Persistence, Periodicity and Privacy for Positive Systems in Epidemiology and Elsewhere

Abstract

We first recall and describe some recently published results giving sufficient conditions for persistence and the existence of periodic solutions for switched SIS epidemiological models. We extend the result on the existence of persistent switching signals in two ways. We establish uniform strong persistence where previous work only guaranteed weak persistence; we replace the hypothesis that there exists an unstable matrix in the convex hull of the linearized systems with the weaker assumption that the JLE is positive. In the final section of the chapter, the issue of data privacy for positive systems is addressed.

1 Introduction and Outline

Mathematical models based on differential equations have long played an important role in epidemiology and population biology, dating back to the early, seminal work of Kermack, McKendrick and others. The point has been well made before that mathematical models are of particular importance in epidemiology as they allow researchers to investigate the feasibility and effectiveness of containment strategies through simulation and theoretical analysis; experimental investigation is neither feasible nor ethical in this setting. Since the early work in mathematical epidemiology, certain questions have occupied a central role in the development of the subject. It is arguable that the two most central issues concern the existence and stability of disease free equilibria and determining conditions for the disease becoming endemic in the population [1]. These questions are addressed using techniques from dynamical systems theory and, as the models studied have become more realistic and sophisticated, new approaches have been brought to bear on the problems. In particular, it is necessary to develop methods of analysis that can be applied to models incorporating uncertainty and stochastic effects, heterogeneous contact patterns, as well as time-variation in parameters and delay. Much of the work described in this chapter is motivated by this overall programme.

In [2], a simple SIS model for disease propagation in a population with multiple groups was described. The population is first stratified into groups and then each group is further divided into two epidemiological classes: susceptibles and infectives. New infectives can be generated by contacts between different groups and the infection rates as well as curing and birth/death rates can vary between classes. The authors of [2] showed that the spectral abscissa of the matrix of the linearized system can be used as a threshold parameter for the onset of endemic behaviour under a combinatorial irreducibility assumption on the matrix. Recently, this work was extended in the paper [3] in which a switched SIS model was studied.

The model considered in [3] incorporated both time variation and uncertainty and showed that the Joint Lyapunov Exponent (JLE) of the linearized inclusion can be used to determine the stability of the disease free equilibrium DFE. Moreover, it was shown that provided the convex hull of the linearized system matrices contains an unstable matrix, there exists a switching signal with respect to which the disease persists in every group. This work left two questions open: (i) can the condition on the convex hull of the system matrices be replaced with the (weaker) assumption that the JLE is positive? (ii) is the persistence uniform? A major contribution of this chapter is to provide answers to these questions.

The signals in applications such as epidemiology often contain sensitive personal information and it is important to develop analysis techniques that respect the privacy of individuals. A number of recent papers within the field of control have begun to address the interplay between control and privacy. In the final section of the chapter, we will focus on the work described in [4] in which the design of differentially private observers was considered: a motivating example in that paper was a simple epidemiological model. Many systems in which privacy arises as a concern are positive systems, so it seems entirely natural to ask whether or not a differentially private positive observer can be constructed. Our aim is to describe some novel questions for the positive systems community arising from the interplay between privacy and positivity.

2 Notation, Definitions and Preliminary Results

Throughout this chapter, we denote by $\mathbb {R}^n$ the vector space of all n-tuples of real numbers and by $\mathbb {R}^{n\,\times \,n}$ the space of all $n\,\times \,n$ matrices with real entries. For two vectors x, y in $\mathbb {R}^n$, the notation $x \ge y$ means that $x_i \ge y_i$ for $1 \le i \le n$; $x > y$ means that $x \ge y$, $x \ne y$; finally $x \gg y$ means that $x_i > y_i$ for $1 \le i \le n$. Similar notation is used for matrices. We denote by $\mathbb {R}^n_+$ the nonnegative orthant of $\mathbb {R}^n$:

$$\mathbb {R}^n_+ := \{x \in \mathbb {R}^n \mid x \ge 0\}.$$

For a matrix $A \in \mathbb {R}^{n\,\times \,n}$, $\sigma (A)$ denotes the spectrum of A and we denote by $\mu (A)$ the spectral abscissa of A, $\mu (A) := \max \{\text {Re}(\lambda ) \mid \lambda \in \sigma (A)\}$. For a set S in $\mathbb {R}^{n\,\times \,n}$, $\text {conv}(S)$ denotes the convex hull of S.

