1

Smart Meter Privacy with Renewable Energy and
an Energy Storage Device

arXiv:1703.08390v3 [cs.IT] 29 Jan 2018

Giulio Giaconi, Student Member, IEEE, Deniz Gündüz, Senior Member, IEEE, and H. Vincent Poor, Fellow, IEEE

Abstract—A smart meter (SM) measures a consumer’s electricity consumption and reports it automatically to a utility provider
(UP) in almost real time. Despite many advantages of SMs, their
use also leads to serious concerns about consumer privacy. In
this paper, SM privacy is studied by considering the presence
of a renewable energy source (RES) and a rechargeable battery
(RB), which can be used to partially hide the consumer’s energy
consumption behavior. Privacy is measured by the information
leakage rate, which denotes the average mutual information
between the user’s real energy consumption and the energy
requested from the grid, which the SM reads and reports
to the UP. The impact of the knowledge of the amount of
energy generated by the RES at the UP is also considered.
The minimum information leakage rate is characterized as a
computable information theoretic single-letter expression in the
two extreme cases, that is, when the battery capacity is infinite
or zero. Numerical results are presented for the finite battery
capacity case to illustrate the potential privacy gains from the
existence of an RB. It is shown that, while the information
leakage rate decreases with increasing availability of an RES,
larger storage capacity is needed to fully exploit the available
energy to improve the privacy.

I. I NTRODUCTION
The transition from the legacy power distribution network
to the new power grid paradigm, the so-called smart grid
(SG), is rapidly ongoing. An SG provides many advantages for
energy generation, transmission, distribution and consumption
thanks to the use of information and communication technologies that enable SGs to monitor and control the power
network more effectively [2]. In addition, an SG eases the
integration of renewable energy sources (RESs), which is a
fundamental factor in reducing our dependence on fossil fuels
and moving on to a low carbon economy. A key feature
of an SG is the advanced metering infrastructure, and in
particular smart meters (SMs), which record and report the
electricity consumption of a household. SMs that are currently
being rolled out in the United Kingdom send measurements
every 30 minutes [3], whereas those in Texas send every 15
minutes [4]. The frequency of SM measurements is expected to
The work of G. Giaconi was supported by the Engineering and Physical
Sciences Research Council (EPSRC) of the U.K. under Grant 1507704. This
work was supported in part by the EPSRC through the project COPES under
Grant 173605884, in part by the European Research Council under Starting
Grant BEACON (agreement 677854), and in part by the U.S. National Science
Foundation under Grant CMMI-1435778, Grant ECCS-1549881, and Grant
ECCS-1647198. This paper was presented in part at the IEEE International
Conference on Communications, London, U.K., June 2015 [1].
G. Giaconi and D. Gündüz are with the Department of Electrical and
Electronic Engineering, Imperial College London, London, SW7 2AZ, UK
(e-mail: {g.giaconi, d.gunduz}@imperial.ac.uk).
H. V. Poor is with the Department of Electrical Engineering, Princeton
University, Princeton, NJ 08544 USA (e-mail: poor@princeton.edu).

increase drastically in the near future when renewable energy
integration increases and the energy market becomes more
efficient by incorporating time-of-usage pricing and demand
shifting [5].
The installation of SMs is rapidly advancing worldwide.
For example, all European Union countries are required to
have 80% SM adoption by 2020 and 100% by 2022 [6].
On the other hand, the information that is collected by SMs
may be potentially used for other purposes, thereby raising
the question of data privacy. By using nonintrusive appliance
load monitoring (NILM) techniques, power consumption load
profiles can reveal sensitive information, such as the users’
habits, presence at home and working hours, potential illnesses
or disabilities, equipment being used, and even which TV
channel is being watched [7]. First NILM devices were built
in the 80s and were already able to detect the activity of some
appliances by knowing their power signature [8]. MolinaMarkham et al. [9] showed that it is possible to detect users’
activity by simply using off-the-shelf clustering and pattern
recognition methods, even without any a priori knowledge of
the appliances’ power signature. The current state of the art is
to consider a factorial hidden Markov model to model the total
consumption of various household appliances, whose solution
is, however, NP hard. To solve this issue, [10] describes
a computationally efficient method based on a semidefinite
relaxation combined with randomized rounding.
A. Privacy-Aware SM Techniques
To date, there are two main families of approaches that
have been investigated to provide privacy to consumers. The
first family includes approaches that process SM data before
sending it to the UP, while approaches in the second family
aim at modifying the actual user energy demand. Considered
within the first family are methods such as data obfuscation,
data aggregation and data anonymization. Data obfuscation,
i.e., the perturbation of metering data by adding noise, is a
classic method, and has been adapted to SGs in [11] and
[12]. Among these methods, differential privacy [13], a wellestablished concept in the data mining literature based on
distorting data to protect the privacy of individuals, is applied
to SMs in [14]. Along these lines, authors in [15] provide
a framework that measures the trade-off between altering
data (privacy) and sharing them (utility). Data aggregation,
proposed in [12], [16] and [17], considers aggregating power
measurements over a group of households so that the UP is
prevented from knowing individual consumptions. The aggregation can be performed with or without the help of a trusted
third party. Data anonymization mainly considers resorting to
pseudonyms rather than the real identities, as in [18] and [19].

2

The first family of approaches, however, suffer from a
further privacy risk. In fact, the energy consumed by a user is
provided directly from the grid, which is fully controlled by the
distribution system operator (DSO), i.e., the entity that manages the power grid; and hence, the DSO can embed additional
sensors to monitor the energy requested by a household or a
business, without fully relying on SM readings. Moreover, any
attacker, e.g., a thief or an intelligence agency, may decide to
install a sensor for directly monitoring a specific household or
business. Another disadvantage of data obfuscation methods
is the mismatch between the reported values and the real
energy consumption. This prevents the DSO from accurately
monitoring the grid states and rapidly reacting to outages,
energy theft or other problems. To address these problems,
the second family of privacy-preserving approaches directly
modifies the actual energy consumption profile of the user,
called the input load rather than simply modifying the data
sent to the UP. This can be done, for example, by filtering
the energy via an energy storage device, i.e., a rechargeable
battery (RB), as in [20]–[26], or by using an RES, as originally
proposed in [24]. If we denote the energy received from the
grid as the output load, the idea is to physically differentiate
the output load with respect to the input load. Different
heuristic algorithms have been proposed, such as the besteffort water-filling algorithm in [21] that aims at keeping the
output load at its most recent value, or the stepping algorithm
in [22] that quantizes the power demand into a step function.
In [25] the problem is solved in the offline setting by taking the
energy cost into account, while the online privacy problem is
formulated as a Markov decision process in [26], and solved
numerically in general, while a “single-letter” expression is
provided for an independent and identically distributed (i.i.d.)
input load. In [27] Fisher information is used as a measure of
privacy and, by using the Cramér-Rao bound, the variance of
the estimation error of any unbiased estimator of the household
consumption is maximized by minimizing the trace of the
Fisher information matrix. When considering also the presence
of an RES, a single-letter solution is given for this problem
in [28]–[30] under average and peak power constraints on the
available RES. In [31] model predictive control is adopted to
jointly optimize cost and and privacy in the presence of a
battery and local energy generation.
In this paper, we adopt the latter approach, and focus on
providing privacy by considering the presence of both an RES
and an RB. We study privacy from an information theoretic
point of view, and, for some scenarios, provide closed-form
expressions for the best privacy performance achievable. A
similar model, studied in [30], imposes only average and peak
power constraints on the RES, which can be a microgrid,
capable of providing any amount of energy at each time
instant. However, the energy produced by an RES at each
time instant is typically random, and its statistics depend on
the energy source (e.g., solar, wind) and the energy generator
specifications. In addition, the finite-capacity battery imposes
further limitations on the available energy. Thus, in this paper
we study the minimum amount of user’s energy consumption
information leaked to the UP by taking into account instantaneous power constraints, as initially proposed in [1]. While

the analysis in [1] is limited to the two extreme scenarios
of zero and infinite battery capacity with a discrete-alphabet
input load, here we also study the more practical scenario
with a finite-capacity storage device, as well as a continuousalphabet input load.
Following up on [23], [24] and [30], we model user’s
energy consumption profile as a randomly generated time
series whose statistics are known by the UP, and measure the
user’s information leakage by the average mutual information
between the input and output load vectors, i.e., between the
real energy consumption profile of the appliances and the SM
readings, which is called the information leakage rate. Mutual
information between random variables X and Y , I(X; Y ),
is as a measure of dependence between X and Y , which is
equal to zero if and only if X and Y are independent. We
can also interpret mutual information as the reduction in the
uncertainty of the UP about the real energy consumption of
the appliances, X n , after receiving the SM measurements, Y n .
Thus, minimizing mutual information can be interpreted as a
way of improving privacy for SM users. Moreover, mutual
information as a privacy measure does not depend on the
technological implementation of load monitoring algorithms,
and therefore, provides statistical privacy guarantees independent of the computational power of the attacker or the
particular monitoring algorithm employed. Mutual information
as a measure of privacy leakage has also been considered in
other domains, see for example [32]–[34].
B. Current Home Batteries and Typical Household Input
Loads
In this section we briefly summarize the specifications of
residential batteries available in the market and the general
statistics of household energy consumption and generation to
illustrate the feasibility of privacy-protection through energy
management. Table I lists the storage capacity and peak power
for some of the currently available batteries for residential use.
It is noteworthy that the capacities are in the range of few kWh.
A typical household’s average energy consumption also lies
within the same range, as shown in Table II, where we report
the distribution of the average user power consumption over
different years obtained from various databases, with different
time resolutions. From the Dataport database [43] we observe
that, independently from the period considered, the average
user demand is less than 2 kWh for 80 − 90% of the time.
Current batteries charged at full capacity would then be able
to satisfy the demand for a few hours only.
In Table III we have also included information about the
amount of average power generated via a rooftop solar panel.
Locations, technology as well as inclinations and sizes of
panels vary, as shown in Table IV for one of the databases
considered, where kWp denotes the kilowatt peak, i.e., the
output power achieved by a panel under full solar radiation.
As expected, around 50% of time, i.e., at night, no energy is
generated at all, while there are differences in the distribution
of the average values for the two databases considered, due
to the different areas considered. If we compare these values
with those in Table I, we can see that the capacities of current

