{"id":"cfd8a2c4-b84e-45d6-a91b-71e642eca247","arxiv_id":"2505.05859","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A centralized dispatch algorithm uses random matrix masks and duplicated constraints to let a grid operator exploit building thermal flexibility while keeping the building model and temperature state hidden.","lead":"This paper gives distribution system operators a way to dispatch building heating and cooling loads for grid flexibility while the building aggregator keeps its model parameters and indoor temperature profiles secret. The method uses random matrix transformations and duplicated constraints so that an operator's equations for recovering the private data are underdetermined.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy proof ignores that Vk is invertible, so the masked constraints are equivalent to the original ones; the DSO can recover the BLA's feasible region and, via the row space, the state and parameters.","rationale":"The reader's weakest assumption pointed to the same underlying gap: Section III-C equates underdetermination of Vk with privacy and ignores the additional structure and the optimizer's information. The stress-test pass identifies a concrete mechanism that makes that gap decisive. Because Vk is invertible, the masked equalities are logically equivalent to the unmasked equalities; the DSO can therefore query the true feasible set of (u, \\tilde{x}, w) directly. The paper's equation-counting shows only that Vk is not uniquely recoverable as a bare matrix, which is irrelevant to what the DSO can learn about the BLA's flexibility region. Furthermore, the row-space invariant is a standard linear-algebra fact that does not depend on knowing Vk, and it provides a path to recover Wk and hence the private state and parameters. The numerical tests in Section IV do not include any attack or even a feasibility-projection experiment; the privacy analysis is purely the counting argument. If the proposed concrete test succeeds, the central contribution of the paper, a privacy-preserved dispatch with a strong privacy guarantee, is invalid. Therefore the verdict should move from CONDITIONAL to REJECT pending the outcome of this test. The optimization equivalence and computational results are not questioned; the concern is specifically the privacy claim and its proof.","tokens_in":17943,"tokens_out":40170,"duration_ms":452052,"concrete_test":"Implement the attack for T=6 (or T=24) with random W, V, E and M=1 Toeplitz R, S as in Section IV. Construct F, G, H, e from (13b)-(13e) and give the DSO M = [VF, VG, VH, Ve]. (1) Solve 2T LPs, min/max u_t subject to the masked equalities and w >= 0, and compare the resulting u-feasible region with the true projection of (4b)-(4c); if they match, the DSO has exact access to the flexibility region. (2) Compute rowspace(M); from the w-block-zero subspace extract A = (RW)^{-1}S and b = (RW)^{-1}d; enumerate facets of the \\tilde{x}-projection to get W up to diagonal scaling; use A and b to fix the scaling; then compute x* = W \\tilde{x}* and compare with the true optimal state from the non-private dispatch. Exact recovery in either step refutes the central privacy claim.","verdict_should_be":"REJECT","load_bearing_attack":"Section III-C's privacy argument (Eqs. (16a)-(16d)) counts equations in the uploaded masked matrices and concludes that Vk is underdetermined. This does not establish privacy. Since Vk is invertible, the constraint set {VkFk \\tilde{x}_k + VkGk u_k + VkHk w_k = Vk e_k, w_k >= 0} is exactly the original constraint set {Fk \\tilde{x}_k + Gk u_k + Hk w_k = e_k, w_k >= 0}. The DSO therefore has an exact feasibility oracle for the BLA model in the variables (u_k, \\tilde{x}_k, w_k) and can compute the projection onto u_k, the BLA's true flexibility region, by solving linear programs with the received matrices. This alone contradicts the claim that the DSO 'cannot infer private information' in any operational sense. Moreover, rowspace([VkFk, VkGk, VkHk, Vkek]) = rowspace([Fk, Gk, Hk, ek]), so the DSO can recover the linear relations defining the model. The dynamic rows (w_k-block zero) yield (Rk Wk)^{-1} Sk and (Rk Wk)^{-1} dk; the \\tilde{x}_k-projection is the parallelotope {xlow <= Wk \\tilde{x}_k <= xbar}, whose facets give Wk up to diagonal scaling, and the dynamic relations fix that scaling. Hence Wk, the true state xk = Wk \\tilde{x}_k, and (via the Toeplitz parameterization of Rk, Sk) the parameters Rk, Sk, dk can be recovered. The equation-counting in Section III-C is therefore not a valid privacy guarantee.