For an autonomous nonlinear system whose right hand side is Lipschitz,

$$\begin{aligned} \dot{x} = f(x), \;\; x(0) = x^0, \end{aligned}$$

(1.1)

we denote by $x(t, x^0)$ the unique solution with $x(0, x^0) = x^0.$ In the case where f is $C^1$ on a neighbourhood of $\mathbb {R}^n_+$ (as will be the case throughout here), it is well known that the system (1.1) is order preserving if the Jacobian of f is Metzler in $\mathbb {R}^n_+$. For background on monotone or order-preserving systems, we refer the reader to [5].

2.1 An Autonomous Multi-group SIS Model

We briefly recall the core SIS model of [2] which motivates our work. We consider a population that is divided into n groups; each group is then sub-divided into susceptibles and infectives and we denote the number of susceptibles in group i by $S_i(t)$ and the number of infectives in group i by $I_i(t)$. The rate at which susceptibles in group i are infected by infectives from group j is $\beta _{ij}$; the curing rate for infectives in group i is $\gamma _i$ and the birth and death rates for group i are both given by $\mu _i$. Following standard mass-action kinetics, the core model takes the form:

$$\begin{aligned} \dot{S}_i(t)= & {} \mu _i N_i - \mu _i S_i(t) - \sum _{j=1}^n \beta _{ij} \frac{S_i(t)I_j(t)}{N_i} + \gamma _i I_i(t) \\ \dot{I}_i(t)= & {} \sum _{j=1}^n \beta _{ij} \frac{S_i(t)I_j(t)}{N_i} - (\gamma _i + \mu _i) I_i(t) . \end{aligned}$$

The population of each group, $N_i$, is constant and if we focus on the dynamics of the fraction $x_i(t) = \frac{I_i(t)}{N_i}$ of infectives in each group the system simplifies to the compact form

$$\begin{aligned} \dot{x}(t) = (-D + B) x(t) + \text {diag}(x(t))B x(t). \end{aligned}$$

(1.2)

Here the matrix D is diagonal with entries $\alpha _i = \gamma _i + \mu _i$ along the main diagonal and B has entries $b_{ij} = \frac{\beta _{ij}N_j}{N_i}$. It is assumed throughout that $\alpha _i > 0$ for all i. It is easy to see that the origin is always an equilibrium for (1.2) corresponding to the disease free equilibrium (DFE). Moreover, the compact set

$$\Sigma _{n} := \{x \in \mathbb {R}^n_+ \mid x \le \mathbf {1}\}$$

is invariant under (1.2) and for every initial condition $x^0 \in \Sigma _n$, there exists a unique solution $x(t, x^0)$ of (1.2) defined for all $t \ge 0$ with $x(0, x^0) = x^0.$

The two key results from [2] concerning stability of the DFE and endemic behaviour for (1.2) are recalled below.

Theorem 1.1

Let B be an irreducible matrix. Then the DFE of (1.2) is globally asymptotically stable if and only if $\mu (-D + B) \le 0$.

The next result characterises possible endemic behaviour of (1.2).

Theorem 1.2

Let B be irreducible. There exists an endemic equilibrium $\bar{x}$ in $\text {int}(\mathbb {R}^n_+)$ if and only if $\mu (-D +B) > 0$. Furthermore, in this case $\bar{x}$ is asymptotically stable and has region of attraction containing $\Sigma _n \backslash \{0\}$.

2.2 Persistence

Our later results will be concerned with persistence for a switched version of the model (1.2). Persistence for a semiflow on a state space X is usually defined with respect to a function $\eta :X \rightarrow \mathbb {R}_+$. We next recall the definitions of weak and strong persistence and the uniform versions of both [6].

Definition 1.1

A semiflow $\phi :X \times \mathbb {R}_+ \times X$ is weakly persistent if

$$\limsup _{t \rightarrow \infty } \eta (\phi (t, x))> 0 \quad \forall x \in X \text{ with } \eta (x) > 0.$$

The semiflow $\phi :X \times \mathbb {R}_+ \times X$ is uniformly weakly persistent if there is some $\varepsilon > 0$ such that:

$$\limsup _{t \rightarrow \infty } \eta (\phi (t, x))> \varepsilon \quad \forall x \in X\,\text{ with }\,\eta (x) > 0.$$

The corresponding definitions of strong and uniform strong persistence replace the $\limsup$ with $\liminf$.