3

Table I
S PECIFICATIONS OF SOME CURRENTLY AVAILABLE RESIDENTIAL BATTERIES .
Residential Battery

Capacity (kWh)

Sunverge SIS-6848 [35]
SonnenBatterie eco [36]
Tesla Powerwall [37]
LG RESU 48V [38]
Panasonic Battery System LJ-SK84A [39]
Powervault G200-LI-2/4/6KWH [40]
Orison Panel [41]
Simpliphi PHI 3.4 - 48V [42]

7.7, 11.6, 15.5, 19.4
4 − 16
13.5
2.9, 5.9, 8.8
8
2, 4, 6
2.2
3.4

RB Charging
Peak Power (kW)
6.4
3−8
5
3, 4.2, 5
2
0.8, 1.2
1.8
1.5

RB Discharging
Peak Power (kW)
6
3−8
5
3, 4.2, 5
2
0.7, 1.4
1.8
1.5

Table II
D ISTRIBUTION OF AVERAGE HOUSEHOLD POWER CONSUMPTION ( RESOLUTION REFERS TO THE MEASUREMENT FREQUENCY ). VALUES IN EACH
COLUMN INDICATE THE PERCENTAGE OF TIME THE AVERAGE CONSUMPTION FALLS INTO THE CORRESPONDING INTERVAL .
Source

Location

Resolution

[43]

Texas

60 mins

[44]
[45]
[46]

UK
Netherlands
France

2 mins
1 sec
1 min

Time
01/01/2016
01/01/2015
01/01/2014
01/01/2013
01/01/2012
01/05/2010
05/07/2015
16/12/2006

Frame
- 31/05/2016
- 31/12/2015
- 31/12/2014
- 31/12/2013
- 31/12/2012
- 31/07/2011
- 05/12/2015
- 26/11/2010

# of Houses
512
703
720
419
182
251
1
1

[0, 0.5] kW
38
36
39
35
31
18
98
47

(0.5, 1] kW
30
26
25
25
26
24
1.8
9

(1, 2] kW
20
20
20
21
24
47
0.4
28

(2, 3] kW
7
9
8
9
10
11
0
8

(3, 4] kW
3
5
4
5
5
0
0
4

(4, +∞) kW
2
4
4
5
5
0
0
2

Table III
D ISTRIBUTION OF AVERAGE POWER GENERATED BY RESIDENTIAL PHOTOVOLTAIC SYSTEMS . VALUES IN EACH COLUMN INDICATE THE PERCENTAGE OF
TIME THE AVERAGE GENERATION FALLS INTO THE CORRESPONDING INTERVAL .
Source
[43]
[47]

Location
Texas
UK

Resolution
60 min
30 min

Time Frame
01/01/2012 - 31/05/2016
01/01/2015 - 31/12/2015

# of Houses
351
100

0 kW
49
51.7

(0, 0.5] kW
17
36.4

(0.5, 1] kW
7
9.8

(1, 2] kW
9
2

(2, 3] kW
7
0.1

(3, 4] kW
6
0

(4, +∞) kW
5
0

Table IV
S PECIFICATIONS OF THE SOLAR PANELS STUDIED IN [47]. T HE VALUES IN EACH COLUMN INDICATE THE PERCENTAGE OF SOLAR PANELS THAT SATISFY
THE CORRESPONDING PROPERTY.
(0, 15]
5

Solar Panel Area (m2 )
(15, 20]
(20, 25]
(25, 30]
35
44
15

(30, +∞)
1

Solar Panel Cell Type
Monocrystalline
Polycrystalline
93
7

batteries are sufficient to store many hours of average solar
energy generated by the solar panels most of the time, for
which the infinite battery assumption may be an accurate
model.
C. Main Contributions
The main contributions of this paper can be summarized as
follows:
1) We provide computable closed-form single-letter expressions for the minimum information leakage rate when
the battery capacity is zero and infinite. We provide
detailed proofs for these results, which have been stated
in [1] without proofs. These two asymptotic performance
results can also be considered as upper and lower
bounds on the achievable privacy performance for a
more practical SM system with a finite-capacity battery.
2) For these scenarios, we study the information leakage
rate also considering the availability of the RES information at the UP, which provides additional side
information to the UP.
3) For a finite-capacity battery scenario, we propose a
suboptimal parameterized energy management policy,

Nominal Installed Capacity (kWp)
(0, 2] (2, 3]
(3, 4]
(4, ∞)
4
36
59
1

and optimize the policy parameters using a policy search
technique that exploits stochastic gradient descent. We
show numerically that the performance of the proposed
energy management policy approaches the one with
an infinite battery even with a relatively small battery
size. This shows the efficacy of the proposed privacy
preservation scheme.
4) We show that the information leakage rate decreases
with the rate of the available RES, and that a larger
RB is needed to fully exploit the available energy to
improve the privacy.
The remainder of the paper is organized as follows. In
Section II the system model is introduced. In Section III an
ideal system with an infinite-capacity battery is studied, while
in Section IV another extreme case with no energy storage
is considered. For both scenarios, we also study the case in
which the UP knows the realizations of the renewable energy
process. In Section V we study the binary scenario, while in
Section VI we propose achievable schemes for the generic
finite battery capacity scenario, and present the corresponding
numerical results. In Section VII a continuous input load is
considered, while conclusions are drawn in Section VIII.

4

storage to isolate and understand the privacy benefits of RESs.
Hence, we impose
0 ≤ Yt ≤ Xt ,

∀t,

(1)

while Xt − Yt is the amount of energy obtained from the RB
in time slot t. The energy retrieved from the battery must be
smaller than the energy available in it, i.e.,
Xt − Yt ≤ Bt + Et ,

∀t.

(2)

We also consider a peak power constraint P̂ on the amount
of energy that can be requested at any time from the RB, i.e.,
Figure 1. System model. Xt , Yt , Et and Bt denote the consumer’s energy
demand, the SM readings, the energy produced by the RES, and the state of
the RB at time t, respectively. The dashed line represents the meter readings
being reported to the UP.

D. Notation
Random variables (RVs) are denoted by capital letters X, Y ,
their realizations by lower-case letters x, y, and the corresponding alphabets by calligraphic letters X , Y. The probability distribution of a RV X taking values in X is denoted
by pX . For integers 0 < a < b, Xab denotes the sequence
(Xa , Xa+1 , . . . , Xb ), while X b , X1b . All logarithms and
exponentials are in base 2, unless specified otherwise.
II. S YSTEM M ODEL
A discrete time system model is adopted as depicted in
Figure 1. Xt ∈ X is the total amount of power demanded
by a user in time slot t, where X = [0, . . . , Xmax ], while
Yt ∈ Y is the energy received from the UP at time t, where
Y = [0, . . . , Ymax ]. We call Xt as the input load and Yt as
the output load to simplify the terminology. For simplicity, we
assume that the entries of the input load sequence {Xt }∞
t=1
are i.i.d. with distribution pX . In time slot t, Et ∈ E units of
energy are generated from the RES, which becomes available
to the energy management unit (EMU) at the beginning of
time slot t. The entries of the renewable energy sequence
{Et }∞
t=1 are also i.i.d. with distribution pE and alphabet
E = [0, . . . , Emax ], while the average renewable energy rate
is denoted by P̄E , E[E]. We further consider the presence
of an RB in which the renewable energy can be stored for
future use. The state of charge (SOC) of the battery at time t
is Bt ∈ [0, . . . , Bmax ], and its capacity is Bmax . We assume
no losses in the battery charging and discharging processes.
The EMU always satisfies user’s energy demands by drawing energy from either the UP or the RB; that is, outages
or demand shifting are not allowed. As a consequence, we
have Xmax ≥ Ymax ≥ Xmax − Bmax . We do not allow
extra energy to be drawn from the grid and then wasted. This
could provide additional privacy, albeit at a significantly higher
energy cost. Also, the battery is exclusively for storing the
generated renewable energy, and it cannot be recharged with
grid energy. While storing grid energy in the battery to be
supplied later to the appliances can provide additional privacy
[23], here we limit the use of the battery to renewable energy

0 ≤ Xt − Yt ≤ P̂ ,

∀t,

(3)

and for the rest of the paper we assume that P̄E ≤ P̂ .
Given (Xt , Et , Bt ) = (xt , et , bt ) and the constraints (1),
(2), and (3), the set of feasible energy requests at time t is
o
n
Ȳ(xt , et , bt ) , yt ∈ Y : [xt −min{bt +et , P̂ }]+ ≤ yt ≤ xt ,
(4)
where [a]+ = a if a > 0, and 0 otherwise.
The battery update equation can be written as
o
n
(5)
Bt+1 = min Bt + Et − (Xt − Yt ), Bmax , ∀t.

