time-varying
transformation, that is, when
$(\boldsymbol{R}_{(\cdot)},\boldsymbol{r}_{(\cdot)})$ remains constant long
enough until the conditions in Theorem 6 are satisfied. $\hfill\square$

##  6 Numerical Simulation

In this section, a case study is presented to further examine the results.

###  6.1 Case study setup

We use the Quadruple-Tank Process (QTP) as the system to be controlled [52].
The QTP consists of four tanks containing water, two valves and two pumps as
actuators which change the water levels in the tanks. The QTP is a nonlinear
system but its linearized model is

$\displaystyle\dot{x}_{1}$
$\displaystyle=-1/T_{1}x_{1}+A_{3}/(A_{1}T_{3})x_{3}+\gamma_{1}k_{1}/A_{1}u_{1}$
(43) $\displaystyle\dot{x}_{2}$
$\displaystyle=-1/T_{2}x_{2}+A_{4}/(A_{2}T_{4})x_{4}+\gamma_{2}k_{2}/A_{2}u_{2}$
$\displaystyle\dot{x}_{3}$
$\displaystyle=-1/T_{3}x_{3}+(1-\gamma_{2})k_{2}/A_{3}u_{2}$
$\displaystyle\dot{x}_{4}$
$\displaystyle=-1/T_{4}x_{4}+(1-\gamma_{1})k_{1}/A_{4}u_{1}$ $\displaystyle y$
$\displaystyle=\begin{bmatrix}k_{c}x_{1}\\\ k_{c}x_{2}\end{bmatrix},$

where $x_{i}$ , $T_{i}$ and $A_{i}$ are the water level, time constant and
cross-section for tank $i=1,2,3,4$, and $\gamma_{j}$, $k_{j}$, and $u_{j}$ are
constants for valve, pump and the voltage applied to the pump $j=1,2$, and
$k_{c}$ is the sensor coefficient. The cross-sections for tanks are
$(A_{1},A_{2},A_{3},A_{4})=(28,32,28,32)\text{cm}^{2}$, and $k_{c}=0.5$. We
use the values $(T_{1},T_{2},T_{3},T_{4})=(63,91,39,56)$, and
$(k_{1},k_{2},\gamma_{1},\gamma_{2})=(3.14,3.29,0.43,0.34)$ given in [52] for
the operating point and discretize the system using zero-order hold method
with the sampling rate $T_{s}=2s$. For the later reference (Subsections
6.2-6.3) we note the spectrum of discretized system matrix
$\operatorname{spec}(A)=\\{0.968,0.978,0.950,0.964\\}$. The control objective
is to reject the process disturbance
$d_{k}=\begin{bmatrix}3&-3\end{bmatrix}^{\top}(0.99)^{k-200}$ for $k\geq 200$
while the system is at rest and the constraints $-2\leq y_{i}(k)\leq 2$ and
$-1\leq u_{i}(k)\leq 1$ for $i=1,2$ are satisfied. For achieving this we use
$Q=2I_{4}$, $R=I_{2}$ and $P=0$ for the cost matrices in (2) and use the dense
form of MPC given in (21)444Simulation files are available at
https://github.com/teimour-halizadeh/affine_transformation_code.
Privacy concerns: One of the major concerns from Plant’s perspective is data
privacy during an outsourced search for optimal control inputs. Notable in
this case, the system in the selected operating point has a non-minimum phase
zero at $s=0.013$ or out of unit-disc zero in discrete time at $z=1.02$. This
non-minimum phase zero turns the system (43) into a possible target for zero
dynamics attack, where the attacker can cause instability for the system by
injecting false data [46]. On the other hand, as it has been studied in detail
in [53, p.170-175], the zero for this system can deteriorate the performance
of MPC, and even instability of system can arise when the controller attempts
to cancel the non-minimum phase zero with right hand side poles. To obtain a
satisfactory performance for this system (and generally for system with non-
minimum phase zeros) the prediction horizon parameter $N$ must be selected
sufficiently large. Therefore, Plant needs to take into account in its design
the effects of prediction horizon $N$ and preserving privacy of the dynamics
(43) from Cloud.
Figure 1 shows the output of the linearized system using dense MPC with
prediction horizon $N=5,20$ and $50$ and total time steps $K=500$. As it can
be seen from the figure, the controller performs better when $N=50$ compared
to $N=5$. Furthermore, the root mean squared error
$e_{N}=(\left\|y\right\|_{2}/K^{1/2})$ for the three scenarios are
$e_{5}=0.67$, $e_{20}=0.55$, and $e_{50}=0.49$ which further validates the
superior performance for $N=50$. Therefore, Plant prefers to adopt $N=20$ or
$N=50$ rather than $N=5$ as the prediction horizon for MPC.

Figure 1: The output $y_{1}$ and $y_{2}$ for the system (43) for $N=5$, $20$,
$50$. The system response is more sluggish with $N=5$ compared to $N=20$ and
$N=50$.

###  6.2 Estimation using $H$ and $F$

To examine how Cloud can identify the system dynamics using Theorem 4 (by only
accessing $H$ and $F$ in (21)) we have computed the $\bar{Y}$ in (28) (which
is unknown to Cloud) since it satisfies the Lyapunov equation
$A^{\top}\bar{Y}A-\bar{Y}=-Q$ [47, p.37]. Furthermore, from the spectrum of
$A$ we can see that the system is stable, and the pair $(A,B^{\top}\bar{Y})$
is observable. Therefore, all the conditions of Theorem 4 are satisfied, and
hence Cloud can use the theorem to infer the system and cost matrices. To
measure the error for Cloud’s estimation of the system matrix $A$ we define
the error index

$\epsilon_{A}=\frac{\left\|A-\hat{A}\right\|_{F}}{\left\|A\right\|_{F}},$ (44)

where $\left\|\cdot\right\|_{F}$ is Frobenius norm. For matrix $B$ an
analogues index to (44) will be used, denoted as $\epsilon_{B}$. In addition,
we have shown the error between
$Y=\sum_{i=0}^{N-1}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N}PA^{N}$ given in (21)
and $\bar{Y}$ in (28) as $N$ changes by computing
$\epsilon_{Y}={\left\|\bar{Y}-Y\right\|_{F}}/{\left\|\bar{Y}\right\|_{F}}$.
With regard to $Q$ and $P$ matrices, as we argued in Theorem 2 and Remark 8
for the choice $Q\succ 0$ and $P\succeq 0$ with $B$ in the system (43) the set
(24) is not a singleton and hence Cloud cannot obtain unique values for $P$
and $Q$ but only the uncertainty set (24).

Figure 2: Cloud’s estimation error for $A$ and $B$ matrices of quadruple-tank
process, and convergence error for $Y$ using Theorem 4 Figure 3: Cloud’s
estimation of the true zeros of the system $z_{1}=1.02$, and $z_{2}=0.89$ as
prediction horizon $N$ changes

As Figure 2 shows Cloud is able to identify $A$ and $B$ matrices with less
than $5\%$ error when $N=50$, that is in order for Cloud to apply Theorem 4,
it needs not $N\to\infty$. We have also included in Figure 3 what Cloud infers
for the zeros of the system $z_{1}=1.02$, and $z_{2}=0.89$ using its estimated
$\hat{A}$, $\hat{B}$ and $C$. As we can observe from this figure, Cloud’s
estimation improves as Plant adopts higher values for $N$ to the degree that
at $N=50$ it can estimate both zeros with less than $10\%$ error. Overall,
Cloud’s estimations can be considered as a privacy breach for Plant.

