Training machine learning models, including Grid Foundation Models (GFMs), requires large volumes of realistic grid data, yet substantial privacy concerns discourage utilities and data providers from sharing load profiles and network parameters. We study the release of synthetic voltage phasor trajectories for distribution grids under differential privacy (DP). We first fit a DP generative model to historical customer loads, then propagate synthetic load trajectories through the AC power flow equations on the true admittance matrix to produce voltage phasors. The central question is whether the randomness already present in the DP synthetic loads is sufficient to protect not only the loads, but also the network topology encoded by the bus admittance matrix. We show that it is. The implication is that a corpus of voltage trajectories can be constructed from DP synthetic loads while preserving the statistics of AC power flow, which is critical for training GFMs. This preservation of the power flow statistics stands in contrast to approaches that perturb the admittance matrix directly or inject noise into the voltage outputs, both of which distort the underlying physics. Concretely, we derive (ε,δ)-DP guarantees for the released voltage trajectories with respect to the admittance matrix, meaning privacy of the network parameters is obtained without any additional noise mechanism. Our bound depends on the adjacency assumption, the Jacobian of the AC power flow, and the covariance of the synthetic DP-loads. Finally, we present a synthetic voltage generation procedure and an empirical evaluation against Gaussian output-perturbation baselines, demonstrating that our approach provides a clear advantage for enabling GFM training.

This paper addresses the problem of protecting network information from privacy system identification (SI) attacks when sharing cyber-physical system simulations. We model analyst observations of networked states as time-series outputs of a graph filter driven by differentially private (DP) nodal excitations, with the analyst aiming to infer the underlying graph shift operator (GSO). Unlike traditional SI, which estimates system parameters, we study the inverse problem: what assumptions prevent adversaries from identifying the GSO while preserving utility for legitimate analysis. We show that applying DP mechanisms to inputs provides formal privacy guarantees for the GSO, linking the (ϵ, δ)-DP bound to the spectral properties of the graph filter and noise covariance. More precisely, for DP Gaussian signals, the spectral characteristics of both the filter and noise covariance determine the privacy bound, with smooth filters and low-condition-number covariance yielding greater privacy.

Memory disaggregation via Compute Express Link (CXL) enables multiple hosts to share remote memory, improving utilization for data-intensive workloads. Today, virtual memory enables process-level isolation on a host and CXL enables host-level isolation. This creates a critical security gap: the absence of process-level memory isolation in shared disaggregated memory. We present Space-Control, a hardware-software co-design that provides fine-grained, process-level isolation for shared disaggregated memory. Space-Control authenticates execution context in the hardware and enforces access control on every memory access and amortizes lookup times with a small cache. Our design allows up to 127 processes Simulation Toolkit (SST) based CXL model, Space-Control incurs minimal performance overhead of 3.3

Repeated differentially private (DP) releases are often evaluated by transcript length or cumulative privacy accounting. We show that these quantities do not by themselves determine local reconstruction risk. For Gaussian-calibrated repeated statistical queries, the key object is the nuisance-profiled Fisher geometry of the release sequence: repetition helps only when new releases create identifiable directions after nuisance variables are removed. Thus, release geometry determines what can be locally identified, while the privacy accountant determines how precisely those directions can be estimated. We develop this principle in two settings. For labeled-target reconstruction with fixed-background IN/OUT averages, repeated copies collapse to a single target-versus-background contrast. The best linear unbiased estimator attains the Cramer-Rao bound, and additional copies provide only averaging gain; under Basic Composition this gain is dominated by the Θ(L^2log L) noise penalty, whereas zCDP/RDP-style Gaussian accounting makes the risk order-flat. For static permutation-invariant releases, labels remain unidentified, but feature diversity can make the sorted participating multiset locally identifiable. For polynomial moments and smooth thresholds, the useful number of releases is governed by the balance between newly exposed eigendirections and accountant-induced noise growth. These results provide a local, mechanism-specific benchmark for value leakage in repeated private sensing and analytics.

We propose a novel Decentralized Differentially Private Power Method (D-DP-PM) for performing Principal Component Analysis (PCA) in networked multi-agent settings. Unlike conventional decentralized PCA approaches where each agent accesses the full n-dimensional sample space, we address the challenging scenario where each agent observes only a subset of dimensions through row-wise data partitioning. Our method ensures (ε,δ)-Differential Privacy (DP) while enabling collaborative estimation of global eigenvectors across the network without requiring a central aggregator. We achieve this by having agents share only local embeddings of the current eigenvector iterate, leveraging both the inherent privacy from random initialization and carefully calibrated Gaussian noise additions. We prove that our algorithm satisfies the prescribed (ε,δ)-DP guarantee and establish convergence rates that explicitly characterize the impact of the network topology. Our theoretical analysis, based on linear dynamics and high-dimensional probability theory, provides tight bounds on both privacy and utility. Experiments on real-world datasets demonstrate that D-DP-PM achieves superior privacy-utility tradeoffs compared to naive local DP approaches, with particularly strong performance in moderate privacy regimes (ε∈[2, 5]). The method converges rapidly, allowing practitioners to trade iterations for enhanced privacy while maintaining competitive utility.