2.3 Extension to Switched/Differential Inclusion Model

The major focus of [3] was to extend the study of the model described above to allow for switching and uncertainty in the system parameters. Before recalling the relevant results, we introduce appropriate concepts of weak and strong persistence for switched systems.

Consider a switched system

$$\begin{aligned} \dot{x}(t) = f_{\sigma (t)}(x), \; x(0) = x^0 \end{aligned}$$

(1.3)

defined on a state space $X \subseteq \mathbb {R}^n_+$ where $\{f_1, \ldots , f_m\}$ is a given set of functions, assumed to be sufficiently smooth so that unique solutions of (1.3) exist on $[0, \infty )$ for every fixed $\sigma$ and $x^0$ is a measurable switching signal. For our purposes, X will denote the box $\Sigma _n$ defined earlier.

We only give the precise formulation for uniform strong persistence here due to space limitations. The corresponding definitions for strong and non-uniform persistence are easy to see.

If there is some $\varepsilon > 0$ and a switching signal $\sigma$ such that $\eta (x^0) > 0$ implies $\liminf _{t \rightarrow \infty } \eta (x(t, x^0, \sigma )) > \varepsilon$, we refer to $\sigma$ as a uniformly strongly persistent switching signal.

We now briefly recall the most relevant results of [3] to our current presentation.

We start with a finite set of diagonal matrices $\{D_1, \ldots , D_m\}$ with positive diagonal entries and a set $B_1, \ldots , B_m$ of nonnegative matrices. Each pair $D_i, B_i$ corresponds to one SIS system of the form (1.2). The switched model is then given by

$$\begin{aligned} \dot{x}(t) = (-D_{\sigma (t)} + B_{\sigma (t)}) x(t) - \text {diag}(x(t)) B_{\sigma (t)} x(t). \end{aligned}$$

(1.4)

We denote by $\mathscr {M}$ the set of matrices

$$ \mathscr {M} := \{-D_i +B_i \mid 1 \le i \le m\}.$$

The key idea in [3] was to replace the spectral abscissa of the linearized matrix $-D + B$ with the corresponding joint Lyapunov exponent of the linearized switched system/inclusion. We now briefly recall the definition of this concept.

Let $A_i = -D_i +B_i$ for $i = 1, \ldots , m$.

For each switching signal $\sigma$ and $t \ge 0$, the evolution operator $\varPhi _{\sigma }(t)$ is given by the solution of the matrix differential equation:

$$\overset{\mathbf{.}}{\varPhi }_{\sigma }(t) = A_{\sigma (t)}\varPhi _{\sigma }(t), \; \varPhi (0) = I.$$

We let $\mathscr {H}_t$ denote the set of all time evolution operators for time t and then define the operator semigroup

$$\mathscr {H} := \bigcup _{t \ge 0} \mathscr {H}_t,$$

setting $\mathscr {H}_0 = \{I\}$. The growth rate of the switched system at time t is defined by

$$\rho _t(\mathscr {M}) := \sup _{\phi _{\sigma } \in \mathscr {H}_t} \frac{1}{t} \log \Vert \varPhi _{\sigma }(t) \Vert .$$

Finally, the joint Lyapunov exponent (JLE) of the linearized system is:

$$\rho (\mathscr {M}) = \lim _{t \rightarrow \infty } \rho _t(\mathscr {M}).$$

Essentially, the JLE defined here represents a natural generalisation of the spectral abscissa of a single matrix to the context of switched linear systems.

In order to properly set context for our results here, we need to recall two of the main facts established in [3] for the switched epidemic model. The first of these establishes a sufficient condition for the DFE to be globally asymptotically stable with respect to arbitrary switching signals.

Theorem 1.3

Consider the switched system (1.4) and the associated set $\mathscr {M}$ of matrices. Assume that $\text {conv}(\mathscr {M})$ contains an irreducible matrix. The DFE of (1.4) is uniformly globally asymptotically stable if and only if $\rho (\mathscr {M}) \le 0$.

While the previous theorem establishes a condition for the DFE of the switched model to be globally asymptotically stable, the next result from [3] provides a condition for the existence of a persistent switching signal for (1.4).