We aim at designing energy management policies f =
(f1 , f2 , . . .) that decide on the amount of energy to request
from the UP at each time t, given the previous values of input
load X t , renewable energy E t , battery SOCs B t , and output
load Y t−1 , i.e.,
ft : X t × E t × B t × Y t−1 → Y,

∀t,

while satisfying (4) and (5), where f ∈ F and F denotes the
set of feasible policies, i.e., which produce output load values
that satisfy the RB and RES constraints at any time, as well
as the battery update equation.
We measure privacy via the information leakage rate, defined as the average mutual information rate between the actual
user energy consumption and the energy received from the
grid, which also corresponds to the reported SM data, i.e.,
1
I (X n ; Y n ) ,
(6)
n
where the subscript f denotes the specific energy management
policy employed, and the superscript i stresses the fact that
we are considering instantaneous power constraints. Thus, the
optimization problem can be written as the minimization of
(6) over all feasible policies f ∈ F , i.e.,
Ifi (Bmax , P̂ ) , lim

n→∞

I i (Bmax , P̂ ) , inf lim

f ∈F n→∞

1
I(X n ; Y n ).
n

(7)

A single-letter expression for the information leakage rate
is provided in [28]–[30] when the EMU is constrained only by
the average and peak power constraints. In general, because
of the memory effects introduced by the RB and the RES,
satisfying the input load from the RB or the RES at some time
period may come at the expense of revealing more information
about the energy consumption at future time periods. For this
reason, the information theoretic analysis typically focuses on
the average performance, measured over a period of n time

5

slots, and aims at understanding the fundamental performance
bounds by letting this time period go to infinity, i.e., n → ∞,
as in (6). However, the definition of the information leakage
rate in (6) involves n-length sequences X n and Y n , and
the asymptotic performance limit corresponds to an infinitedimensional optimization problem, which cannot be solved
numerically. On the contrary, characterizing a single-letter
expression allows the optimal solution to be to described as
an optimization problem in terms of the single-letter random
variables, which can be a finite-dimensional optimization
problem when the involved random variables are defined over
finite alphabets. Therefore, a single-letter characterization of
the information theoretic privacy is desirable to be able to
evaluate the minimum possible information leakage rate.
In [29] the privacy-power function I(P̄ , P̂ ) is defined as the
minimum information leakage rate that can be achieved when
the energy management
policy
 satisfies the average power
Pn
constraint E
t=1 (Xt −Yt ) ≤ P̄ , as well as the peak power
constraint 0 ≤ Xt − Yt ≤ P̂ , ∀t. The privacy-power function
has the single-letter characterization provided by the following
theorem.
Theorem 1. [29, Theorem 1] The privacy-power function
I(P̄ , P̂ ) for an i.i.d. input load vector X with distribution
pX (x) and output load vector Y , when the average and peak
values of the power provided by the RES are limited by P̄ and
P̂ , respectively, is given by
I(P̄ , P̂ ) =

inf

pY |X ∈P

I (X; Y ) ,

(8)

where P , {pY |X : y ∈ Y, E[(X − Y )] ≤ P̄ , 0 ≤ X − Y ≤
P̂ }.
Lemma 1. [29, Lemma 1] The privacy-power function
I(P̄ , P̂ ), given above, is a non-increasing convex function of
P̄ and P̂ .
It is shown in [30] that, when the input load alphabet is
discrete, i.e., X = {0, 1, . . . , Xmax }, the output load alphabet
Y, which is not necessarily discrete, can be restricted to the
input load alphabet, i.e., Y = X , without loss of optimality.
Given this restriction and the convexity of the privacy-power
function, I(P̄ , P̂ ) can be numerically evaluated, e.g., by the
efficient Blahut-Arimoto (BA) [48] algorithm. The following
lemma states that this property holds also in our setting for the
various battery capacities we analyze in the following. Thus, in
the discrete case, we can assume that all the involved random
processes are defined over finite alphabets and that there is a
minimum quantum of energy such that all the aforementioned
quantities are integer multiples of this quantum.
Lemma 2. If the input alphabet X is discrete, the output
alphabet Y can be constrained to the input alphabet without
loss of optimality.
Proof. The proof is similar to that of [30, Theorem 2]. Let
X be the discrete input load alphabet and let X(y) =
minx∈X {x ≥ y}. Then, for any given energy management
policy, and the resultant output load Y n , we define a new
output load as Ŷ (t) = X(Y (t)), that is, Ŷ is a post-processed

version of Y , and Ŷ = X . By construction, we have that
X(t) ≥ Ŷ (t) ≥ Y (t), ∀t, i.e., the power demanded by the
battery cannot have a larger peak value than the original
demanded power. Similarly, the new output load satisfies all
the instantaneous power constraints as well. This proves that
the policy is feasible. Also, the information leakage rate is
not increased as Ŷ is a deterministic function of Y , and thus
X − Y − Ŷ forms a Markov chain, and I(X, Y ) ≥ I(X, Ŷ )
by the data processing inequality.
Here we introduce a generic energy management policy,
which we later specialize to the different scenarios we consider. This is a stationary and memoryless policy that generates
Yt randomly using a conditional probability distribution that
is based only on the current input load Xt and the available
total renewable energy Bt + Et , i.e.,
p̃Y |X,B+E : X × (B + E) → Y.

(9)

Note that, in the presence of an RB, in which the generated
renewable energy is stored and used for privacy, a memoryless
energy management policy is suboptimal in general, as it
ignores the history. However, in the following we show that a
memoryless policy is able to achieve the minimum information
leakage rate in the two extreme scenarios of Bmax = ∞ and
Bmax = 0.
III. I NFINITE BATTERY C APACITY
In this section we relax the constraint on the battery capacity
and consider Bmax = ∞. This is an extreme situation that may
model a battery with a relatively large capacity compared to
the average generation rate of renewable energy, P̄E , and the
average input load. This scenario provides useful insights on
the best achievable privacy performance, and also serves as
a bound on the performance achievable with a finite-capacity
RB.
In each time slot, the EMU is limited by both the peak
power constraint (3) and the energy available in the RB, which
is the difference between the total renewable energy generated
and the total energy that has been requested from the battery
up to that time, i.e.,
n
X
t=1

(Xt − Yt ) ≤

n
X

Et ,

∀n.

(10)

t=1

A. Generated Renewable Energy not Known by the UP
In this section E n is treated as a random sequence whose
realization is known only to the consumer in a causal manner.
This scenario may occur if the renewable energy originates
from sources which could be extremely difficult, if not impossible, for the UP to track.
The following theorem states that the minimum information
leakage rate when Bmax = ∞ is equivalent to the average
and peak power-constrained scenario, as in [29]; that is, the
cumulative constraints on the EMU policy do not reduce the
achievable privacy if the battery capacity is sufficiently large.
Theorem 2. If Bmax = ∞ and the peak power constraint
on the amount of energy taken from the RB is P̂ , then the

6

Algorithm 1 Best-Effort Privacy Policy for Bmax = ∞.
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:

Initial battery SOC: B0 .
Find p∗Y |X that minimizes (8) for given P̄E and P̂ .
for t = 1, . . . , n do
Input: Xt , Bt , Et .
Generate Yt∗ according to p∗Y |X .
if Bt + Et ≥ Xt − Yt∗ then
Optimal policy is followed: Yt = Yt∗ and Xt − Yt∗
taken from the battery.
else
Full leakage occurs: Yt = Xt .
end if
Next battery state: Bt+1 = min{Bt + Et − (Xt −
Yt ), Bmax }.
end for

minimum information leakage rate for an i.i.d. input load
X and a renewable energy generation process with average
power P̄E , is
I i (∞, P̂ ) = I(P̄E , P̂ ).
(11)
i

I(P̄E , P̂ ) is a trivial lower bound on I (∞, P̂ ). In the
following section an energy management policy that achieves
I i (∞, P̂ ) is presented. The proposed policy is a specialization
of the generalized memoryless policy introduced in (9).
B. Optimal Energy Management Policy for Bmax = ∞
Consider the following energy management policy. In each
time slot t, the EMU, based on the instantaneous input load
Xt , decides on the optimal portion of the input load to be
received from the grid, Yt∗ , by using the optimal conditional
probability distribution p∗Y |X that minimizes (8). If there is
enough energy available to fully satisfy the EMU requests,
i.e., Bt + Et ≥ Xt − Yt∗ , the EMU uses Xt − Yt∗ units of
renewable energy and Yt∗ units of energy from the grid, i.e.,
Yt = Yt∗ ; otherwise, all the input load is satisfied directly
from the grid, i.e., Yt = Xt , thus leading to the maximum
information leakage for that time instant, i.e., the UP learns
Xt perfectly. The time instants at which such leakage occurs
cannot be computed beforehand, since they depend on the
realizations of the renewable energy process, input and output
loads. Given the nature of this policy, which tries to follow
the optimal policy generated by ignoring the current SOC, we
name it the best-effort energy management policy. Algorithm
1 summarizes this policy.
Equation (12), shown at the bottom of the page, specializes
policy (9) to the best-effort policy. The second case in (12)
includes all the instances for which p∗Y |X outputs either y ∗ =
x, or an infeasible output, i.e, for which x − y ∗ > b + e.
Since the energy arrival is stochastic, it may seem that
very little can be said about the information leakage rate.