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a centralized, privacy-preserved optimal dispatch method for distribution systems with building thermal flexibility. The BLA model is masked through transformation-based encryption (a random invertible state mapping Wk and row transformation Vk), constraint relaxation (slack variables), and constraint extension (duplication of constraints). The DSO solves a masked optimization problem that is claimed to be exactly equivalent to the original centralized dispatch problem, with zero optimality loss, while the BLA's private parameters and indoor temperature profiles are hidden. Case studies on modified IEEE 33-bus and 141-bus systems show identical operational cost to the non-private benchmark, modest computational overhead, and a visualization of masked matrices.","tokens_in":18271,"tokens_out":22364,"duration_ms":251682,"significance":"If the privacy guarantee were sound, the paper would be valuable: it combines exact optimality with a centralized computing paradigm, avoids the accuracy loss of differential privacy and the computational burden of homomorphic encryption, and applies to a relevant class of storage-like flexible resources. The algebraic equivalence between the masked and original optimization problems is real and is supported by the identical costs in the case study. The computational experiments are reasonable and the proposed method is scalable in the tested settings. However, the central contribution is the privacy claim, and that claim is not established by the analysis in Section III-C; as detailed below, the masking is an invertible linear transformation that gives the DSO an exact model of the BLA, contradicting the paper's assertion that the DSO cannot infer private information.","major_comments":[{"comment":"The privacy argument is invalid because Vk is invertible. The constraint set in (14), together with wk >= 0, is equivalent to Fk \\tilde{x}_k + Gk uk + Hk wk = ek, wk >= 0, which is in turn equivalent to the original BLA model (4b)-(4c) under the bijective change xk = Wk \\tilde{x}_k. The DSO therefore receives an exact feasibility oracle for the BLA model and can compute the true flexibility region Uk by projection onto uk, as well as evaluate any linear function over that region. The equation count in Section III-C, comparing 24T^2+6T known entries with 36T^2 entries of Vk, is not relevant to this operational capability: the uploaded data are invariant under the gauge Vk -> Vk Q^{-1}, (Fk,Gk,Hk,ek) -> Q(Fk,Gk,Hk,ek), so the DSO does not need to determine Vk or Fk to exploit the model. This directly contradicts the claim in Section III-C that 'the DSO cannot infer the private information of the BLA k' under the paper's own Definition 1.","section":"Section III-C and Eq. (14)"},{"comment":"The identifiability analysis ignores the known block structure of the uploaded matrices and the information contained in the optimal solution. The row space of [VkFk, VkGk, VkHk, Vkek] equals the row space of [Fk, Gk, Hk, ek]; because the CET duplicates the dynamic rows and the CRT uses a diagonal Ek, the DSO can separate the dynamic equations from the bound equations. The bound equations define the parallelotope {xlow_k <= Wk \\tilde{x}_k <= xbar_k}, whose facet normals and widths determine Wk up to multiplication by the scalar (xbar_k - xlow_k). The dynamic equations then yield alpha_k, beta1_k/beta0_k, gamma_k/beta0_k, and (xbar_k - xlow_k)/beta0_k. In the numerical setup of Section IV, the distribution of Wk entries, N(0.1,0.1), is public, so this scalar is identifiable and the DSO can recover xk = Wk \\tilde{x}_k from the returned \\tilde{x}_k. Even without using the distribution, the DSO recovers the shape of the temperature profile and the ratios of all model parameters, which is far from 'cannot infer private information.' The optimal solution (u*, \\tilde{x}*) and the coupling constraint Az+u=0 are additional sources of information that are not accounted for in (16a)-(16d).","section":"Section III-C, Eqs. (16a)-(16d)"},{"comment":"The privacy experiment does not provide evidence for the privacy claim. It plots G1 and V1G1 and observes that the numerical entries differ, but any invertible linear map changes the entries of a matrix. The section does not attempt to recover parameters or states from the uploaded data, does not test the feasibility-oracle or row-space attacks described above, and gives no quantitative privacy metric such as estimation error or indistinguishability. A claim of privacy-preserved performance requires an attack model and a success metric; the current demonstration is purely visual and cannot distinguish masking from a complete lack of protection.","section":"Section IV-B"}],"minor_comments":[{"comment":"The definition of Uk as {uk | VkFk \\tilde{x}_k + VkGk uk + VkHk wk = Vkek} is ambiguous and, taken literally, incorrect: the set should be the projection Uk = {uk | there exist \\tilde{x}_k and wk >= 0 satisfying the masked equation}. The nonnegativity constraint wk >= 0 is essential for the equivalence with the original bounds and should appear explicitly in (15).","section":"Eq. (15)"},{"comment":"The statement that the information accessible to other BLAs is a subset of that available to the DSO is only true if colluding BLAs do not exchange their own private information; the sentence should clarify the collusion model, since the paper says 'even if they collude with each other.'","section":"Section III-C"},{"comment":"The