Proposition 1.1

Consider the switched SIS model (1.4) and assume that every $B_i$ is irreducible. Assume that there exists some $R \in \text {conv}(\mathscr {M})$ with $\mu (R) > 0$. Then there exists a switching signal $\sigma$ such that for all $x^0 > 0$, $1 \le i \le n$

$$\begin{aligned} \liminf _{t \rightarrow \infty }\,\, x_i(t, x^0, \sigma ) > 0. \end{aligned}$$

We may summarise what the previous two results establish in the following way:

• if $\text {conv}(\mathscr {M})$ contains an irreducible matrix and the JLE $\rho (\mathscr {M}) \le 0$ the DFE is GAS and the disease dies out.

• if all the matrices $B_i$ are irreducible and $\mu (M)>0$ for some $M \in \text {conv}(\mathscr {M})$, there exists a switching signal which is strongly persistent with respect to every function $\eta (x) = |x_i|$, $1\le i \le n$.

Several questions arise naturally here. A first question is whether the switching signal above can be chosen so as to ensure uniform strong persistence. It is well known that while the existence of an unstable matrix in $\text {conv}(\mathscr {M})$ ensures that $\rho (\mathscr {M}) > 0$, there is in general a gap between the two conditions [7]. This raises the question of whether persistence can be established under the weaker assumption that $\rho (\mathscr {M}) > 0$. In the next section of the chapter we shall present a number of results addressing these issues.

3 Uniform Persistence and the JLE

In this section, we present some novel results and observations that address some of the issues mentioned at the close of the previous section. We first consider the case where the system (1.4) is 2-dimensional, corresponding to a population with two groups.

3.1 The 2-Group Case

To begin, we recall the following fact from [8].

Proposition 1.2

Consider a switched linear system

$$\begin{aligned} \dot{x}(t) = A_{\sigma (t)} x(t), \end{aligned}$$

(1.5)

where $\sigma :[0, \infty ) \rightarrow \mathscr {M} \subseteq \mathbb {R}^{2 \times 2}$ for a finite set $\mathscr {M}$ of Metzler matrices. Then (1.5) is globally uniformly asymptotically stable if and only if $\text {conv}(\mathscr {M})$ consists of Hurwitz matrices.

Consider now the system (1.4) and suppose that all of the matrices $B_i$ are irreducible. If $\rho (\mathscr {M}) > 0$, then this will still be true if we replace each matrix $-D_i + B_i$ by $-D_i+B_i - \varepsilon I$ for $\varepsilon > 0$ sufficiently small, by continuity of the JLE. It now follows from Proposition 1.2 that there exists some matrix M in $\text {conv} \{-D_i+B_i - \varepsilon I \mid 1 \le i \le m\}$ with $\mu (M) \ge 0$. It is easy to see that $\hat{M} = M+\varepsilon I$ is in $\text {conv}(\mathscr {M})$ and $\mu (\hat{M}) > 0$. Putting these simple observations together, we get the following result.

Proposition 1.3

Consider the switched system (1.4) and suppose that $n = 2$ and that each matrix $B_i$ is irreducible. Then:

• (i) if $\rho (\mathscr {M}) \le 0$, the DFE is globally asymptically stable;

• (ii) if $\rho (\mathscr {M}) > 0$, there exists switching signal $\sigma$ that is strongly persistent with respect to $\eta _i(x) = |x_i|$ for $1 \le i \le 2$.

3.2 Uniform Strong Persistence

In the next result, we show that under the same hypotheses as in Proposition 1.1 we can conclude the existence of a uniformly strongly persistent switching signal.

Proposition 1.4

Consider the switched SIS model (1.4) and assume that each $B_i$ is irreducible. Assume that there exists some $R \in \text {conv}(\mathscr {M})$ with $\mu (R) > 0$. Then there exists some $\varepsilon > 0$ and a switching signal $\sigma$ such that for all $x^0 > 0$, $1 \le i \le n$

$$\begin{aligned} \liminf _{t \rightarrow \infty } \,\, x_i(t, x^0, \sigma ) > \varepsilon . \end{aligned}$$

Proof

In the proof of Proposition 1.1 in [3] (where it appears as Proposition 6.1), it is shown that there exists a periodic switching signal $\sigma$ with period $T = \frac{1}{N_0}$ for some $N_0 \in \mathbb {N}$ with the following properties.