However, if the condition E[X − Y ∗ ] < P̄E holds, then it
is possible to show that the number of times full leakage of
information occurs due to unavailability of energy is relatively
small compared to the operating time of the system. This is
proved in the following lemma.
Lemma 3. If E[X − Y ∗ ] < P̄E , and the EMU follows the
best-effort energy management policy, then almost surely the
condition Bt + Et < Xt − Yt∗ holds only in finitely many time
slots in the limit of infinite horizon.
Proof. Let E[X − Y ∗ ] = P̄E − ǫ, for some ǫ > 0. The
sequence E − (X − Y ∗ ) − ǫ has zero mean. By the strong
law of large numbers, the sample average of the sequence
converges almost
value, i.e., the sequence
Pn surely to its expected
∗
of events { n1 t=1
(E
−
(X
−
Y
)
−
ǫ) < −ǫ}∞
t
t
t
n=1 , and thus
Pn
1
∗
the sequence { n t=1 (Et − (Xt − Yt )) < 0}∞
n=1 occurs only
for finitely many times. This implies that, with Yt∗ generated
according to the best-effort policy, the unavailability of energy
at any time, Bt + Et < Xt − Yt∗ , occurs only for finitely many
times.
Lemma 4. If E[X −Y ∗ ] < P̄E , then the minimum information
leakage rate of the best-effort policy tends to I i (∞, P̂ ), as
n → ∞.
Proof. Divide the sequence of input and output loads according to the time instants in which a private SM operation is
achieved, i.e., the time instants the EMU can fully emulate
p∗Y |X , and time instants in which full leakage occurs. From
Lemma 3 we know that as n → ∞, there is only a finite
number of time instants, say m, in which the level of privacy
induced by p∗Y |X is not achieved, i.e., for which the condition
Bt + Et < Xt − Yt∗ holds, when Yt∗ is generated based on
p∗Y |X . We remind that the condition Xt − Yt∗ < P̂ always
holds. Then, we can write
i
1
1h
H(X n ) − H(X n |Y n )
(13a)
I(X n ; Y n ) =
n "
n
#
n
1 X
=
H(Xt ) − H(Xt |X t−1 , Y n )
(13b)
n t=1
" n
#
1 X
H(Xt ) − H(Xt |Yt )
(13c)
≥
n t=1
"
#
X
1 X
∗
I(Xt ; Yt = Yt ) +
=
I(Xt ; Yt = Xt ) (13d)
n
C
t∈T

t∈T

n−m i
m
n→∞
≥
I (∞, P̂ ) + H(X) −−−−→ I i (∞, P̂ ),
(13e)
n
n
where T is the set of instants when full leakage of information
takes place, i.e., for which Yt = Xt , and T C is the set of time
instants in which the output is generated through p∗Y |X , i.e.,
Yt = Yt∗ ; (13c) follows since conditioning reduces entropy;
(13e) follows since m is finite.


∗

pY |X (y|x), P
p̃Y |X,B+E (y|x, b + e) = p∗Y |X (y|x) + {y′ ∈Y:x−y′ >b+e} p∗Y |X (y ′ |x),


0,

if x − y ∗ ≤ b + e and y ∗ 6= x,
if y ∗ = x,
∗

if x − y > b + e.

(12)

7

C. Store-and-Hide Energy Management Policy
Here we provide an alternative energy management policy
in the case of an infinite-capacity battery. The store-and-hide
energy management policy consists of an initial storage phase,
during which all the energy requests of the user are satisfied
from the grid while all the generated renewable energy is
stored in the battery, and a second hiding phase, during which
the EMU deploys the optimal policy p∗Y |X .
More formally, consider n time slots. In the first s(n)
time slots, the so-called storage phase, no privacy is achieved
because we have Yt = Xt , for t = 1, 2, . . . , s(n). In the
remaining n − s(n) time slots, the so-called hiding phase,
user demand is satisfied by taking energy from both the grid
and the battery according to the optimal policy p∗Y |X . We
assume that s(n) = o(n), with limn→∞ s(n) = ∞, and
limn→∞ n − s(n) = ∞. The initial waiting time s(n) enables
the battery to store on average s(n)P̄E units of energy. In
the following lemma we show that the energy stored in the
initial storage phase is sufficient to let the EMU follow the
optimal energy management policy p∗Y |X during the hiding
phase, without energy outages almost surely. After s(n) units
of time, thanks to the energy already stored in the RB, the
system is able to overcome the uncertainty in the energy
arrival, and is able to adopt the optimal privacy-preserving
energy management policy for the remaining time.
Remark 1. It is noteworthy that no information about the
recharge process of the battery is required, and all the EMU
needs to know is the average power generated by the renewable energy process, P̄E .
Lemma 5. With a storage phase of length s(n) = o(n), where
limn→∞ s(n) = ∞, and limn→∞ n − s(n) = ∞, the storeand-hide policy satisfies the energy constraints in (10) almost
surely provided that E[X − Y ∗ ] < P̄E .
The proof can be found in Appendix A.
By means of Lemma 5 it is possible to show that the
minimum information leakage rate of the store-and-hide policy
approaches I i (∞, P̂ ) as n → ∞, as shown in the following
lemma, whose proof can be found in Appendix B.
Lemma 6. If E[X − Y ] < P̄E , then the information leakage
rate of the store-and-hide policy with s(n) as specified in
Lemma 5 approaches I i (∞, P̂ ) as n → ∞.
∗

Remark 2. Even though the two schemes described above
achieve the same privacy performance as n → ∞, they do
have some conceptual differences. During the initial phase of
energy saving, the store-and-hide policy satisfies all the user
demands from the grid leaking full information. Therefore,
the SM readings reveal user’s activity completely in this
period. While the impact of this on the information leakage
rate vanishes as n → ∞, this might not be preferable in
practice. Therefore, we believe that the best-effort policy is
more appropriate for practical applications.
D. Generated Renewable Energy Known by the UP
Here we assume that the UP knows the realization of the
renewable energy process E n , as highlighted in Figure 2.

Figure 2. The UP has perfect knowledge about the realizations of the
renewable energy generation process, in addition to the energy used from
the grid that is reported through the SM readings.

This scenario can occur if, for example, we consider solar
energy as the RES, and the UP can accurately estimate
the renewable energy produced from its own observations
in nearby locations, weather forecast of the area, and the
specifications of the solar panel. This is a worst-case situation
and we expect the amount of leaked information in this case
to be greater than or equal to that of the previous scenario, in
which only the EMU knows the current state of the renewable
energy produced. In this setting, the information leakage rate
is defined as
Ī i (∞, P̂ ) , inf lim

f ∈F n→∞

1
I(X n ; Y n |E n ).
n

(14)

The following theorem states that E n does not necessarily
provide more information to the UP compared to the scenario
where the UP does not have access to this information.
Theorem 3. If Bmax = ∞, the minimum information leakage
rates for the cases in which E n is either known or not known
to the UP are the same, i.e., Ī i (∞, P̂ ) = I i (∞, P̂ ).
Proof. We have the following chain of inequalities:
lim

1

n→∞ n

I(X n ; Y n |E n ) = lim

n→∞

1
I(X n ; Y n , E n )
n

1
[I(X n ; Y n ) + I(E n ; X n |Y n )]
n
1
≥ lim I(X n ; Y n ),
n→∞ n
= lim

n→∞

(15a)
(15b)
(15c)

where (15a) follows as X and E are independent from each
other, and (15c) is due to the non negativity of mutual
information. Thus, we have Ī i (∞, P̂ ) ≥ I i (∞, P̂ ).
The inequality in (15c) becomes an equality if
I(E n ; X n |Y n ) = 0. This condition can be achieved
by the store-and-hide policy. In fact, at the end of the
storage phase the battery is filled up with an infinite
amount of energy, and, as a consequence, the optimal
policy during the hiding phase p∗Y |X does not need to
take the information about the RES into account. This
implies that limn→∞ I(E n ; X n |Y n ) = 0; and therefore,
limn→∞ n1 I(X n ; Y n |E n ) = limn→∞ n1 I(X n ; Y n ), and that
Ī i (∞, P̂ ) = I i (∞, P̂ ).

8

IV. SM S YSTEM W ITHOUT E NERGY S TORAGE
In this section we focus on another extreme scenario in
which there is no RB for storing extra renewable energy, i.e.,
Bmax = 0. The renewable energy available at time slot t, Et ,
can be considered as an i.i.d. state information, and could be
known, or not, to the UP. Given Et and Xt , the EMU decides
on the amount of energy to use from the grid and from the
RES. In each time slot t = 1, . . . , n the energy that can be
obtained from the RES, Xt − Yt , is limited by the energy
generated in time slot t, Et , i.e., 0 ≤ Xt − Yt ≤ Et . Thus, this
is an SM system with a stochastic peak power constraint on the
energy that the EMU can obtain from the RES. Therefore, this
section can be considered as a generalization of [30], where
the authors consider a fixed peak power constraint.

Converse. We assume that there is an energy management
policy that satisfies the instantaneous peak power constraints,
i.e., xt − yt ≤ et , ∀t. Then, the information leakage rate
satisfies the following chain of inequalities:
1
1
I(X n ; Y n ) = [H(X n ) − H(X n |Y n )]
n
n
" n
#
n
X
1 X
t−1
n
H(Xt ) −
H(Xt |X , Y )
=
n t=1
t=1
" n
#
1 X
≥
H(Xt ) − H(Xt |Yt )
n t=1
n

=

(17a)
(17b)
(17c)

n

1X
1X i
I (Xt ; Yt ) ≥
I (0) = I i (0),
n t=1
n t=1

(17d)

Remark 3. We note that a peak power constraint other than
Et can be easily incorporated to the model, as this would
simply correspond to a new instantaneous power constraint
of Xt − Yt ≤ min{Et , P̂ }. Therefore, for the brevity of the
presentation we do not consider a peak power constraint in
this section.

where (17b) follows since X is i.i.d.; (17c) follows since
conditioning reduces entropy; and (17d) follows from the
definition of I i (0) in (16).