###  6.3 Affine transformation and permutation

As we studied in Section 5, Plant can adopt random affine transformation and
permutation $(\boldsymbol{R},\boldsymbol{r},\boldsymbol{P})$ to prevent Cloud
from accessing sensitive information (See Figure 2 and 3). For the matrices
$\boldsymbol{R}$ and $\boldsymbol{r}$ given in (30) we consider
$\boldsymbol{R}_{i,j},\boldsymbol{r}_{i}\in[-10^{3},10^{3}]$, i.e., each
element of $\boldsymbol{R}$ and $\boldsymbol{r}$ is selected uniformly
randomly from the given interval. By adopting this mechanism, Plant outsources
the computation of the optimizer for transformed program (31) with matrices
(32) to Cloud. Since the mechanism is exact, the system (43) controlled with
solving (31) has the same responses as in Figure 1 for $N=5,20$, and $50$;
hence we do not present them again.
From the system and cost matrices, it can be checked that
$\operatorname{rank}F=4$. Furthermore, from the obtained data in (33a) it
holds that $\operatorname{rank}\Delta\tilde{F}_{0}=4$ with
$\Delta\tilde{F}_{0}$ in (38). Therefore, Cloud can apply Theorem 6 for
estimating eigenvalues of $A$. It should be noted that the condition
$\Delta\tilde{Z}^{*}\Theta=0$ in (41b) has been relaxed to
$\left\|\Delta\tilde{Z}^{*}\Theta\right\|_{F}\leq\epsilon$ where the value
$\epsilon$ is minimized. We have shown the results of eigenvalue estimation by
Cloud in Figure 4.

Figure 4: Cloud’s estimation of eigenvalues of $\hat{A}=TAT^{-1}$ for $N=5$,
$20$, $50$ using Theorem 6 when Plant has adopted random
$(\boldsymbol{R},\boldsymbol{r},\boldsymbol{P})$ and true values of
$\lambda(A)$.

As it can be seen from this figure, Cloud is able to approximately estimate
the eigenvalues of $A$. While these estimations can indeed be considered as
privacy leakage of the random affine transformation method, we need to point
out that since the condition (41b) was replaced by a surrogate and the true
eigenvalues cannot be exactly recovered.

##  7 Conclusion

We have studied privacy preserving properties of random affine transformation
that are applied to computationally demanding MPC problems before outsourcing
to Cloud the search for the optimizer. We have shown that in two forms of MPC,
namely separate and dense form, these transformations are vulnerable to mild
side-knowledge from Cloud. In other words, while they can be used to create
some ambiguity for a privacy-sensitive value in the form of an uncertainty set
(as it has been done so in the literature), it is not necessarily correct to
argue that they guarantee the same privacy degree under side-knowledge from
Cloud which its amount cannot be predetermined. Future directions for this
research include analyzing the privacy preserving properties of time-varying
transformations, studying banded least square form of MPC and floating point
analyses of random variables.

Nils Schlüter and Moritz Schulze Darup acknowledge financial support by the
German Research Foundation (DFG) under the grant SCHU 2940/4-1.

##  Appendix A Proofs

_Proof of Theorem 1_. Recall that Cloud receives
$(\tilde{A},\tilde{B},\tilde{C})$ and
$\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$ given in (5) and
(6) from Plant. Note the expanded form for $\tilde{M}$ in (6) is

$\displaystyle\tilde{M}=\begin{bmatrix}\tilde{M}_{1,1}&\star\\\
-(\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1})\boldsymbol{F}\boldsymbol{T}^{-1}&\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}\end{bmatrix},$
(45)

with
$\tilde{M}_{1,1}=\boldsymbol{T}^{-\top}Q\boldsymbol{T}^{-1}+(\boldsymbol{F}\boldsymbol{T}^{-1})^{\top}(\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1})(\boldsymbol{F}\boldsymbol{T}^{-1})$,
and $(\star)$ denotes the transpose of block $\tilde{M}_{2,1}$. The following
set of observations prove the claim:

  1. 1.

Cloud finds the non-singular matrix
$\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}$ from block $(2,2)$ in
$\tilde{M}$.

  2. 2.

From block $(2,1)$ in $\tilde{M}$ and using the known matrix
$\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}$, Cloud infers the value of the
matrix $\boldsymbol{F}\boldsymbol{T}^{-1}$.

  3. 3.

From block $(1,1)$ in $\tilde{M}$ and using the previously identified matrices
$\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}$ and
$\boldsymbol{F}\boldsymbol{T}^{-1}$, Cloud computes
$\boldsymbol{T}^{-\top}Q\boldsymbol{T}^{-1}$.

  4. 4.

From
$\tilde{A}=\boldsymbol{T}A\boldsymbol{T}^{-1}-\boldsymbol{T}B\boldsymbol{G}^{-1}\boldsymbol{F}\boldsymbol{T}^{-1}$
and $\tilde{B}=\boldsymbol{T}B\boldsymbol{G}^{-1}$ (see (5)), Cloud recovers
$\tilde{A}=\boldsymbol{T}A\boldsymbol{T}^{-1}-\tilde{B}(\boldsymbol{F}\boldsymbol{T}^{-1})$.
Thus, the matrix $\boldsymbol{T}A\boldsymbol{T}^{-1}$ is revealed to Cloud.
$\hfill\blacksquare$

_Proof of Corollary 1_. The proof follows from the observation that the
expressions of $\tilde{A}$, $\tilde{B}$ in (9) are the same as those in (5).
Furthermore, from the quadratic terms of
$\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$, which also appear
in the transformed cost function (10), Cloud recovers the matrices
$(\boldsymbol{T}^{-\top}Q\boldsymbol{T}^{-1}+(\boldsymbol{F}\boldsymbol{T}^{-1})^{\top}(\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1})\boldsymbol{F}\boldsymbol{T}^{-1})$,
$(\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1})\boldsymbol{F}\boldsymbol{T}^{-1}$
and $\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}$. Note that
$\tilde{J}_{r}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})-\tilde{J}(\boldsymbol{\tilde{x}},\boldsymbol{\tilde{u}})$
does not include any quadratic terms to create uncertainty for Cloud. By using
these matrices, Cloud can follow the same steps in the proof of Theorem 1 to
obtain the same results, i.e., it first finds
$\hat{R}=\boldsymbol{G}^{-\top}R\boldsymbol{G}^{-1}$ and then
$\hat{Q}=\boldsymbol{T}^{-\top}Q\boldsymbol{T}^{-1}$ and
$\hat{A}=\boldsymbol{T}A\boldsymbol{T}^{-1}$. $\hfill\blacksquare$
_Proof of Corollary 2_. We present the proof by following analogous steps in
the proof of Theorem 1. Cloud receives $(\tilde{A},\tilde{B},\tilde{C})$ and
$\tilde{J}_{h}(\tilde{\boldsymbol{x}},\tilde{\boldsymbol{u}})$ given in (12)
and (13) from Plant.
(1) Cloud finds
$(\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell}$ from block
$(2,2)$ of $\tilde{M}$. (2) From block $(2,1)$ in $\tilde{M}$ and using the
obtained matrix
$(\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell}$, Cloud
infers the following equality concerning
$\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell}\in\mathbb{R}^{\bar{m}\times\bar{n}}$:

$\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell}=(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}+X,$
(46)

where $(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}$ is any
particular solution to
$-\tilde{M}_{2,1}=((\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell})(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}$
and $X\in\mathbb{R}^{\bar{m}\times\bar{n}}$ is any matrix satisfying
$((\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell})X=0$. As
$R\succ 0$, the latter is equivalent to $X\in\ker\boldsymbol{\bar{G}}^{\ell}$.
Note that, by construction, a particular solution always exists. (3) By
substituting the known term
$(\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell}$ and the
expression of $\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell}$ from (46) into
$\tilde{M}_{1,1}$, Cloud finds the matrix
$(\boldsymbol{\bar{T}}^{\ell})^{\top}Q\boldsymbol{\bar{T}}^{\ell}$ following
the derivations below:

$\displaystyle\tilde{M}_{1,1}=((\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}+X)^{\top}(\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell}((\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}+X)$
$\displaystyle+(\boldsymbol{\bar{T}}^{\ell})^{\top}Q\boldsymbol{\bar{T}}^{\ell}=(\boldsymbol{\bar{T}}^{\ell})^{\top}Q\boldsymbol{\bar{T}}^{\ell}+(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}^{\top}(\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell}(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}},$

hence
$(\boldsymbol{\bar{T}}^{\ell})^{\top}Q\boldsymbol{\bar{T}}^{\ell}=\tilde{M}_{1,1}-(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}^{\top}((\boldsymbol{\bar{G}}^{\ell})^{\top}R\boldsymbol{\bar{G}}^{\ell})(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})_{\text{p}}$.
(4) From
$\tilde{A}=\boldsymbol{\bar{T}}A\boldsymbol{\bar{T}}^{\ell}-(\boldsymbol{\bar{T}}B\boldsymbol{\bar{G}}^{\ell})\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell}$
and $\tilde{B}=\boldsymbol{\bar{T}}B\boldsymbol{\bar{G}}^{\ell}$, Cloud
obtains
$\tilde{A}=\boldsymbol{\bar{T}}A\boldsymbol{\bar{T}}^{\ell}-\tilde{B}(\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell})$.
Thus, by substituting $\boldsymbol{\bar{F}}\boldsymbol{\bar{T}}^{\ell}$ from
(46) into $\tilde{A}$, it follows that
$\boldsymbol{\bar{T}}A\boldsymbol{\bar{T}}^{\ell}$ is revealed to Cloud.
The proof for the second part of Corollary follows from the fact that for two
arbitrary matrices $X_{1}\in\mathbb{R}^{q\times r}$ and
$X_{2}\in\mathbb{R}^{r\times q}$ we have
$\operatorname{mspec}_{nz}(X_{1}X_{2})=\operatorname{mspec}_{nz}(X_{2}X_{1})$[54,
Prop. 6.4.10]. By considering $X_{1}=\boldsymbol{\bar{T}}$ and
$X_{2}=A\boldsymbol{\bar{T}}^{\ell}$, we conclude that
$\operatorname{mspec}_{nz}(\boldsymbol{\bar{T}}A\boldsymbol{\bar{T}}^{\ell})=\operatorname{mspec}_{nz}(A)$,
which completes the proof. $\hfill\blacksquare$
_Proof of Theorem 2_. We present the proof for $N=n+1$. By using
${\mathcal{O}}$ in (23) and block partitioning it, the following equality
holds:

$\underbrace{\operatorname{col}(\mathcal{O}_{1,1},\cdots,\mathcal{O}_{1,n})}_{\eqqcolon{\mathcal{O}}^{-}}A=\operatorname{col}(\mathcal{O}_{1,2},\cdots,\mathcal{O}_{1,n+1}).$
(47)

Notice $\operatorname{rank}{\mathcal{O}}^{-}=n$, i.e., ${\mathcal{O}}^{-}$ is
full column rank since $\mathcal{O}^{-}$ can be written as
$\mathcal{O}^{-}=\operatorname{col}(C,CA,\cdots,CA^{n-1})A,$ which is the
observability matrix multiplied by an invertible matrix $A$ (Assumption 2). As
the pair $(A,C)$ is observable, we find that $\mathcal{O}^{-}$ has full column
rank. Hence the state matrix $A$ can be found uniquely from (47).
By using the first block in $\mathcal{O}$, i.e., $CA$, and the known $A$,
Cloud infers the output matrix $C$. In addition, Cloud recovers the input
matrix $B$ by noticing that the first column block of ${\mathcal{G}}$ for
$N=n+1$ is

$\operatorname{col}(C,CA,\cdots,CA^{n})B=\operatorname{col}(\mathcal{G}_{1,1},\mathcal{G}_{2,1},\cdots,\mathcal{G}_{N,1}),$

which returns a unique value for $B$ due to observability of $(A,C)$. To
recover the matrix $R$, consider $F_{1,N}$ and $H_{N,N}$ blocks from $F$ and
$H$ which are

$\displaystyle 2(A^{N})^{\top}PB$ $\displaystyle=F_{1,N}$ (48a) $\displaystyle
2(R+B^{\top}PB)$ $\displaystyle=H_{N,N}.$ (48b)

From (48a), Cloud recovers the matrix $PB$, and then from (48b) it computes
the cost matrix $R$.
From the obtained set of matrices, Cloud can form the set

$\displaystyle\Big{\\{}\hat{Q},\hat{P}\in\mathbb{R}^{n\times n}|$
$\displaystyle\hat{\mathcal{Q}}\coloneqq\operatorname{blockdiag}(\hat{Q},\ldots,\hat{Q},\hat{P})\,\text{and}\,$
(49)
$\displaystyle\begin{bmatrix}\mathcal{S}&\mathcal{T}\end{bmatrix}^{\top}\hat{\mathcal{Q}}\mathcal{S}$
$\displaystyle=\frac{1}{2}\operatorname{col}(H-2\mathcal{R},F)\Big{\\}},$

where the matrices $\mathcal{R}$, ${\mathcal{S}}$ and $\mathcal{T}$ are
defined in (22). Note that Cloud knows $\mathcal{R}$, ${\mathcal{S}}$ and
$\mathcal{T}$ since it has already recovered $A$, $B$, $R$ and received $H$
and $F$. Notice that by construction of the received matrices, Cloud can find
a pair such as $(\hat{P}\succeq 0,\hat{Q}\succeq 0)$ satisfying (49). Any
other solution for (49) can be written in the following form

$\hat{P}+\Delta P\succeq 0,\quad\hat{Q}+\Delta Q\succeq 0,$ (50)

where $\Delta P$ and $\Delta Q$ are symmetric. The pair $(\hat{P}+\Delta
P,\hat{Q}+\Delta Q)$ is a solution to (49) if and only if $(\Delta P,\Delta
Q)$ satisfies

$\begin{bmatrix}\mathcal{S}&\mathcal{T}\end{bmatrix}^{\top}\Delta\mathcal{Q}\mathcal{S}=0,$
(51)

where $\Delta\mathcal{Q}=\operatorname{blockdiag}(\Delta Q,\cdots,\Delta
Q,\Delta P)$. Denote
$\mathcal{T}^{\top}\Delta\mathcal{Q}\mathcal{S}\eqqcolon\Delta F$ and
$\mathcal{S}^{\top}\Delta\mathcal{Q}\mathcal{S}\eqqcolon\Delta H$. We note
that (51) can be rewritten as $\Delta F=0$ and $\Delta H=0$. Consistent with
$F$ and $H$, we partition the matrices $\Delta F$ and $\Delta H$. We observe
that

$\displaystyle\Delta F_{1,N}=(A^{N})^{\top}\Delta PB=0\iff\Delta PB=0.$ (52)

Note that the deduction is due to invertibility of $A$. Hence, it follows from
(52) that $\Delta P=X_{1}$ for some $X_{1}\in\mathbb{R}^{n\times n}$ with
$X_{1}B=0$. By substituting $\Delta P$ in $\Delta F_{1,N-1}$ block, we have