• (i) There exists some $v \gg 0$ and $\delta > 0$ such that $x(1, v, \sigma ) \gg v$ and $x_i(t, v, \sigma ) \ge \delta$ for all $t \ge 0$.

• (ii)   For any $\lambda$ with $0< \lambda < 1$ and $t \ge 0$, $x(t, \lambda v, \sigma ) \ge \lambda x(t, v, \sigma )$.

• (iii)   As each constituent vector field is irreducible, standard results from [5] show that $x(t, x^0, \sigma ) \gg 0$ for all $t > 0$ and $x^0 > 0$. In particular for all $x^0 > 0$, $x(1, x^0, \sigma ) \gg 0$.

It is a simple rephrasing of (i) to say that there is some $\alpha > 1$ such that $x(1, v, \sigma ) \ge \alpha v$. Let $x^0 \gg 0$ be given. We claim that there is some time T such that $x(T, x^0, \sigma ) \ge v$.

As in the proof of Proposition 6.1 in [3], we can find some $0<\lambda < 1$ such that $x^0 \ge \lambda v$. Then, using (ii), $x(1, \lambda v, \sigma ) \ge \lambda x(1, v, \sigma ) \ge \alpha \lambda v$. If $\alpha \lambda \ge 1$, then $x(1, \lambda v, \sigma ) \ge v$ and we are done. Otherwise, $\alpha \lambda < 1$ and again using (ii), combined with our choice of $\sigma$ and the monotonicity of the constituent systems, we have

$$\begin{aligned} x(2, x^0, \sigma )= & {} x(1, x(1, x^0, \sigma ), \sigma ) \\\ge & {} x(1, \alpha \lambda v, \sigma ) \\\ge & {} \alpha \lambda x(1, v, \sigma ) \\\ge & {} \alpha ^2 \lambda v. \end{aligned}$$

Iterating and using the periodicity of $\sigma$ together with the order-preserving property of each constituent vector field, we find that eventually there is some T such that $\alpha ^T \lambda \ge 1$ and hence $x(T, x^0, \sigma ) \ge v$. It now follows from the monotonicity of the constituent systems that $x(T+t, x^0, \sigma ) \ge x(t, v, \sigma )$ for $t \ge 0$ and hence that $\liminf _{t\rightarrow \infty } x_i(t, x^0, \sigma ) \ge \delta$ for $1 \le i \le n$.

It only remains to consider the case of $x^0 > 0$ but $x^0 \not \gg 0$. It follows from (iii) and the above argument that in this case also, $\liminf _{t\rightarrow \infty } x_i(t, x^0, \sigma ) \ge \delta$ for $1 \le i \le n$. This completes the proof.

3.3 Uniform Weak Persistence and the JLE

The results of the previous subsections show that there will exist persistent switching signals when the convex hull of the linearized system matrices contains an unstable matrix. However, there is a gap in general between the two conditions:

• (A)   $\exists M \in \text {conv}(\mathscr {M})$ with $\mu (M) > 0$;

• (B)   $\rho (\mathscr {M}) > 0$.

We now ask what can be said about persistence when we make the weaker assumption (B).

Theorem 1.4

Consider the switched SIS model (1.4). Assume that $\rho (\mathscr {M}) > 0$ and that each $B_i$ is irreducible. Then there exists a switching signal $\sigma$ that is uniformly weakly persistent with respect to $\eta (x) = \max _i |x_i|$.

Remark

Combining this result with Theorem 1.3, we see that for switched SIS models with irreducible $B_i$:

• $\rho (\mathscr {M}) \le 0$ implies DFE is globally asymptotically stable;

• $\rho (\mathscr {M}) > 0$ implies there exists a uniformly weakly persistent switching signal.

Outline of Proof:

We argue by contradiction. So, suppose that no uniformly weakly persistent switching signal exists. This would mean that for all $\varepsilon > 0$, and all switching signals $\sigma$, there would exist a solution $x(t, x^0, \sigma )$ with $\eta (x^0) > 0$ and

$$\limsup _{t \rightarrow \infty } \eta (x(t, x^0, \sigma )) < \varepsilon .$$

Choose $\varepsilon > 0$ so that the JLE of the matrices

$$ \hat{\mathscr {M}} := \{-D_1+ (1-\varepsilon ) B_1, -D_2+ (1-\varepsilon ) B_2, \ldots , -D_n+ (1-\varepsilon ) B_n\}$$

is still positive. This can be done as the JLE is continuous with respect to the Hausdorff metric on compact sets of Metzler matrices by [9].