Note that, as opposed to the infinite-capacity battery scenario, here the past has no influence on the energy constraint,
since there is no battery, and thus, no memory, in the system.
To analyze this scenario, we first consider the minimum
information leakage rate when the generated renewable energy
is constant in every time slot, i.e., E = {e}, which is known
by both the EMU and the UP. The privacy-power function is
obtained by considering only a peak power constraint, which
can be obtained as a special case of Theorem 1.

Theorem 5. If Bmax = 0, the input load is i.i.d. with distribution pX , and the amount of generated renewable energy is also
known by the UP at each time t, then the optimal information
leakage rate Ī i (0) is given by

Lemma 7. If Bmax = 0 and E = {e}, the privacy-power
function for an i.i.d. input load X is given by I(e, e).
A. Generated Renewable Energy not Known by the UP
As in Section III-A, here the realization of the renewable
energy process is assumed to be known only by the EMU,
while the UP only knows the probability distribution pE .
Theorem 4. If Bmax = 0, and the renewable energy produced by the RES is i.i.d. with distribution pE , the optimal
information leakage rate, denoted by I i (0), is given by
I i (0) ,

I
Pinf
pY |X :pY |X = e∈E pY |X,E (y|x,e);
i
pY |X,E ∈P

(X; Y ) ,

(16)

where P i , {pY |X,E : pY |X,E (y|x, e) = 0 if y > x or y <
x − e}.
Proof. Achievability. We consider a conditional probability
distribution pY |X,E (y|x, e) that satisfies the conditions of
Theorem 4. At each time instant, for given xt and et , yt
is generated independently using the conditional distribution
pY |X,E (yt |Xt = xt , Et = et ). Since the input and output
load sequences are generated i.i.d. with the induced joint
distribution pX (x)pY |X (y|x), the information leakage rate is
given by I(X; Y ), whereas the instantaneous peak power
constraint is satisfied for all conditional distributions in P i .

B. Generated Renewable Energy Known by the UP
Here we assume the UP also knows the state Et , ∀t.

Ī i (0) =

inf

pY |X,E ∈P i

I (X; Y |E) = EE [I(E, E)],

(18)

where P i , {pY |X,E : pY |X,E (y|x, e) = 0 if y > x or y <
x − e}.
Proof: Achievability of (18) follows trivially by employing the optimal pY |X,E that minimizes (18) at each time slot.
To prove the converse, we show that any energy management
policy that satisfies the stochastic peak power constraint at
each time instant satisfies the following chain of inequalities:
1
I(X n ; Y n |E n )
n
1
= [H(X n |E n ) − H(X n |Y n , E n )]
(19a)
n"
#
n
1 X
=
H(Xt |X t−1 , E n ) − H(Xt |X t−1 , Y n , E n )
n t=1
(19b)
" n
#
X
1
H(Xt |Et ) − H(Xt |Yt , Et )
(19c)
≥
n t=1
n

|E|

1 XX
pE (E = ek )I (Xt ; Yt |Et = ek )
=
n t=1
≥

1
n

k=1
|E|
n X
X

pE (E = ek )I (ek , ek )

(19d)

(19e)

t=1 k=1
|E|

=

X

pE (E = ek )I (ek , ek ) = EE [I(E, E)] ,

(19f)

k=1

where (19c) follows because X and E are independent of each
other and across time, and conditioning reduces entropy; (19d)

9

follows by explicitly considering all the states of Et ; and (19e)
follows from Lemma 7.
From the chain rule of mutual information, we have
I(X; Y, E) = I(X; E) + I(X; Y |E) = I(X; Y |E), (20a)
I(X; Y, E) = I(X; Y ) + I(X; E|Y ),

(20b)

where (20a) follows since X and E are independent of each
other. From (20a) and (20b), we get I(X; Y ) ≤ I(X; Y |E).
Hence, from Theorems 4 and 5, we have I i (0) ≤ Ī i (0), as
expected.
V. B INARY S CENARIO
In order to provide further insights into the behavior of the
information leakage rate, here we consider a simple scenario
with binary energy demands, binary energy generation and
binary output load, i.e., X = E = Y = {0, 1}. This scenario
may represent appliances that are either on or off/standby.
X and E follow independent Bernoulli distributions with
Pr{X = 1} = qx and Pr{E = 1} = pe , respectively.
We compare the minimum information leakage rates for the
infinite and zero battery scenarios.
If Bmax = ∞, the minimum information leakage rate can
be characterized explicitly as
I i (∞, 1) = I(pe , 1) =


pe log pe − qx log qx
−(1 − qx + pe ) × log(1 − qx + pe ), if pe ≤ qx ,


0,
otherwise,

(21)

where we set the peak power constraint to P̂ = 1.
When Bmax = 0, there are two scenarios. If the generated
renewable energy is known only by the EMU, the minimum
information leakage rate for this scenario is given by
I i (0; pe , pv , qx ) = h(1 − qx + qx pe pv ) − qx h(pe pv ), (22)
where h(·) is the binary entropy function defined as h(p) ,
−p log p − (1 − p) log(1 − p), qx is fixed, and pv is the probability of using the energy available in the battery whenever
X = 1 and E = 1.
Proposition 1. For every pe and qx , the information leakage
rate I i (0; pe , pv , qx ) is minimized with pv = 1.
i

(0,pv )
≤
Proof: The proof follows from observing that dI dp
v
0, ∀pe , qx . Thus, the minimum of I i (0; pe , pv , qx ) is reached
when pv takes its maximum value, i.e., pv = 1.
When Et is known also by the UP, if the peak power
constraint is e = 1, no information is leaked, whereas if e = 0,
the input load is known perfectly by the UP, leading to a
leakage of H(X). Hence, the minimum information leakage
rate when the state information is known by the UP is

Ī i (0; pe , qx ) = (1 − pe )h(qx ).

(23)

Numerical comparison of the information leakage rate for
zero and infinite battery capacities in the binary scenario will
be presented in the next section together with the results
corresponding to a finite battery capacity.

Figure 3. Finite state diagram for the evolution of the battery with B =
{0, 1, . . . Bmax } and X = E = Y = {0, 1} for the battery-independent
policy. The 4-tuple (x, e, v, y) represent for every time t the values of the
input load, the renewable energy produced, the energy taken out of the battery
by the EMU, and the output load, respectively.

VI. F INITE BATTERY C APACITY
A closed-form expression for the finite-capacity battery
scenario is elusive as the presence of a finite battery brings
memory into the system, and the future energy usage depends
on how much renewable energy has been generated in the
previous time slots, how much of that energy has already been
used by the EMU, and how much is available in the RB.
Instead, we propose a low-complexity energy management
policy and compare it to the two previous scenarios, which
represent upper and lower bounds on the system performance
for the finite battery scenario.
A. Binary Alphabet: X = E = Y = {0, 1}
In this setting X, E and Y have binary alphabets and we
consider a discrete-time system, modeled via a finite state
machine. As in Section V, we set Pr{X = 1} = qx and
Pr{E = 1} = pe , while V n , X n − Y n represents the
energy taken by the EMU from the battery, with V = {0, 1}.
1) Battery-independent Policy: Here we consider a timeinvariant policy according to which the evolution of the battery
state can be modeled as the Markov chain of Figure 3, where
the 4-tuples (x, e, v, y) represent the realization at time t of the
input load X, the renewable energy E, the energy taken from
the battery by the EMU V , and the output load Y , respectively.
At every time, the RB can be charged, discharged or remain
in the current SOC, depending on the transition probabilities.
We note that a similar model has been adopted in [24], with
the difference that in [24] the RB can also store energy from
the grid. We define pv as the probability that the energy is
taken from the battery provided that the user is asking for
energy and that there is energy available for use, i.e., pv ,
Pr{V = 1 X = 1, E + B ≥ 1}. Since the value of pv does
not change according to the current battery state, we name
this policy battery-independent policy. Table V lists all the
possible states and transition probabilities for this scenario.
In particular, the table shows for each transition from Bt to
Bt+1 and each combination of the tuple (Xt , Et , Vt , Yt ) the
corresponding transition probability.
To compute the information leakage rate, all the distributions are considered to be Bernoulli. For Bmax = ∞ and
Bmax = 0 we use the single-letter expressions derived in
Section V, and set P̂ = 1 for Bmax = ∞. For a finite-capacity
battery, we implement the achievable scheme described above,

10

Table V
T UPLES AND TRANSITION PROBABILITIES FOR THE
BATTERY- INDEPENDENT POLICY WHEN X = E = Y = {0, 1}.
Bt

Bt = 0

0 < Bt ≤ Bmax

Xt
0
0
1
1
1
0
0
1
1
1
1

Et
0
1
0
1
1
0
1
0
0
1
1

Vt
0
0
0
0
1
0
0
0
1
0
1

Yt
0
0
1
1
0
0
0
1
0
1
0

Bt+1
0
1
0
1
0
Bt
min{Bt + 1, Bmax }
Bt
Bt − 1
min{Bt + 1, Bmax }
Bt

Transition Probability
(1 − qx )(1 − pe )
(1 − qx )pe
qx (1 − pe )
qx pe (1 − pv )
qx pe pv
(1 − qx )(1 − pe )
(1 − qx )pe
qx (1 − pe )(1 − pv )
qx (1 − pe )pv
qx pe (1 − pv )
qx pe pv

Figure 5. Minimum information leakage with respect to the renewable
energy generation rate pe with X = E = Y = {0, 1} for the batteryconditioned policy. As Bmax increases, the performance rapidly approaches
that of Bmax = ∞ and P̂ = 1.