$\displaystyle\Delta F_{1,N-1}=(A^{N-1})^{\top}\big{(}\Delta Q+A^{\top}\Delta
PA\big{)}B$ (53) $\displaystyle\qquad\qquad=0\iff\underbrace{(\Delta
Q+A^{\top}X_{1}A)}_{\coloneqq X_{2}}B=0,$

where the first line follows from the definition of the block $\Delta
F_{1,N-1}$ and the equivalence is due to $\Delta P=X_{1}$ and invertibility of
$A$. Hence, it follows from (53) that $\Delta Q=X_{2}-A^{\top}X_{1}A$ for some
$X_{2}\in\mathbb{R}^{n\times n}$ with $X_{2}B=0$. Similarly, by substituting
$\Delta P$ and $\Delta Q$ in $\Delta F_{1,N-2}$ block it can be verified that

$\Delta F_{1,N-2}=0\iff(X_{2}-X_{1})AB=0.$ (54)

Analogously, by substituting $\Delta P$ and $\Delta Q$ into $\Delta
F_{1,N-3}$, $\Delta F_{1,N-4}$, $\cdots$, $\Delta F_{1,1}$ it follows:

$\displaystyle\Delta F_{1,N-3}$ $\displaystyle=0\iff(X_{2}-X_{1})A^{2}B=0$
(55) $\displaystyle\qquad\quad\vdots$ $\displaystyle\Delta F_{1,1}$
$\displaystyle=0\iff(X_{2}-X_{1})A^{N-2}B=0.$

Therefore, in order for $\Delta P$ and $\Delta Q$ to satisfy $\Delta F=0$ in
(51) it follows that we equivalently must ensure the existence of $X_{1}$ and
$X_{2}$ such that (52)-(55) hold. Let $X_{1}$ and $X_{2}$ satisfy (52)-(55).
It follows that

$(X_{1}-X_{2})\begin{bmatrix}B&AB&\cdots&A^{N-2}B\end{bmatrix}=0.$ (56)

Noting that $N=n+1$ by assumption and that $(A,B)$ is controllable, it follows
that $X_{1}=X_{2}\eqqcolon X$ for some $X\in\mathbb{R}^{n\times n}$. Recalling
that $\Delta P=X_{1}$ and $\Delta Q=X_{2}-A^{\top}X_{1}A$, the matrix $\Delta
F$ in (51) is equal to zero if and only if

$\displaystyle\Delta P=X$ (57) $\displaystyle\Delta
Q=X-A^{\top}XA,\quad\text{for}\,\,XB=0.$

To complete the proof, we need to prove that $\Delta P$ and $\Delta Q$ given
in (57) satisfy $\Delta H=0$ in (51). It can be observed that the following
relation between the blocks in $\Delta H$ and $\Delta F$ exists:

$\displaystyle\begin{bmatrix}2\Delta H_{1,1}&\star&\cdots&\star\\\ \Delta
H_{2,1}&2\Delta H_{2,2}&\cdots&\star\\\ \vdots&\vdots&\ddots&\star\\\ \Delta
H_{N,1}&\Delta H_{N,2}&\cdots&2\Delta
H_{N,N}\end{bmatrix}=\Delta\mathcal{F}^{\top}\mathcal{A}\mathcal{S}+(\Delta\mathcal{F}^{\top}\mathcal{A}\mathcal{S})^{\top}$
(58)

where $\Delta\mathcal{F}\coloneqq\operatorname{blockdiag}(\Delta
F_{1,1},\Delta F_{1,2},\cdots,\Delta F_{1,N})$ and
$\mathcal{A}\coloneqq\operatorname{blockdiag}(A^{-1},A^{-2},\cdots,A^{-N})$
and $\mathcal{S}$ is given in (22). Thus, from (58) it follows that $\Delta
H=0$ if $\Delta\mathcal{F}=0$. Therefore, it follows that the pair

$\hat{P}+X\succeq 0,\quad\hat{Q}+X-A^{\top}XA\succeq 0,$

with $XB=0$ specifies all the solution for (49). Hence, Cloud infers $Q$ and
$P$ uniquely, if and only if the set (24) is singleton. Note that the proof
also holds for $N>n+1$ since the observability and controllability matrices
(See (47) and (56)), from which the system and cost matrices are obtained,
remain full rank. $\hfill\blacksquare$
_Proof of Lemma 1_. By having access to $h(1)$, $h(2)$, $\ldots$, $h(N)$
defined in (25) with $N=2n+1$ in the $G$ matrix (23), Cloud obtains the Hankel
matrix $\mathcal{H}_{n+1,n+1}$ constructed from Markov parameters, namely

$\mathcal{H}_{n+1,n+1}=\begin{bmatrix}h(1)&h(2)&\ldots&h(n+1)\\\
h(2)&h(3)&\cdots&h(n+2)\\\ \vdots&\vdots&\ddots&\vdots\\\
h(n+1)&h(n+2)&\cdots&h(2n+1)\end{bmatrix}.$

Then based on Lemma 3.5 in [50, Lemma 3.5], Cloud recovers the matrices $A$,
$B$, and $C$ up to a similarity transformation $T$, i.e.,
$(A,B,C)=(TA_{t}T^{-1},TB_{t},C_{t}T^{-1}),$ where $A_{t}$, $B_{t}$, and
$C_{t}$ are computed using singular value decomposition (SVD) of
$\mathcal{H}_{n+1,n+1}$. Note that the results also hold for $N>2n+1$ [50,
Lemma 3.6]. $\hfill\blacksquare$
_Proof of Theorem 3_. Since $N\geq 2n+1$ from Lemma 1, Cloud recovers the
system matrices as $(A,B,C)=(TA_{t}T^{-1},TB_{t},C_{t}T^{-1})$. By
substituting the obtained $(A,B)$ in ${\mathcal{S}}$ and ${\mathcal{T}}$ given
in (22) and defining $V\coloneqq I_{N}\otimes T$, it follows that

$\displaystyle{\mathcal{S}}_{t}\coloneqq V^{-1}\mathcal{S}$ (59)
$\displaystyle{\mathcal{T}}_{t}\coloneqq V^{-1}{\mathcal{T}}T.$

Furthermore, substituting $\mathcal{S}$ and $\mathcal{T}$ given in (59) into
the $H$ and $F$ matrices in (21a) yields

$\displaystyle
2{\mathcal{R}}+2{\mathcal{S}}_{t}^{\top}{\mathcal{Q}}_{t}{\mathcal{S}}_{t}=H$
(60a) $\displaystyle
2{T^{-\top}}{\mathcal{T}}_{t}^{\top}{\mathcal{Q}}_{t}{\mathcal{S}}_{t}=F,$
(60b)

for Cloud where ${\mathcal{Q}}_{t}\coloneqq V^{\top}{\mathcal{Q}}V$.
From the right-hand side of the constraint (21b) the rows $N(2m+p)+1$ to
$2N(m+p)$ read as

$-\mathbb{1}_{N}\otimes y_{\text{min}}+{\mathcal{O}}x_{0}.$ (61)

Due to Assumption 3, Cloud writes $I$ instances of (61) as
$-\mathbb{1}_{N}\otimes y_{\text{min}}+{\mathcal{O}}x_{0|1}\eqqcolon e_{1},$
$\cdots$, $-\mathbb{1}_{N}\otimes y_{\text{min}}+{\mathcal{O}}x_{0|I}\eqqcolon
e_{I}$ which can be compactly rewritten as

$\big{(}-\mathbb{1}_{N}\otimes
y_{\text{min}}\big{)}\mathbb{1}_{I}^{\top}+{\mathcal{O}}X_{0}=\underbrace{\begin{bmatrix}e_{1}&e_{2}&\ldots&e_{I}\end{bmatrix}}_{\eqqcolon
E_{0}},$ (62)

with $X_{0}$ given in (26). Similarly, Cloud writes

$2({\mathcal{T}}^{\top}{\mathcal{Q}}{\mathcal{S}})^{\top}X_{0}=F^{\top}X_{0}$
(63)

for $I$ instances of $x_{0}^{\top}F$. By substituting the obtained system
matrices $(A,C)=(TA_{t}T^{-1},C_{t}T^{-1})$ into ${\mathcal{O}}$ at (62) Cloud
has