In future nuclear arms control treaties, it will be necessary to authenticate the hardware and software components of verification measurement systems, i.e., to ensure these systems are functioning as intended and have not been tampered with by malicious actors. While methods such as source code hashing and static analysis can help verify the integrity of software components, they may not be capable of detecting tampering with environment variables, external libraries, or the firmware and hardware of radiation measurement systems. In this article, we introduce the concept of physical differential fuzz testing as a challenge-response-style tamper indicator that can holistically and simultaneously test all the above components in a cyber-physical system. In essence, we randomly sample (or "fuzz") the untampered system's parameter space, including both normal and off-normal parameter values, and consider the time series of outputs as the baseline signature of the system. Re-running the same input sequence on a untampered system will produce an output sequence consistent with this baseline, while running the same input sequence on a tampered system will produce a modified output sequence and raise an alarm. We then apply this concept to authenticating the radiation measurement equipment in nuclear weapon verification systems and conduct demonstration fuzz testing measurements with a sodium iodide (NaI) gamma ray spectrometer. Because there is Poisson noise in the measured output spectra, we also use a mechanism for comparing inherently noisy or stochastic fuzzing sequences. We show that physical differential fuzz testing can detect two types of tamper attempts, and conclude that it is a promising framework for authenticating future cyber-physical systems in nuclear arms control, safeguards, and beyond.

Internet of Things (IoT)-enabled electric vehicles (IoEVs) enable intelligent charging coordination that accounts for grid congestion. However, increased data exchange raises privacy concerns, as charging patterns can reveal sensitive driver behavior to grid operators. We propose a differentially private (DP) EV charging framework that enables coordinated control while protecting driver data with theoretical privacy guarantees. Nevertheless, integrating DP inevitably introduces uncertainty into the control strategy for EVs, which can lead to infeasible solutions. To tackle this challenge, we develop a feasible and scalable control algorithm based on constrained reinforcement learning (CRL) and convex hulls. While our framework is designed to handle the uncertainty introduced by DP, it is general and also applicable to other sources of uncertainty in EV charging, such as the stochastic nature of driver behavior and renewable variability. This ensures feasible and privacy-preserving coordination of EV charging at scale. Our method constructs convex hulls within the action space to guarantee feasibility under stochastic constraints and incorporates constraint reduction techniques to improve scalability. Case studies based on IEEE benchmark systems demonstrate that the proposed approach effectively balances feasibility under uncertainty, scalability, and privacy in large-scale EV charging control.

Gaussian Mixture Models (GMMs) are widely used statistical models for representing multi-modal data distributions, with numerous applications in data mining, pattern recognition, data simulation, and machine learning. However, recent research has shown that releasing GMM parameters poses significant privacy risks, potentially exposing sensitive information about the underlying data. In this paper, we address the challenge of releasing GMM parameters while ensuring differential privacy (DP) guarantees. Specifically, we focus on the privacy protection of mixture weights, component means, and covariance matrices. We propose to use Kullback-Leibler (KL) divergence as a utility metric to assess the accuracy of the released GMM, as it captures the joint impact of noise perturbation on all the model parameters. To achieve privacy, we introduce a DP mechanism that adds carefully calibrated random perturbations to the GMM parameters. Through theoretical analysis, we quantify the effects of privacy budget allocation and perturbation statistics on the DP guarantee, and derive a tractable expression for evaluating KL divergence. We formulate and solve an optimization problem to minimize the KL divergence between the released and original models, subject to a given (ε, δ)-DP constraint. Extensive experiments on both synthetic and real-world datasets demonstrate that our approach achieves strong privacy guarantees while maintaining high utility.

Modern biomedical AI pipelines require robust data protection across heterogeneous environments, including edge devices, hospital servers, and cloud resources, each with distinct performance, trust, and regulatory considerations. While recent advancements in hardware-backed confidential computing (e.g., Intel SGX, AMD SEV, ARM TrustZone) offer promising solutions for data security, their differing threat models prevent seamless, end-to-end "capture-to-use" protection. To address this, we propose a novel, hardware-agnostic security monitor that extends the attestation and memory-encryption capabilities of these disparate Trusted Execution Environments (TEEs). This is complemented by a software-defined secure tunnel that enforces data-centric policy, provenance, and compliance. Our proof-of-concept prototype, integrating a TrustZone-enabled Raspberry Pi with an AMD SEV virtual machine in a cloud environment, demonstrates a deployable, data-centric enclave architecture that achieves end-to-end confidentiality, integrity, and compliance without compromising clinical throughput in biomedical AI workflows.