Figure 4. Optimal pv for the binary scenario and various battery capacities,
when qx = 0.5.

and by means of the algorithm in [49] we simulate the system
for very long sequences and evaluate the information leakage
between the input and the output loads numerically and for
different battery capacities. Moreover, for each pe , we find the
value of pv that achieves the minimum information leakage
rate by searching over a discretized set of pv values. As
an example, Figure 4 represents the optimal pv values for
each pe , when the input load is uniformly distributed and
Bmax = {1, 2, 5, 10}. In the figure, pe = 0 is not represented
because, regardless of pv , the leakage when pe = 0 is always
equal to the entropy of the input load. Also, the figure shows
that for higher pe values, the minimum leakage is achieved
for pv = 1, i.e., it is better to always use the energy when
available.
2) Battery-conditioned Policy: Here we consider a policy,
in which pv , as defined before, can differ for different battery
SOCs, i.e., the policy is characterized by a specific pvi for
each battery SOC Bt = i, for i = {0, . . . , Bmax }. Thus, we
now have the vector
p̄v = [pv0 , pv1 , . . . , pvBmax ].

(24)

To find the optimal p̄v for each pe and Bmax we deploy
a stochastic gradient descent algorithm, specifically we use
the least square-based finite difference method to approximate
the gradient [50]. Briefly, the algorithm works as follows. At
any step, small perturbations are applied to each pvi according
to a uniform distribution over a predefined interval, and the
leakage corresponding to the resulting perturbed vector p̄v is

computed. The gradient of the leakage function can thus be
approximated numerically by employing the leakage corresponding to a number of different perturbations. A new p̄v is
finally computed using the gradient estimate and a predefined
learning rate, and its corresponding leakage is determined and
compared with that of the previous step. If the difference
between the two leakage rates is below a certain threshold, the
algorithm stops. Otherwise, the algorithm keeps on iterating.
Figure 5 shows the information leakage rate with respect to
the renewable energy generation rate pe , for different battery
capacities. For Bmax = {1, 2, 5, 10}, we adopt the batteryconditioned policy, which has only a small gain with respect
to the battery-independent policy. In particular, this gain is
focused around smaller pe values. As expected, the least information leakage rate is achieved when Bmax = ∞ and P̂ = 1,
while the maximum leakage occurs when Bmax = 0 and the
UP knows the renewable energy process realizations. When
Bmax = 0 the information leakage rate reduces significantly
if the state is not known by the UP and, more interestingly,
we observe that the performance of the proposed suboptimal
memoryless scheme approaches that of the infinite-capacity
battery with relatively small battery sizes. In addition, we can
see that the gain from the battery is much higher when the
renewable generation rate is higher, i.e., when pe is high. This
is expected because when pe is low, there is less energy to be
stored for future time slots.

B. Larger Alphabets: |X | = |Y| = |E| > 2
Here we consider larger alphabets for X, E and Y . As
the alphabet sizes grow, so does the complexity of searching
for the optimal policy. Instead, we consider the following
suboptimal policy. At each time instant, the policy chooses

11

absence of an RES [23], [26], or jointly with an RES [52]. The
additional privacy benefits of allowing charging of the RB from
the grid will depend on the battery capacity. When Bmax = ∞,
perfect privacy can be achieved by charging the battery
initially, and using the battery throughout the operation. In the
other extreme scenario, that is, when Bmax = 0, obviously it
is not possible to charge a non-existent battery from the grid.
We leave a more detailed study of a finite-capacity storage
device that can be charged by both the RES and the grid as
a future work.
VII. C ONTINUOUS I NPUT L OADS

Figure 6. Minimum information leakage with respect to the renewable energy
generation rate pe with X = E = Y = {0, 1, 2, 3, 4}. The leakage for
Bmax = ∞ has been found by setting P̂ = 4.

among using all of the available energy, half of it, or no energy
at all and we model the probability pv as in the following:


(p1 , p4 ), if Bt + Et < Xt ,
pv (Bt + Et , Xt ) = (p2 , p5 ), if Bt + Et = Xt ,
(25)


(p3 , p6 ), if Bt + Et > Xt .

The probability pairs in (25) refer to the probability of using
all the available energy and the probability of using half of
it. Therefore, we have 0 ≤ pi ≤ 1, for i = 1, . . . , 6, and
pi + pi+3 ≤ 1, for i = 1, 2, 3. For example, if Bt + Et <
Xt , all of the available energy is used with probability p1 ,
half of it, or the nearest integer value lower than that, is used
with probability p4 , and none of it is used with probability
1 − p1 − p4 .
Figure 6 shows the results for the scenario for |X | =
|E| = |Y| = 5 when Bmax = {0, 1, 2, ∞}. The input
load is uniformly distributed over the alphabet X , while the
renewable energy generation follows a binomial distribution
with parameters |X | and pe . The information leakage rate for
the infinite and zero battery scenarios is computed by using
the single-letter expressions which are evaluated by efficient
numerical algorithms, specifically the BA algorithm [48] and
the CVX package [51]. In particular, for Bmax = ∞ we
set P̂ = Xmax . For the finite battery scenario, we adopt the
aforementioned policy and optimize the performance by trying
different combinations of the probabilities pi , 1 ≤ i ≤ 6.
Similar considerations to that of Figure 5 can be drawn for
Figure 6 as well.
Remark 4. We remark here that, in order to isolate the privacy
benefits of RESs, we do not allow charging the battery directly
from the grid, which can potentially reduce the information
leakage. It is known that modulating grid energy intake by
employing a storage device provides privacy even in the

In the simulation results presented above, we have considered discrete alphabets for all the involved random variables.
A set of fixed discrete values for the energy demands may not
be an accurate model for all the appliances in the real world.
However, as discussed in Section II, such hypothesis enables
to constrain the output alphabet to the input alphabet without
loss of optimality and to apply efficient algorithms to find the
minimum amount of information leakage.
For continuous input loads, the optimal alphabet is also
continuous. Thus, low-complexity numerical algorithms, such
as the BA algorithm, cannot be applied. However, one can
provide a lower bound on the privacy-power function by using
the Shannon lower bound (SLB) [53], [54], which has been
introduced by Shannon, and widely used in the literature
to provide a computable lower bound to the rate-distortion
function. Although it is not always a tight bound, it is shown
in [30] that the SLB provides a tight bound for the information
leakage rate for an exponentially distributed input load. The
SLB for the rate distortion function R(D) is defined as
H(X) − φ(D) where φ(D) = maxp:Pm
H(p). The
i=1 pi di ≤D
truncated exponential distribution maximises the entropy for a
given mean value P̄ and a peak power constraint 0 ≤ X ≤ P̂
[53] and has the form [29]
(
x
1 − λ1
, if 0 ≤ x ≤ P̂ ,
e
λ
0
(26)
fX (x) =
0,
otherwise,
where λ0 ≥ 0 and λ1 ≥ 0 are chosen to satisfy the constraints
on the moments. Thus, the SLB for the privacy-power function
introduced in Theorem 1 is given by


1
P̄
ISLB (P̄ , P̂ ) = h(X) −
log(λ0 ) +
.
(27)
ln 2
λ1
Authors in [29] show that the SLB is indeed achievable for
peak and average power constraints, by finding the conditional
distribution fY |X (y|x) that satisfies the SLB with equality,
provided that the energy coming from the battery X − Y is
distributed according to a truncated exponential distribution
with mean P̄ and peak P̂ .
Authors in [30] provide the SLB for the average power
constraint, which, as we have shown, is equivalent to the
infinite-capacity battery scenario.
A. No Battery - Renewable Energy not Known by the UP
Here only a peak power constraint is considered, i.e.,
X − Y is constrained by 0 ≤ X − Y ≤ P̂ . The distribution

12

that maximises the entropy over an interval is the uniform
distribution
(
1
, if 0 ≤ x ≤ P̂ ,
fX (x) = P̂
(28)
0, otherwise.
For a fixed P̂ , the differential entropy of this distribution is
log(P̂ ). Then, the SLB in the case of zero capacity battery is
ISLB (P̂ ) = h(X) − log(P̂ ),

(29)

where P̂ is a RV with a certain known distribution.

Figure 7. The battery SOC evolution is represented by a random walk that
starts at the beginning of the hiding phase and has a drift towards the positive
direction of the battery SOC axis. We want to guarantee that the threshold α
is never crossed by the random walk.

B. No Battery - Renewable Energy Known by the UP
As in the previous scenario, only peak power constraints are
considered and thus the entropy maximising distribution is still
the uniform distribution (28). The privacy-power function is
given by the expected value over the distribution of the states
of the privacy-power function related to every state. Hence,
the SLB is
ISLB (P̂ ) = EP̂ [h(X) − log(P̂ )].