$\big{(}-\mathbb{1}_{N}\otimes
y_{\text{min}}\big{)}\mathbb{1}_{I}^{\top}+{\mathcal{O}}_{t}{T^{-1}X_{0}}=E_{0},$
(64)

where
${\mathcal{O}}_{t}\coloneqq\operatorname{col}(C_{t}A_{t},C_{t}A_{t}^{2},\cdots,C_{t}A_{t}^{N})$.
Analogously, substituting $F$ from (60b) into (63) yields

$\displaystyle
2\big{(}{\mathcal{T}}_{t}^{\top}{\mathcal{Q}}_{t}{\mathcal{S}}_{t}\big{)}^{\top}T^{-1}X_{0}=F^{\top}X_{0}$
(65)

for Cloud. Then, Cloud multiplies (64) from right by $L\coloneqq
I_{I}-(\frac{1}{I})\mathbb{1}_{I}\mathbb{1}_{I}^{\top}$ to get

${\mathcal{O}}_{t}{T^{-1}X_{0}}L=E_{0}L,$ (66)

from which it obtains the unique value
$T^{-1}X_{0}L=\mathcal{O}_{t}^{\dagger}E_{0}L$ since ${\mathcal{O}}_{t}$ is
full column rank and known to Cloud. Furthermore, multiplying (65) from right
by $L$ yields

$2\big{(}{\mathcal{T}}_{t}^{\top}{\mathcal{Q}}_{t}{\mathcal{S}}_{t}\big{)}^{\top}T^{-1}X_{0}L=F^{\top}X_{0}L.$
(67)

Since due to assumption $\operatorname{rank}X_{0}=n$ and
$\mathbb{1}_{I}\notin\operatorname{im}X_{0}^{\top}$, equivalently it holds
that $\operatorname{rank}X_{0}L=n$ and subsequently
$\operatorname{rank}T^{-1}X_{0}L=n$. Hence, given that Cloud knows
$T^{-1}X_{0}L$ from (66) it determines from (67) the unique value
$2{\mathcal{T}}_{t}^{\top}{\mathcal{Q}}_{t}{\mathcal{S}}_{t}\eqqcolon F_{t}$,
i.e.,

$F_{t}=(F^{\top}X_{0}L)(T^{-1}X_{0}L)^{\dagger}.$ (68)

Then from block $(1,N)$ of $F_{t}$ in (68) and block $(N,N)$ of $H$ in (60a)
Cloud writes

$\displaystyle 2(A_{t}^{N})^{\top}P_{t}B_{t}=(F_{t})_{1,N}$ (69a)
$\displaystyle 2R+2B_{t}^{\top}P_{t}B_{t}=H_{N,N},$ (69b)

where $P_{t}\coloneqq T^{\top}PT$. From (69a) Cloud obtains the unique
$P_{t}B_{t}$, and then from (69b) it recovers unique matrix $R$.
To recover $Q$ and $P$, Cloud needs to consider the equalities given in (60a)
and (68) and form the set

$\displaystyle\Big{\\{}$ $\displaystyle Q_{t},P_{t}\in\mathbb{R}^{n\times
n}|{\mathcal{Q}}_{t}\coloneqq\operatorname{blockdiag}({Q}_{t},\ldots,{Q}_{t},{P}_{t})\,\text{and}$
(70)
$\displaystyle\begin{bmatrix}\mathcal{S}_{t}&\mathcal{T}_{t}\end{bmatrix}^{\top}{\mathcal{Q}}_{t}\mathcal{S}_{t}=\frac{1}{2}\operatorname{col}(H-2\mathcal{R},F_{t})\Big{\\}},$

where it knows the matrices $\mathcal{S}_{t}$, $\mathcal{T}_{t}$,
$\mathcal{R}$, $H$ and $F_{t}$. Note, the set (70) is analogous to (49), and
therefore Cloud follows the same steps as in Theorem 2 to recover the set (27)
for ${Q}_{t}$ and ${P}_{t}$. This gives the claims. $\hfill\blacksquare$
_Proof of Theorem 4_. From Assumption 4 it holds that
$\lim_{N\to\infty}Y=\bar{Y}$. This enables Cloud to write using the block
matrices $F_{1,1}$, $F_{1,2}$, $\ldots$, $F_{1,n+1}$ the following

$\operatorname{col}(A^{\top},\cdots,(A^{\top})^{n+1})\bar{Y}B=\operatorname{col}(F_{1,1},\cdots,F_{1,n+1}).$
(71)

From the above equation, it follows that

$A^{\top}\underbrace{\begin{bmatrix}F_{1,1}&F_{1,2}&\ldots&F_{1,n}\end{bmatrix}}_{\eqqcolon\mathcal{C}}=\begin{bmatrix}F_{1,2}&F_{1,3}&\ldots&F_{1,n+1}\end{bmatrix}.$
(72)

Observe that

$\displaystyle\mathcal{C}=A^{\top}\begin{bmatrix}\bar{Y}B&(A)^{\top}\bar{Y}B&\cdots&(A^{n-1})^{\top}\bar{Y}B\end{bmatrix}.$

By controllability of the pair $(A^{\top},\bar{Y}B)$, equivalently
observability of $(A,B^{\top}\bar{Y})$, and non-singularity of $A$, Cloud
recovers the state matrix $A$ from (72). For finding the matrix $B$, Cloud
uses the known blocks $H_{2,1}$, $H_{3,1}$, $\ldots$, $H_{n+1,1}$ and writes

$B^{\top}\mathcal{C}=\begin{bmatrix}H_{2,1}^{\top}&H_{3,1}^{\top}&\cdots&H_{n+1,1}^{\top}\end{bmatrix}.$
(73)

From (73) and noting that $\mathcal{C}$ has full row rank, Cloud finds $B$
uniquely. Moreover, Cloud finds $\bar{Y}B$ uniquely from (71). Then, from
block $(1,1)$ of $H$, namely, $R+B^{\top}\bar{Y}B=H_{1,1},$ Cloud recovers the
matrix $R$.
Now that Cloud has recovered the matrices $A$, $B$, and $R$, determining the
matrices $Q$ and $P$ reduces to the same setup as in Theorem 2, leading to the
set in (24). This completes the proof.$\hfill\blacksquare$
_Proof of Theorem 5_. Cloud uses the block matrices $x_{0}^{\top}F_{1,1}$,
$x_{0}^{\top}F_{1,2}$, $\ldots$, $x_{0}^{\top}F_{1,n}$ and writes:

$x_{0}^{\top}\mathcal{C}=x_{0}^{\top}\begin{bmatrix}A^{\top}\bar{Y}B&\cdots&(A^{\top})^{n}\bar{Y}B\end{bmatrix},$
(74)

where $\mathcal{C}$ was defined in (72). Recall the matrix of initial states
defined in (26) as
$X_{0}=\begin{bmatrix}x_{0|1}&x_{0|2}&\ldots&x_{0|I}\end{bmatrix}.$ Due to
Assumption 3, Cloud writes (74) for $I$ instances as

$X_{0}^{\top}\mathcal{C}=X_{0}^{\top}\begin{bmatrix}A^{\top}\bar{Y}B&\cdots&(A^{\top})^{n}\bar{Y}B\end{bmatrix}.$
(75)