Graph matching over two given graphs is a well-established method for re-identifying obscured node labels within an anonymous graph by matching the corresponding nodes in a reference graph. This paper studies a new application, termed the graph-signal-to-graph matching (GS2GM) problem, where the attacker observes a set of filtered graph signals originating from a hidden graph. These signals are generated through an unknown graph filter activated by certain input excitation signals. Our goal is to match their components to a labeled reference graph to reveal the labels of asymmetric nodes in this unknown graph, where the excitations can be either known or unknown to the attacker. To this end, we integrate the existing blind graph matching algorithm with techniques of graph filter inference and covariance-based eigenvector estimation. Furthermore, we establish sufficient conditions for perfect node de-anonymization through graph signals, showing that graph signals can leak substantial private information on the concealed labels of the underlying graph. Experimental results validate our theoretical insights and demonstrate that the proposed attack effectively reveals many of the hidden labels, particularly when the graph signals are adequately uncorrelated and sampled.

Graph matching over two known graphs is a method for de-anonymizing obscured node labels within an anonymous graph, finding the corresponding nodes in a second graph. In this paper, we consider a new case where a set of graph signals originate from a hidden graph. We want to match their components to a reference graph to reveal labels of asymmetric nodes. We refer to this as the graph-signal-to-graph matching (GS2GM) problem. We introduce a symmetry detection method to pinpoint the asymmetric nodes in the reference graph. Then, we adapt the existing blind graph matching algorithm, originally designed for asymmetric graphs, to align the detected nodes with signals generated from the target hidden graph. Furthermore, we establish sufficient conditions for perfect node de-anonymization through graph signals, showing that graph signals can leak substantial private information on the concealed labels of the underlying graph.

Most published work on differential privacy (DP) focuses exclusively on meeting privacy constraints by adding to the query noise with a pre-specified parametric distribution model, typically with one or two degrees of freedom. The accuracy of the response and its utility for the intended use are often not part of the design. Considering that several database queries are categorical in nature (e.g., label, color, etc.), or discrete numerical data (e.g., ranking, histogram, etc.), or can be quantized to discrete values, the parameters that define the randomized mechanism’s distribution are finite. Thus, it is reasonable to search through numerical optimization for the probability masses that meet the privacy constraints while minimizing the query distortion. Considering the modulo summation of random noise as the probabilistic DP mechanism, the goal of this paper is to introduce a tractable framework to design the optimum noise probability mass function (PMF) for database queries with a discrete and finite set, optimizing with an expected distortion metric for a given privacy requirement. This paper shows that the optimum PMF can be obtained by solving a mixed integer linear program (MILP) and that the proposed optimal mechanism significantly outperforms the state-of-the-art.

In this paper, we present a framework based on differential privacy (DP) for querying electric power measurements to detect system anomalies or bad data. Our DP approach conceals consumption and system matrix data, while simultaneously enabling an untrusted third party to test hypotheses of anomalies, such as the presence of bad data, by releasing a randomized sufficient statistic for hypothesis-testing. We consider a measurement model corrupted by Gaussian noise and a sparse noise vector representing the attack, and we observe that the optimal test statistic is a chi-square random variable. To detect possible attacks, we propose a novel DP chi-square noise mechanism that ensures the test does not reveal private information about power injections or the system matrix. The proposed framework provides a robust solution for detecting bad data while preserving the privacy of sensitive power system data.

This paper presents a comprehensive stochastic optimization model that seamlessly integrates aggregate electric vehicle (EV) charging demand response with power grid system operations, leveraging the inherent flexibility of EV charging. Our main novel contribution is tackling the problem of uncertainty in the demand characteristics. In our stochastic model, we capture not only unknown user charging patterns but also the effect of a pseudo-randomized mechanism applied to provide differential privacy (DP) guarantees to users whose charging patterns are not disclosed. From a control perspective, the intrinsic randomness of the users charging needs, compounded with randomness introduced by the DP mechanism can easily result in infeasible solutions. To overcome this challenge, we adopt a robust optimal control strategy that encompasses the intersection of potential sampling scenario-based constraints. In addition, to manage the high-dimension of the control action space, we approximate the intersections of the feasible regions with a reduced set of polyhedron constraints. In conclusion, our case studies based on IEEE standard systems demonstrate that the proposed algorithm effectively addresses robustness, scalability, and differential privacy for EV users by dynamically adapting to control the demand response for renewable energy integration while consistently ensuring the privacy of EV drivers.

Having infrastructure survive over very long stretches of time is a nontrivial task. This is either because such infrastructure needs to be built extremely well from the outset or because it requires ongoing maintenance. The former may require prohibitively large initial investments. The latter requires ongoing investment from public agencies over the span of decades or centuries despite the pendulum swings of those governments from contrasting political aims. Without either the very high initial or ongoing investment, infrastructure can fail. Physical infrastructure failure is not inevitable—consider railways in Japan, the Panama Canal, and the U.S. Interstate Highway System.

IEEE Security & Privacy published Volume 1, Issue 1 20 years ago in January/February 2003. This year, beginning with this issue of IEEE Security & Privacy, we aim to celebrate those first 20 years with retrospectives on some of the challenges that we have overcome in that time as well as some of those on which we have not made as much progress as we had hoped to achieve. We also reflect on new challenges and even entire subdisciplines of computer security and privacy that didn’t even exist 20 years ago.