(30)

VIII. C ONCLUSIONS
We have studied information leakage in an SM system by
considering an RES along with an RB. For infinite and zero
battery capacities, we have provided single-letter information
theoretic expressions for the minimum information leakage
rate, which can be efficiently evaluated when the input load
has a discrete alphabet. For these scenarios, we have also
studied the information leakage rate when the UP knows the
exact amount of renewable energy generated in each time slot.
In addition, for the finite-capacity battery scenario, we have
proposed a suboptimal low-complexity energy management
policy, and evaluated the corresponding privacy performance
using a stochastic gradient descent algorithm. Our results show
that the privacy achieved by the proposed low-complexity
policy approaches the theoretical lower bound obtained by
assuming an infinite-capacity battery with a relatively small
battery capacity, especially when the generation rate of the
RES is low or high.
A PPENDIX A
P ROOF OF L EMMA 5
Proof. During the hiding phase, the random variable Q = E −
X +Y ∗ is i.i.d., as E and X are i.i.d and Y ∗ is generated from
X through a memoryless policy. Q can assume both positive
and negative values with positive probability. The stochastic
process
St = Q1 + Q2 + . . . Qt , ∀t,
(31)
is a random walk based on Q that moves along the battery
SOC axis. Since by hypothesis E[E] = P̄E > E[X − Y ∗ ],
then E[Q] = E[E − X + Y ∗ ] > 0, meaning that the random
walk St has a positive drift, i.e., as t → ∞, St drift towards
the positive values of the SOC axis.
By the law of large numbers, when s(n) → ∞ the amount
of energy stored in the battery at the end of the storage phase
is s(n)P̄E , almost surely. Let α , −s(n)P̄E . When s(n) →

∞, α → −∞. At s(n) + 1, when the hiding phase begins,
the energy in the battery is used according to the optimal
privacy-preserving policy p∗Y |X and the random walk state is
S1 = Q1 = E1 − X1 + Y1∗ . For any t, s(n)P̄E + St represents
the battery SOC at time t. Our objective is to prove that the
battery is never emptied, i.e., that the probability of crossing
the threshold α for any time t is zero:
Pr{St ≤ α} = 0,

∀t.

(32)

This scenario is represented in Figure 7. We recall a
corollary of Wald’s Identity [55, Chapter 7.5, Corollary 2],
which is applied to find exponential bounds on the probability
of threshold crossing. In particular, the corollary states that if
we consider Q as having a finite moment-generating function
γ(r) = ln{E[exp(rQ)]} over an interval (r− , r+ ), a negative
drift E[Q] < 0 and r∗ being the positive root of γ(r), then the
probability of crossing threshold α > 0 by the random walk
St = Q1 + Q2 + . . . + Qt is
Pr{Sτ ≥ α} ≤ exp(−r∗ α),

(33)

where τ is the minimum t for which the threshold α is crossed.
Having a finite moment generating function means that Q must
have moments of all orders and the tails of its distribution
function must decay at least exponentially in q as q → ∞
and q → −∞. In our specific setting, E[Q] > 0, α < 0,
and r∗ < 0. We can still apply Wald’s identity by changing
the signs of r∗ and α and by considering the probability of
crossing a negative threshold. Thus, we have
Pr{Sτ ≤ α} ≤ exp(−r∗ α),

(34)

where α < 0 and r∗ < 0. When limn→∞ n − s(n) = ∞ and
limn→∞ s(n) = ∞, α → −∞ and exp(−r∗ α) → 0. Thus,
we obtain
lim Pr{Sτ ≤ α} = 0.
(35)
n→∞

A PPENDIX B
P ROOF OF L EMMA 6
Proof. Split the sequence of input and output symbols into
the storage and hiding phases of duration s(n) and n − s(n),

13

respectively and let s(n) = o(n). Then, it is possible to write
#
" n
1 X
1
i−1
i−1
n
n
n
H(Xi |X ) − H(Xi |X , Y )
I(X ; Y ) =
n
n i=1

(36a)

≥

1
n

"

n
X

i=1
" s(n)

H(Xi ) − H(Xi |Yi ),

#

(36b)

#
n
X
1 X
I(Xi ; Yi )
(36c)
I(Xi ; Yi ) +
=
n i=1
i=s(n)+1
o
1n
=
s(n)H(X) + [n − s(n)]I i (∞, P̂ )
(36d)
n
s(n)H(X) [n − s(n)]I i (∞, P̂ )
=
+
,
(36e)
n
n
where (36b) follows because X is i.i.d. and conditioning
reduces entropy; (36d) follows since in the first s(n) time
instants leakage of full information H(X) takes place, while
in the following n−s(n) time slots private operation is assured
via the optimal strategy of Theorem 2.
If we take the limit n → ∞, since s(n) = o(n) and H(X)
is finite, we obtain the leakage rate
lim

n→∞

n − s(n) i
s(n)
H(X) +
I (∞, P̂ ) = I i (∞, P̂ ). (37)
n
n

R EFERENCES
[1] G. Giaconi, D. Gündüz, and H. V. Poor, “Smart meter privacy with an
energy harvesting device and instantaneous power constraints,” in Proc.
IEEE Int. Conf. on Commun., London, UK, Jun. 2015, pp. 7216–7221.
[2] Y. Mo, T.-H. Kim, K. Brancik, D. Dickinson, H. Lee, A. Perrig, and
B. Sinopoli, “Cyber-physical security of a smart grid infrastructure,”
Proc. IEEE, vol. 100, no. 1, pp. 195–209, Jan. 2012.
[3] Smart Energy GB. Using a smart meter. [Online]. Available:
https://www.smartenergygb.org/en/faqs?category=using-a-smart-meter
[4] Smart
Meter
Texas.
About
us.
[Online].
Available: https://www.smartmetertexas.com/CAP/public/home/home about
us.html
[5] M.
S.
R.
Segovia.
(2011)
Set
of
common
functional requirements of the smart meter”. [Online]. Available:
https://ec.europa.eu/energy/sites/ener/files/documents/2011 10
smart meter funtionalities report.pdf
[6] European Union, “Directive 2009/72/EC of the European parliament and
of the council of 13 July 2009 concerning common rules for the internal
market in electricity and repealing directive 2003/54/EC,” Official J.
European Union, vol. 52, no. L211, p. 55–93, Aug. 2009.
[7] I. Rouf, H. Mustafa, M. Xu, W. Xu, R. Miller, and M. Gruteser,
“Neighborhood watch: Security and privacy analysis of automatic meter
reading systems,” in Proc. ACM Conf. on Comput. and Commun.
Security, Raleigh, NC, USA, Oct. 2012, pp. 462–473.
[8] G. Hart, “Nonintrusive appliance load monitoring,” Proc. IEEE, vol. 80,
no. 12, pp. 1870–1891, Dec. 1992.
[9] A. Molina-Markham, P. Shenoy, K. Fu, E. Cecchet, and D. Irwin,
“Private memoirs of a smart meter,” in Proc. ACM Workshop on
Embedded Sensing Systems for Energy-Efficiency in Building, Zurich,
Switzerland, Nov. 2010, pp. 61–66.
[10] K. Shaloudegi, A. György, C. Szepesvári, and W. Xu, “SDP relaxation
with randomized rounding for energy disaggregation,” arXiv:1610.09491
[cs.LG], Oct. 2016.
[11] Y. Kim, E. Ngai, and M. Srivastava, “Cooperative state estimation for
preserving privacy of user behaviors in smart grid,” in Proc. IEEE Int.
Conf. on Smart Grid Commun., Brussels, Belgium, Oct. 2011, pp. 178–
183.
[12] J.-M. Bohli, C. Sorge, and O. Ugus, “A privacy model for smart
metering,” in Proc. IEEE Int. Conf. on Commun., Cape Town, South
Africa, May 2010, pp. 1–5.