Note, $\operatorname{rank}\mathcal{C}=n$ because of the observability of the
pair $(A,B^{\top}\bar{Y})$ and invertibility of $A$. Additionally,
$\operatorname{rank}X_{0}=n$ due to assumption. Hence, it follows
$\operatorname{rank}X_{0}^{\top}\mathcal{C}=n$. Then, Cloud writes a full
factorization of $X_{0}^{\top}\mathcal{C}$ as
$X_{0}^{\top}\mathcal{C}=X_{b}\mathcal{C}_{b}$ where
$X_{b}\in\mathbb{R}^{I\times n}$ and $\mathcal{C}_{b}\in\mathbb{R}^{n\times
nm}$ are full column rank and full row rank matrices. Note that

$X_{0}^{\top}T=X_{b},\quad T^{-1}\mathcal{C}=\mathcal{C}_{b}$ (76)

for an unknown invertible $T\in\mathbb{R}^{n\times n}$ [54, Prop. 7.6.6].
Analogous to (75), Cloud uses the block matrices $x_{0}^{\top}F_{1,2}$,
$x_{0}^{\top}F_{1,2}$, $\ldots$, $x_{0}^{\top}F_{1,n+1}$ and writes:

$X_{0}^{\top}TT^{-1}A^{\top}\mathcal{C}=X_{0}^{\top}\begin{bmatrix}(A^{\top})^{2}\bar{Y}B&\cdots&(A^{\top})^{n+1}\bar{Y}B\end{bmatrix}.$
(77)

By substituting $\mathcal{C}=T\mathcal{C}_{b}$ into (77), Cloud recovers a
unique value for $A_{t}\coloneqq T^{\top}AT^{-\top}$ (equivalently
$T^{-1}A^{\top}T$) since it knows $X_{0}^{\top}T$ from (76) and
$\mathcal{C}_{b}$ (both matrices have full rank) and has received the right
hand-side from Plant.
For finding $B$ matrix, by considering the blocks $H_{2,1}$, $H_{3,1}$,
$\ldots$, $H_{n+1,1}$ Cloud writes

$B^{\top}T\mathcal{C}_{b}=\begin{bmatrix}H_{2,1}^{\top}&H_{3,1}^{\top}&\cdots&H_{n+1,1}^{\top}\end{bmatrix}.$
(78)

Therefore, Cloud recovers unique value $T^{\top}B\eqqcolon B_{t}$ since
$\mathcal{C}_{b}$ is known. For recovering $R$, Cloud first rewrites (78) as

$B^{\top}\bar{Y}T^{-\top}T^{\top}\begin{bmatrix}AB&\cdots&A^{n}B\end{bmatrix}=\begin{bmatrix}H_{2,1}&\cdots&H_{n+1,1}\end{bmatrix},$

and then obtains $B^{\top}\bar{Y}T^{-\top}$ since it knows the full row rank
matrix $T^{\top}\begin{bmatrix}AB&A^{2}B&\ldots&A^{n}B\end{bmatrix}$. Then, it
substitutes the value $(B^{\top}\bar{Y}T^{-\top})(T^{\top}B)$ into the block
$H_{1,1}$, i.e., $R+B^{\top}\bar{Y}B=H_{1,1}$, and recovers the unique matrix
$R$. By replacing $T$ with $T^{-\top}$, we have the claims for the first part
of Theorem.
For the second part of Theorem, note that Cloud has recovered
$A_{t}=T^{-1}AT$, $B_{t}=T^{-1}B$, and $R$ hence analogous to Theorem 3 it can
form the set given in (70) and follow the subsequent steps to infer $Q_{t}$
and $P_{t}$. $\hfill\blacksquare$
_Proof of Proposition 1_. Cloud receives $\tilde{G}=G\boldsymbol{R}$. Recall
$G$ in (23), i.e.,
$G=\begin{bmatrix}I_{Nm}^{\top}&-I_{Nm}^{\top}&{\mathcal{G}}^{\top}&-{\mathcal{G}}^{\top}\end{bmatrix}^{\top}$.
It is clear that Cloud recovers $\hat{}\boldsymbol{R}=\boldsymbol{R}$ from the
results of the first matrix block in $\tilde{G}$. To recover $\boldsymbol{r}$,
note the rows $1$ to $Nm$ in $\tilde{e}$ read as

$\displaystyle\mathbb{1}_{N}\otimes u_{\text{max}}-\boldsymbol{r}$
$\displaystyle\eqqcolon\tilde{e}_{1}.$ (79)

Consider $L=I_{N}-(\frac{1}{N})\mathbb{1}_{N}\mathbb{1}_{N}^{\top}$ and
multiply (79) from left by $L\otimes I_{m}$ to obtain $(L\otimes
I_{m})\boldsymbol{r}=-(L\otimes I_{m})\tilde{e}_{1}$. Hence, Cloud recovers
$\hat{}\boldsymbol{r}=(L\otimes I_{m})\boldsymbol{r}$, which proves the claim.
$\hfill\blacksquare$
_Proof of Theorem 6_. From the analysis preceding the theorem it follows that
under Assumption 3 and the condition $\operatorname{rank}F=n$, the dynamical
system (37) can be formed by Cloud, and its (known) data matrices satisfy
(39). Furthermore, it can be observed from (33a) and (36) that
$\delta\tilde{f}_{1},\cdots,\delta\tilde{f}_{I-1}\in\operatorname{im}(\boldsymbol{R}^{\top}F^{\top})$.
Note also $\operatorname{rank}\boldsymbol{R}^{\top}F^{\top}=n$ since
$\boldsymbol{R}$ is invertible and $\operatorname{rank}F=n$ due to assumption.
By drawing on these observations, it follows that

$\displaystyle\boldsymbol{R}^{\top}F^{\top}X_{1}$
$\displaystyle=\Delta\tilde{F}_{0}$ (80a)
$\displaystyle\boldsymbol{R}^{\top}F^{\top}X_{2}$
$\displaystyle=\Delta\tilde{F}_{1},$ (80b)

where $X_{1}\in\mathbb{R}^{n\times(I-2)}$ is full row rank,
$X_{2}\in\mathbb{R}^{n\times(I-2)}$ and both are unknown to Cloud since
$\boldsymbol{R}^{\top}F^{\top}$ is unknown. Substituting $\Delta\tilde{F}_{0}$
from (40) in (80a) and $\boldsymbol{R}^{\top}F^{\top}$ from (80a) in (80b)
yields

$\displaystyle\boldsymbol{R}^{\top}F^{\top}$ $\displaystyle={\Delta F_{b}}T$
(81) $\displaystyle\Delta\tilde{F}_{1}$ $\displaystyle={\Delta F_{b}}E_{1}$

for Cloud where $E_{0}X_{1}^{\dagger}\eqqcolon T\in\mathbb{R}^{n\times n}$ is
invertible and $E_{0}X_{1}^{\dagger}X_{2}\eqqcolon
E_{1}\in\mathbb{R}^{n\times(I-2)}$. Note, while Cloud knows $E_{1}$, it does
not know $T$. By substituting $\Delta\tilde{F}_{0}$ given in (40),
$\Delta\tilde{F}_{1}$ and $\boldsymbol{R}^{\top}F^{\top}$ given in (81) into
(39) it follows that

$E_{1}={\Delta F_{b}}^{\dagger}\tilde{A}{\Delta F_{b}}E_{0}+{\Delta
F_{b}}^{\dagger}\tilde{B}\Delta\tilde{Z}^{*},$

which is further simplified as

$E_{1}=\begin{bmatrix}TAT^{-1}&T\bar{B}\boldsymbol{R}\end{bmatrix}\begin{bmatrix}E_{0}\\\
\Delta\tilde{Z}^{*}\end{bmatrix}.$ (82)

Multiplying both sides of the above equality from the right by $\Theta$
satisfying (41) yields $E_{1}\Theta=TAT^{-1}$, and thus Cloud identifies
$\hat{A}=TAT^{-1}$ as claimed. $\hfill\blacksquare$