Next, we write $\varPhi _{\sigma }$ for the evolution operators corresponding to $\hat{\mathscr {M}}$. As $\rho (\hat{\mathscr {M}}) > 0$, there is some $T > 0$ and some $\sigma$ such that $\Vert \varPhi _{\sigma }(T)\Vert = e^{\alpha T}$ where $\alpha > 0$. Consider the periodic switching signal $\sigma _1$ constructed from this $\sigma$ by setting $\sigma _1(t) = \sigma (t)$ for $0 \le t < T$ and $\sigma (t+T) = \sigma (t)$ for all $t \ge 0$.

By assumption there is some solution of the SIS model for this switching signal and some $T_1 > 0$ such that $\eta (x(t, x^0, \sigma )) < \varepsilon$ for all $t \ge T_1$. Choose a positive integral multiple kT of T such that $kT >T_1$. Then for all $t \ge kT$,

$$\begin{aligned} \dot{x}(t) \ge (-D_{\sigma (t)} + (1-\varepsilon ) B_{\sigma (t)}) x(t). \end{aligned}$$

(1.6)

As the matrices $B_i$ are irreducible, it follows from [5] that $x(kT) \gg 0$. Moreover, as the evolution operator is nonnegative, we can choose some vector $v > 0$ such that $\Vert \varPhi _{\sigma }(kT) v \Vert = e^{k\alpha T} \Vert v \Vert$ with $v \le x(kT)$. It now follows that for $p = 1, 2, \ldots$,

$$\eta (x(pkT, x^0, \sigma )) \ge e^{pk\alpha T} \Vert v\Vert $$

which clearly contradicts $\eta (x(t, x^0, \sigma )) < \varepsilon$. We conclude that there is a uniformly weakly persistent switching signal as claimed.

4 Privacy and Positive Systems

Monitoring population variables in order to determine whether or not a disease outbreak is likely to become an epidemic is a key aspect of epidemiological modelling in real world situations. In a recent paper [4], an interesting application of observer design motivated by syndromic surveillance methods for public health was considered. Specifically, a simple SIR model with output was considered, whose output consists of variables being used to monitor the level of disease in the population. This could be the number of tweets or blog posts about the disease for instance and the core idea is to design observers that can track the actual epidemiological variables based on the measured output.

It is important to address the privacy concerns of individuals who are contributing the data being measured in such a system. While many frameworks for privacy protection have been proposed in the data science and computing communities in the recent past, those based on information theoretic foundations and differential privacy [10, 11] appear the most suitable for dynamic situations and control applications. With this in mind, Le Ny introduced the problem of constructing a Luenberger observer that is differentially private in [4]. In the remainder of this section, our purpose is to describe the core idea behind the design of such observers and to highlight some novel and interesting questions for the field of positive systems that arise here.

Focussing on the essential details, the core question considered in [4] can be described as follows. We have a discrete time system with measured outputs of the form:

$$\begin{aligned} x_{k+1}= & {} f_k(x_k) \\ \nonumber y_k= & {} g_k(x_k), \end{aligned}$$

(1.7)

and we wish to construct a simple Luenberger observer $\mathscr {L}$ of the form:

$$z_{(k+1)} = f_k(z_k) + L_k(y_k - g(z_k))$$

to asymptotically track the state $x_k$ of (1.7). This is of course not a new problem. The novelty arises when some of the signals contain sensitive information in application areas such as epidemiology, population dynamics and social networks. In such a scenario, the problem is to construct observers that also guarantee that the mapping from a sensitive signal to the eventual (released) output of the observer satisfies an appropriate differential privacy constraint.