[13] C. Dwork, “Differential privacy,” in Proc. Int. Colloquium Automata,
Languages and Programming, Venice, Italy, Jul. 2006, pp. 1–12.
[14] M. Backes and S. Meiser, “Differentially private smart metering with
battery recharging,” in Proc. Int. Workshop Data Privacy Management
and Autonomous Spontaneous Security, Egham, UK, Sep. 2014, pp.
194–212.
[15] L. Sankar, S. Rajagopalan, S. Mohajer, and H. V. Poor, “Smart meter
privacy: A theoretical framework,” IEEE Trans. Smart Grid, vol. 4, no. 2,
pp. 837–846, Jun. 2013.
[16] F. D. Garcia and B. Jacobs, “Privacy-friendly energy-metering via
homomorphic encryption,” in Proc. Int. Conf. on Security and Trust
Manage., Athens, Greece, Sep. 2010, pp. 226–238.
[17] F. Li, B. Luo, and P. Liu, “Secure and privacy-preserving information
aggregation for smart grids,” Int. J. of Security and Networks, vol. 6,
no. 1, pp. 28–39, Apr. 2011.
[18] R. Petrlic, “A privacy-preserving concept for smart grids,” in Proc.
Sicherheit in vernetzten Systemen:18. DFN Workshop, 2010, p. B1–B14.
[19] C. Efthymiou and G. Kalogridis, “Smart grid privacy via anonymization
of smart metering data,” in Proc. IEEE Int. Conf. on Smart Grid
Commun., Gaithersburg, MD, USA, Oct. 2010, pp. 238–243.
[20] G. Kalogridis, C. Efthymiou, S. Denic, T. Lewis, and R. Cepeda, “Privacy for smart meters: Towards undetectable appliance load signatures,”
in Proc. IEEE Int. Conf. on Smart Grid Commun., Gaithersburg, MD,
USA, Oct. 2010, pp. 232–237.
[21] G. Kalogridis, Z. Fan, and S. Basutkar, “Affordable privacy for home
smart meters,” in Proc. IEEE Int. Symp. on Parallel and Distributed
Process. with Applicat. Workshops, Busan, Korea, May 2011, pp. 77–
84.
[22] W. Yang, N. Li, Y. Qi, W. Qardaji, S. McLaughlin, and P. McDaniel,
“Minimizing private data disclosures in the smart grid,” in Proc. ACM
Conf. on Comput. and Commun. Security, Raleigh, NC, USA, Oct. 2012,
pp. 415–427.
[23] D. Varodayan and A. Khisti, “Smart meter privacy using a rechargeable
battery: Minimizing the rate of information leakage,” in Proc. IEEE Int.
Conf. on Acoust., Speech and Signal Process., Prague, Czech Republic,
May 2011, pp. 1932–1935.
[24] O. Tan, D. Gündüz, and H. V. Poor, “Increasing smart meter privacy
through energy harvesting and storage devices,” IEEE J. Sel. Areas
Commun., vol. 31, no. 7, pp. 1331–1341, Jul. 2013.
[25] O. Tan, J. Gómez-Vilardebó, and D. Gündüz, “Privacy-cost trade-offs
in demand-side management with storage,” IEEE Trans. Inf. Forens.
Security, vol. 12, no. 6, pp. 1458–1469, June 2017.
[26] S. Li, A. Khisti, and A. Mahajan, “Privacy-optimal strategies for
smart metering systems with a rechargeable battery,” arXiv:1510.07170
[cs.IT], Aug. 2016.
[27] F. Farokhi and H. Sandberg, “Fisher information as a measure of privacy:
Preserving privacy of households with smart meters using batteries,”
IEEE Trans. on Smart Grid, Feb. 2017.
[28] D. Gündüz and J. Gómez-Vilardebó, “Smart meter privacy in the
presence of an alternative energy source,” in Proc. IEEE Int. Conf. on
Commun., Budapest, Hungary, Jun. 2013, pp. 2027–2031.
[29] J. Gómez-Vilardebó and D. Gündüz, “Privacy of smart meter systems
with an alternative energy source,” in Proc. IEEE Int. Symp. on Inform.
Theory, Istanbul, Turkey, Jul. 2013, pp. 2572–2576.
[30] J. Gómez-Vilardebó and D. Gündüz, “Smart meter privacy for multiple
users in the presence of an alternative energy source,” IEEE Trans. Inf.
Forens. Security, vol. 10, no. 1, pp. 132–141, Jan. 2015.
[31] J.-X. Chin, T. T. D. Rubira, and G. Hug, “Privacy-protecting energy management unit through model-distribution predictive control,” accepted to
IEEE Trans. on Smart Grid, May 2017.
[32] K. Chatzikokolakis, C. Palamidessi, and P. Panangaden, “Anonymity
protocols as noisy channels,” Information and Computation, vol. 206,
no. 2, pp. 378 – 401, 2008.
[33] B. Köpf and D. Basin, “An information-theoretic model for adaptive
side-channel attacks,” in Proc. ACM Conf. on Computer and Commun.
Security, Alexandria, VA, USA, Oct. 2007, pp. 286–296.
[34] D. Clark, S. Hunt, and P. Malacaria, “Quantitative analysis of the leakage
of confidential data,” Electronic Notes in Theoretical Computer Science,
vol. 59, no. 3, pp. 238 – 251, 2002.
[35] Sunverge.
[Online].
Available:
http://www.sunverge.com/energy-management/
[36] SonnenBatterie.
[Online].
Available:
https://sonnen-batterie.com/en-us/sonnenbatterie
[37] Tesla
Powerwall
2.
[Online].
Available:
https://www.tesla.com/powerwall
[38] LG
Chem
ESS
battery.
[Online].
Available:
http://www.lgchem.com/global/ess/ess/product-detail-PDEC0001

14

[39] “Panasonic residential storage battery system LJ-SK84A,”
http://www.panasonic.com/au/support/product-archives/energysolutions/residential-storage-battery-system/lj-sk84a.html.
[40] Powervault.
[Online].
Available:
http://www.powervault.co.uk/technical/technical-specifications/
[41] Orison battery. [Online]. Available: http://orison.energy/
[42] Simpliphi Power PHI3.4 Smart-Tech Battery. [Online]. Available:
http://simpliphipower.com/product/phi3-4-smart-tech-battery/
[43] Pecan
Street
Inc.
Dataport
2016.
[Online].
Available:
https://dataport.cloud/
[44] Intertek Testing & Certification Ltd. Household electricity
survey, a study of domestic electrical product usage. [Online].
Available: http://randd.defra.gov.uk/Document.aspx?Document=10043
R66141HouseholdElectricitySurveyFinalReportissue4.pdf
[45] S. Akshay. DRED (Dutch Residential Energy Dataset). [Online].
Available: http://www.st.ewi.tudelft.nl/%7Eakshay/dred/
[46] M. Lichman, “UCI machine learning repository,” 2013. [Online].
Available: http://archive.ics.uci.edu/ml
[47] The University of Sheffield - Sheffield Solar. Microgen database.
[Online]. Available: http://www.microgen-database.org.uk/
[48] R. Blahut, “Computation of channel capacity and rate-distortion functions,” IEEE Trans. Inf. Theory, vol. 18, no. 4, pp. 460–473, Jul. 1972.
[49] D.-M. Arnold, H.-A. Loeliger, P. Vontobel, A. Kavcic, and W. Zeng,
“Simulation-based computation of information rates for channels with
memory,” IEEE Trans. Inf. Theory, vol. 52, no. 8, pp. 3498–3508, Aug
2006.
[50] M. P. Deisenroth, G. Neumann, and J. Peters, “A survey on policy search
for robotics,” Foundations and Trends in Robotics, vol. 2, pp. 1–142,
Aug. 2013.
[51] M. Grant and S. Boyd, “CVX: Matlab software for disciplined
convex programming, version 2.1,” Mar. 2014. [Online]. Available:
http://cvxr.com/cvx
[52] G. Giaconi and D. Gündüz, “Smart meter privacy with renewable energy
and a finite capacity battery,” in Proc. IEEE Int. Workshop on Signal
Process. Advances in Wireless Commun., Edinburgh, UK, Jul. 2016.
[53] T. M. Cover and J. A. Thomas, Elements of Information Theory. New
York, NY, USA: Wiley-Interscience, 1991.
[54] T. Berger, Rate Distortion Theory: A Mathematical Basis for Data
Compression. Englewood Cliffs, NJ: Prentice-Hall, 1971.
[55] R. G. Gallager, Discrete Stochastic Processes. Springer US, 1996.

Giulio Giaconi (S’15) received the B.Sc. and M.Sc.
degrees (Hons.) in communication engineering from
the Sapienza University of Rome, Italy, in 2011
and 2013, respectively. He is currently pursuing
the Ph.D. degree with the Department of Electrical and Electronic Engineering, Imperial College
London, U.K. In 2013, he was a Visiting Student
with Imperial College London, working on indoor
localization via visible light communications. His
current research interests include data privacy, information and communication theory, optimization,
signal processing, and machine learning. In 2014, he received the Excellent
Graduate Student Award of the Sapienza University of Rome.

Deniz Gündüz (S’03-M’08-SM’13) received the
B.S. degree in electrical and electronics engineering
from METU, Turkey in 2002, and the M.S. and
Ph.D. degrees in electrical engineering from the
NYU Polytechnic School of Engineering in 2004
and 2007, respectively. He served as a Post-Doctoral
Research Associate with Princeton University, and a
Consulting Assistant Professor with Stanford University. He was a Research Associate with CTTC,
Barcelona, Spain, until 2012, when he joined the
Electrical and Electronic Engineering Department,
Imperial College London, U.K., where he is currently a Reader in information
theory and communications.
His research interests include the areas of communications and information theory with special emphasis on multi-user communication networks,
multimedia content delivery, energy efficient communications and privacy
in cyber-physical systems. He was a recipient of a Starting Grant of the
European Research Council in 2016, the IEEE Communications Society Best
Young Researcher Award for the Europe, Middle East, and Africa Region in
2014, the Best Paper Award at the 2016 IEEE Wireless Communications and
Networking Conference, and the Best Student Paper Award at the 2007 IEEE
International Symposium on Information Theory. He is the General Co-chair
of the 2018 Workshop on Smart Antennas. He served as the General Cochair of the 2016 IEEE Information Theory Workshop, and a Co-chair of the
PHY and Fundamentals Track of the 2017 IEEE Wireless Communications
and Networking Conference. He is an Editor of the IEEE TRANSACTIONS
ON COMMUNICATIONS, and the IEEE TRANSACTIONS ON GREEN
COMMUNICATIONS AND NETWORKING.

H. Vincent Poor (S’72, M’77, SM’82, F’87) received the Ph.D. degree in EECS from Princeton
University in 1977. From 1977 to 1990, he was
with the Faculty of the University of Illinois at
Urbana-Champaign. Since 1990 he has been with
the Faculty, Princeton, where he is the Michael
Henry Strater University Professor of Electrical Engineering. From 2006 to 2016, he served as Dean
of Princeton’s School of Engineering and Applied
Science. He has also held visiting appointments at
several other institutions, most recently at Berkeley
and Cambridge. His research interests are in the areas of information theory
and signal processing, and their applications in wireless networks and related
fields. Among his publications in these areas is the recent book Information
Theoretic Security and Privacy of Information Systems (Cambridge University
Press, 2017).
Dr. Poor is a member of the National Academy of Engineering and the
National Academy of Sciences, and a foreign member of the Royal Society.
In 1990, he served as the President of the IEEE Information Theory Society,
and from 2004 to 2007, as an Editor-in-Chief of the IEEE TRANSACTIONS
ON INFORMATION THEORY. He received the Technical Achievement and
Society Awards of the IEEE Signal Processing Society in 2007 and 2011,
respectively. Recent recognition of his work includes the 2017 IEEE Alexander Graham Bell Medal, a D.Sc. honoris causa from Syracuse University
received in 2017, and election as a Foreign Member of the National Academy
of Engineering of Korea in 2017, and an Honorary Member of the National
Academy of Sciences of Korea, in 2017.