##  Appendix B Dense MPC matrices (21)

We consider the matrices in (21) to be block partitioned based on $N$, and
refer to an arbitrary block by mentioning its position in the matrix. For
instance, we partition $F$ in the cost function as
$F=\begin{bmatrix}F_{i,j}\end{bmatrix}$ where the block
$F_{i,j}\in\mathbb{R}^{n\times m}$ and $i=1$, $j=1,2,\ldots,N$.
The matrices $H$, $F$, and $Y$ in (21a) can be expanded as:

$\displaystyle\frac{1}{2}H=\mathcal{R}+{\mathcal{S}}^{\top}{\mathcal{Q}}{\mathcal{S}}=\begin{bmatrix}H_{1,1}&\star&\star&\ldots&\star\\\
H_{2,1}&H_{2,2}&\star&\ldots&\star\\\ \vdots&\vdots&\ddots&\vdots&\vdots\\\
H_{N-1,1}&H_{N-1,2}&&H_{N-1,N-1}&\star\\\
H_{N,1}&H_{N,2}&\ldots&H_{N,N-1}&H_{N,N}\end{bmatrix}$ $\displaystyle
H_{1,1}=R+B^{\top}\big{(}\sum_{i=0}^{N-2}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N-1}PA^{N-1}\big{)}B$
$\displaystyle
H_{2,1}=B^{\top}\big{(}\sum_{i=0}^{N-3}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N-2}PA^{N-2}\big{)}AB$
$\displaystyle\qquad\qquad\vdots$ $\displaystyle
H_{N-1,1}=B^{\top}\big{(}Q+A^{\top}PA\big{)}A^{N-2}B$ $\displaystyle
H_{N,1}=B^{\top}PA^{N-1}B$ $\displaystyle
H_{2,2}=R+B^{\top}\big{(}\sum_{i=0}^{N-3}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N-2}PA^{N-2}\big{)}B$
$\displaystyle\qquad\qquad\vdots$ $\displaystyle
H_{N-1,2}=B^{\top}\big{(}Q+A^{\top}PA\big{)}A^{N-3}B$ $\displaystyle
H_{N,2}=B^{\top}PA^{N-2}B$ $\displaystyle
H_{N-1,N-1}=R+B^{\top}\big{(}Q+A^{\top}PA\big{)}B$ $\displaystyle
H_{N,N-1}=B^{\top}PAB$ $\displaystyle H_{N,N}=R+B^{\top}PB$
$\displaystyle\frac{1}{2}F=$
$\displaystyle{\mathcal{T}}^{\top}{\mathcal{Q}}{\mathcal{S}}=\begin{bmatrix}F_{1,1}&F_{1,2}&\ldots&F_{1,N-1}&F_{1,N}\end{bmatrix}$
$\displaystyle
F_{1,1}=A^{\top}\big{(}\sum_{i=0}^{N-2}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N-1}PA^{N-1}\big{)}B$
$\displaystyle
F_{1,2}=(A^{2})^{\top}\big{(}\sum_{i=0}^{N-3}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N-2}PA^{N-2}\big{)}B$
$\displaystyle\qquad\qquad\vdots$ $\displaystyle
F_{1,N-2}=(A^{N-2})^{\top}\big{(}Q+A^{\top}QA+(A^{2})^{\top}PA^{2})B$
$\displaystyle F_{1,N-1}=(A^{N-1})^{\top}\big{(}Q+A^{\top}PA)B$ $\displaystyle
F_{1,N}=(A^{N})^{\top}PB$ $\displaystyle
Y=Q+{\mathcal{T}}^{\top}{\mathcal{Q}}{\mathcal{T}}=\sum_{i=0}^{N-1}{(A^{\top})^{i}QA^{i}}+(A^{\top})^{N}PA^{N}$