The original formulation of differential privacy for databases considered records belonging to a set D and modeled databases as vectors $\mathbf {d}$ in $D^n$. Two such vectors satisfy the adjacency relation $\mathbf {d} \sim \mathbf {d'}$ if they differ in exactly one component (the hamming distance between them is exactly 1). A query is a mapping Q from $D^n$ to some output space E. Differential privacy aims to protect the privacy of individuals by supplying randomised answers to a query so that the distribution of answers differs little when any one user changes their entry. Formally, for a query Q, an $\varepsilon$ differentially private mechanism is a set of random variables $X_{Q, \mathbf {d}} \in D^n$ taking values in E such that

$$\mathbb {P}(X_{Q, \mathbf {d}'} \in A) \le e^{\varepsilon } \mathbb {P}(X_{Q, \mathbf {d}} \in A) $$

for any $\mathbf {d} \sim \mathbf {d}'$ and any measurable subset A of E. In a system theoretic setting, we replace the database space with a set of sensitive signals, and a query corresponds to the mapping between signal spaces defined by a system. When dealing with dynamic scenarios, hamming distance is often not an appropriate notion of adjacency.

In [4], the following definition of adjacency was adopted. $K > 0$ and $0< \alpha < 1$ are given real constants; two sequences of measured values $y, y'$ are adjacent, $y \sim y'$, if there is some $k_0$ such that

$${\left\{ \begin{array}{ll} y_k = y_k' &{} \forall k \le k_0 \\ \Vert y_k - y_k'\Vert \le K \alpha ^{k-k_0} &{} \forall k > k_0. \end{array}\right. }$$

Each entry $y_k$, $y_k'$ lies in $\mathbb {R}^p$ and $\Vert \cdot \Vert$ can be any norm on $\mathbb {R}^p$. For simplicity, we will consider the $l_1$ norm. The output signal is considered sensitive (it may concern online activity of individuals for instance) and the aim is to release a differentially private perturbation of the observer state, $z_{(k)}$, of the form $\hat{z}_{(k)} = z_{(k)} + \delta _{(k)}$ where $\delta _{(k)}$ is an appropriate noise signal, chosen so that the mechanism mapping y to $\hat{z}$ is differentially private. Based on earlier work in [12], it is shown that this can be achieved by taking $\delta _{(k)}$ to be appropriate Laplacian or Gaussian random variables/vectors, whose variance depends on the sensitivity of the system mapping y to z. If $y \sim y'$ and we denote the corresponding states of the observer by $z, z'$, then the $l_1$ sensitivity of the system is given by

$$\begin{aligned} \sup _{y \sim y'} \Vert z -z'\Vert _1, \end{aligned}$$

(1.8)

where, in a slight abuse of notation, $\Vert z-z'\Vert _1 = \sum _{k=0}^{\infty } \Vert z_k - z_k'\Vert _1$.

The work of [4] and similar papers raises many very interesting questions for systems theory in general, and positive systems in particular. First, many of the motivating applications arise in area such as social networks and epidemiology, both of which naturally fall within the realm of positive systems. The question of how to design observers that preserve the positivity of the signals in the system and the impact that this might have on the accuracy of the outputs has not yet been addressed. Of course, positive systems possess many special properties that give a particular flavour to many fundamental questions, including that of observer design [13]. While realistic models will require an analysis for nonlinear models, the remainder of our discussion will focus on the linear case in the interest of highlighting some significant questions without muddying the waters with technical detail.

So consider a linear system with output of the form:

$$\begin{aligned} x_{k+1}= & {} A x_k \\ \nonumber y_k= & {} C x_k, \end{aligned}$$

(1.9)

where both $A \in \mathbb {R}^{n \times n}_+$ and $C \in \mathbb {R}^{p \times n}_+$ are nonnegative. A Luenberger observer would take the form

$$z_{k+1} = Az_k +L(y_k - C z_k) = (A-LC)z_k + Ly_k.$$

Even in the simple linear case, certain questions/challenges naturally suggest themselves.

• Characterise the minimal possible $l_1$ sensitivity of the system $\mathscr {L}$ where the observer system is required to be itself positive.

• Characterise the minimal $l_1$ sensitivity (for positive systems) without imposing the positivity constraint on the observer.

• Can we design a positive differentially private observer; here we are requiring that the noise added to z is truncated so as to ensure that the noisy signal remains positive.

• In reducing sensitivity, we can achieve $\varepsilon$ differential privacy with less noise. Can we characterise explicitly the impact this has, on the speed of convergence of the observer?

The above questions represent early steps in a programme to develop a foundation for differentially private observer design for positive systems. Extensions to time-varying and nonlinear systems will certainly be necessary. However, we feel that this is a topic of sufficient practical importance and theoretical interest to merit being brought to the attention of the positive systems community.