## References

  * [1] P. Mell, T. Grance _et al._ , “The nist definition of cloud computing,” 2011.
  * [2] J. Drgoňa, D. Picard, and L. Helsen, “Cloud-based implementation of white-box model predictive control for a geotabs office building: A field test demonstration,” _Journal of Process Control_ , vol. 88, pp. 63–77, 2020.
  * [3] P. Stoffel, A. Kümpel, and D. Müller, “Cloud-based optimal control of individual borehole heat exchangers in a geothermal field,” _Journal of Thermal Science_ , vol. 31, no. 5, pp. 1253–1265, 2022.
  * [4] S. woo Ham, D. Kim, T. Barham, and K. Ramseyer, “The first field application of a low-cost mpc for grid-interactive k-12 schools: Lessons-learned and savings assessment,” _Energy and Buildings_ , vol. 296, p. 113351, 2023.
  * [5] A. Vick, J. Guhl, and J. Krüger, “Model predictive control as a service—concept and architecture for use in cloud-based robot control,” in _21st International Conference on Methods and Models in Automation and Robotics (MMAR)_. IEEE, 2016, pp. 607–612.
  * [6] Y. Xia, Y. Zhang, L. Dai, Y. Zhan, and Z. Guo, “A brief survey on recent advances in cloud control systems,” _IEEE Transactions on Circuits and Systems II: Express Briefs_ , vol. 69, no. 7, pp. 3108–3114, 2022.
  * [7] C. Dwork, A. Roth _et al._ , “The algorithmic foundations of differential privacy,” _Foundations and Trends® in Theoretical Computer Science_ , vol. 9, no. 3–4, pp. 211–407, 2014.
  * [8] J. Cortés, G. E. Dullerud, S. Han, J. Le Ny, S. Mitra, and G. J. Pappas, “Differential privacy in control and network systems,” in _IEEE 55th Conference on Decision and Control (CDC)_. IEEE, 2016, pp. 4252–4272.
  * [9] J. Le Ny and G. J. Pappas, “Differentially private filtering,” _IEEE Transactions on Automatic Control_ , vol. 59, no. 2, pp. 341–354, 2013.
  * [10] M. T. Hale and M. Egerstedt, “Cloud-enabled differentially private multiagent optimization with constraints,” _IEEE Transactions on Control of Network Systems_ , vol. 5, no. 4, pp. 1693–1706, 2017.
  * [11] S. Han, U. Topcu, and G. J. Pappas, “Differentially private distributed constrained optimization,” _IEEE Transactions on Automatic Control_ , vol. 62, no. 1, pp. 50–64, 2016.
  * [12] E. Nozari, P. Tallapragada, and J. Cortés, “Differentially private distributed convex optimization via functional perturbation,” _IEEE Transactions on Control of Network Systems_ , vol. 5, no. 1, pp. 395–408, 2016.
  * [13] K. Yazdani, A. Jones, K. Leahy, and M. Hale, “Differentially private lq control,” _IEEE Transactions on Automatic Control_ , vol. 68, no. 2, pp. 1061–1068, 2022.
  * [14] K. H. Degue and J. Le Ny, “Cooperative differentially private lqg control with measurement aggregation,” _IEEE Control Systems Letters_ , vol. 7, pp. 1093–1098, 2022.
  * [15] M. S. Darup, A. B. Alexandru, D. E. Quevedo, and G. J. Pappas, “Encrypted control for networked systems: An illustrative introduction and current challenges,” _IEEE Control Systems Magazine_ , vol. 41, no. 3, pp. 58–78, 2021.
  * [16] F. J. Gonzalez-Serrano, A. Amor-Martın, and J. Casamayon-Anton, “State estimation using an extended kalman filter with privacy-protected observed inputs,” in _IEEE International Workshop on Information Forensics and Security (WIFS)_. IEEE, 2014, pp. 54–59.
  * [17] K. Kogiso and T. Fujita, “Cyber-security enhancement of networked control systems using homomorphic encryption,” in _IEEE 54th Conference on Decision and Control (CDC)_. IEEE, 2015, pp. 6836–6843.
  * [18] Y. Shoukry, K. Gatsis, A. Alanwar, G. J. Pappas, S. A. Seshia, M. Srivastava, and P. Tabuada, “Privacy-aware quadratic optimization using partially homomorphic encryption,” in _IEEE 55th Conference on Decision and Control (CDC)_. IEEE, 2016, pp. 5053–5058.
  * [19] A. B. Alexandru, K. Gatsis, Y. Shoukry, S. A. Seshia, P. Tabuada, and G. J. Pappas, “Cloud-based quadratic optimization with partially homomorphic encryption,” _IEEE Transactions on Automatic Control_ , vol. 66, no. 5, pp. 2357–2364, 2020.
  * [20] A. B. Alexandru, A. Tsiamis, and G. J. Pappas, “Towards private data-driven control,” in _IEEE 59th Conference on Decision and Control (CDC)_. IEEE, 2020, pp. 5449–5456.
  * [21] Y. Lu and M. Zhu, “Privacy preserving distributed optimization using homomorphic encryption,” _Automatica_ , vol. 96, pp. 314–325, 2018.
  * [22] M. S. Darup, A. Redder, I. Shames, F. Farokhi, and D. Quevedo, “Towards encrypted mpc for linear constrained systems,” _IEEE Control Systems Letters_ , vol. 2, no. 2, pp. 195–200, 2017.
  * [23] N. Schlüter and M. S. Darup, “Encrypted explicit mpc based on two-party computation and convex controller decomposition,” in _IEEE 59th Conference on Decision and Control (CDC)_. IEEE, 2020, pp. 5469–5476.
  * [24] K. Tjell, N. Schlüter, P. Binfet, and M. S. Darup, “Secure learning-based mpc via garbled circuit,” in _IEEE 60th Conference on Decision and Control (CDC)_. IEEE, 2021, pp. 4907–4914.
  * [25] J. Katz and Y. Lindell, _Introduction to modern cryptography_. CRC press, 2015.
  * [26] M. J. Atallah, J. R. Rice, and E. E. Spafford, “Secure outsourcing of scientific computations,” in _Advances in Computers_. Elsevier, 2002, vol. 54, pp. 215–272.
  * [27] J. Vaidya, “Privacy-preserving linear programming,” in _Proceedings of the 2009 ACM symposium on Applied Computing_ , 2009, pp. 2002–2007.
  * [28] O. L. Mangasarian, “Privacy-preserving linear programming,” _Optimization Letters_ , vol. 5, pp. 165–172, 2011.
  * [29] J. Dreier and F. Kerschbaum, “Practical privacy-preserving multiparty linear programming based on problem transformation,” in _IEEE Third International Conference on Privacy, Security, Risk and Trust and IEEE Third International Conference on Social Computing_. IEEE, 2011, pp. 916–924.
  * [30] S. Salinas, C. Luo, W. Liao, and P. Li, “Efficient secure outsourcing of large-scale quadratic programs,” in _Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security_ , 2016, pp. 281–292.
  * [31] L. Zhou and C. Li, “Outsourcing large-scale quadratic programming to a public cloud,” _IEEE Access_ , vol. 3, pp. 2581–2589, 2015.
  * [32] Z. Shan, K. Ren, M. Blanton, and C. Wang, “Practical secure computation outsourcing: A survey,” _ACM Computing Surveys (CSUR)_ , vol. 51, no. 2, pp. 1–40, 2018.
  * [33] P. C. Weeraddana, G. Athanasiou, C. Fischione, and J. S. Baras, “Per-se privacy preserving solution methods based on optimization,” in _IEEE 52nd conference on decision and control (CDC)_ , 2013, pp. 206–211.
  * [34] A. Sultangazin and P. Tabuada, “Towards the use of symmetries to ensure privacy in control over the cloud,” in _IEEE 57th Conference on Decision and Control (CDC)_. IEEE, 2018, pp. 5008–5013.
  * [35] ——, “Symmetries and privacy in control over the cloud: uncertainty sets and side knowledge,” in _IEEE 58th Conference on Decision and Control (CDC)_. IEEE, 2019, pp. 7209–7214.
  * [36] ——, “Symmetries and isomorphisms for privacy in control over the cloud,” _IEEE Transactions on Automatic Control_ , vol. 66, no. 2, pp. 538–549, 2020.
  * [37] K. Zhang, Z. Li, Y. Wang, and N. Li, “Privacy-preserved nonlinear cloud-based model predictive control via affine masking,” _arXiv preprint arXiv:2112.10625_ , 2021.
  * [38] A. M. Naseri, W. Lucia, and A. Youssef, “A privacy preserving solution for cloud-enabled set-theoretic model predictive control,” in _2022 European Control Conference (ECC)_. IEEE, 2022, pp. 894–899.
  * [39] H. Hayati, C. Murguia, and N. van de Wouw, “Privacy-preserving federated learning via system immersion and random matrix encryption,” in _IEEE 61st Conference on Decision and Control (CDC)_. IEEE, 2022, pp. 6776–6781.
  * [40] H. Hayati, N. van de Wouw, and C. Murguia, “Immersion and invariance-based coding for privacy in remote anomaly detection,” _IFAC-PapersOnLine_ , vol. 56, no. 2, pp. 11 191–11 196, 2023.
  * [41] N. Schlüter, P. Binfet, and M. S. Darup, “Cryptanalysis of random affine transformations for encrypted control,” _IFAC-PapersOnLine_ , vol. 56, no. 2, pp. 11 209–11 216, 2023.
  * [42] P. Binfet, N. Schlüter, and M. S. Darup, “On the security of randomly transformed quadratic programs for privacy-preserving cloud-based control,” _arXiv preprint arXiv:2311.05215_ , 2023.
  * [43] F. Borrelli, A. Bemporad, and M. Morari, _Predictive control for linear and hybrid systems_. Cambridge University Press, 2017.
  * [44] J. B. Rawlings, D. Q. Mayne, and M. Diehl, _Model predictive control: theory, computation, and design_. Nob Hill Publishing Madison, WI, 2017, vol. 2.
  * [45] R. Cramer, I. B. Damgård _et al._ , _Secure multiparty computation_. Cambridge University Press, 2015.
  * [46] A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “A secure control framework for resource-limited adversaries,” _Automatica_ , vol. 51, pp. 135–148, 2015.
  * [47] F. L. Lewis, D. Vrabie, and V. L. Syrmos, _Optimal control_. John Wiley & Sons, 2012.
  * [48] J. Kim, H. Shim, and K. Han, “Dynamic controller that operates over homomorphically encrypted data for infinite time horizon,” _IEEE Transactions on Automatic Control_ , vol. 68, no. 2, pp. 660–672, 2022.
  * [49] R. A. Horn and C. R. Johnson, _Matrix analysis_. Cambridge university press, 2012.
  * [50] M. Verhaegen and V. Verdult, _Filtering and system identification: a least squares approach_. Cambridge university press, 2007.
  * [51] J. C. Willems, P. Rapisarda, I. Markovsky, and B. L. De Moor, “A note on persistency of excitation,” _Systems & Control Letters_, vol. 54, no. 4, pp. 325–329, 2005.
  * [52] K. H. Johansson, “The quadruple-tank process: A multivariable laboratory process with an adjustable zero,” _IEEE Transactions on control systems technology_ , vol. 8, no. 3, pp. 456–465, 2000.
  * [53] E. F. Camacho and C. Bordons, _Model predictive controllers_. Springer, 2007.
  * [54] D. S. Bernstein, _Scalar, vector, and matrix mathematics_. Princeton University Press, 2018.