heatmaps in Figure 6 use different color scales, and the claim of 'great differences' is unquantified. If this figure is retained, add a quantitative comparison, such as the Frobenius norm of the difference normalized by the original norm, or an information-theoretic metric.","section":"Figure 6"},{"comment":"There is a typo in 'paramters' in the definition of dk in Eq. (4a); it should read 'parameters.'","section":"Section II-B"},{"comment":"The nonzero optimality loss at phi = 0 is not explained. Since phi = 0 means no injected noise, the loss likely comes from the ADMM convergence tolerance; this should be stated explicitly so that the comparison with PPCC is not misinterpreted.","section":"Table II"}],"recommendation":"reject","confidential_remarks":"The central contribution of the paper is the claim that the DSO cannot infer the BLA's private information, and that claim is not established. The proposed masking is an invertible linear transformation, so the DSO receives an exact equivalent model and can compute the true flexibility region directly. The equation-counting argument in Section III-C is a common but invalid heuristic for transformation-based encryption: it ignores gauge freedom, known block structure, and the information in the optimal solution. The numerical privacy experiment in Section IV-B is only a heatmap and does not test any inference attack. In my view, this is a load-bearing flaw rather than a local presentation issue: the paper's stated contribution of privacy preservation fails, and fixing it would require either a substantially weaker privacy claim or a fundamentally different masking mechanism. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the dispatch-equivalence part is real and clean, but the privacy guarantee is not what the paper says it is. Because Vk is invertible, the masked BLA constraints describe exactly the same feasible set as the original constraints. The equation-counting in Section III-C ignores that the DSO can simply evaluate the uploaded equations as an exact feasibility oracle.\n\nWhat is new and good: the combination of TE-I, CRT, CET, and TE-II for a centralized dispatch problem where the computing center is also the adversary is new as far as I know, and the constraint-extension trick that rebalances the equation/unknown count is clever. The algebraic equivalence between the original and masked problems is exact, and the case study confirms it with identical costs. Computational overhead is modest and the IEEE-141 scaling is reasonable. This is a useful algorithmic contribution for the TE community.\n\nWhere it gets soft: the privacy analysis in Section III-C rests on counting equations versus unknowns, but that is not a privacy guarantee. Since Vk is invertible, the set {VkFk x~k + VkGk uk + VkHk wk = Vkek, wk >= 0} is exactly {Fk x~k + Gk uk + Hk wk = ek, wk >= 0}. The rowspace is also invariant: rowspace([VkFk, VkGk, VkHk, Vkek]) = rowspace([Fk, Gk, Hk, ek]). So the DSO can project the feasible set onto uk and recover the BLA's true flexibility region uk exactly. That directly contradicts the paper's claim that the DSO cannot infer private information in any operational sense. The dynamic and bound rows plausibly leak Rk, Sk, Wk, and xk up to the exact ambiguities the authors count, but those are algebraic non-uniquenesses, not confidentiality against a solver who can query the model. Duplicating constraints does not fix this: it changes the equation-to-unknown ratio but leaves the rowspace equivalence intact.\n\nThe DP-ADMM comparison is also weak. A converged ADMM with no privacy noise would also achieve near-zero optimality loss, so the exactness comparison is not informative. There are no attack experiments and no code, only parameter settings. The paper's own future-work section acknowledges cybersecurity issues are dismissed, which is fine, but it does not acknowledge the deeper issue that feasibility-oracle leakage is not addressed.\n\nWho should read this: people working on transformation-based encryption for privacy-preserving optimization, and anyone who wants a worked example of why equation-counting is not a privacy proof. It deserves serious peer review because the dispatch-exactness mechanism is valuable, but the privacy claim needs major rework. I would ask the authors to either provide a formal indistinguishability-based proof or weaken the claim to 'a naive equation-solving adversary cannot uniquely determine the parameters', and to add attack experiments that test whether the feasibility oracle can extract Rk, Sk, Wk, or xk. The paper should also state plainly that the DSO learns the aggregate flexibility region and argue whether that is inside their threat model.\n\nRecommendation: send to peer review, but only after the privacy analysis is substantially revised.","headline":"The dispatch-equivalence trick is genuinely neat, but the privacy proof is an equation count, not a privacy proof: because Vk is invertible, the DSO actually gets an exact feasibility oracle for the BLA model, so the paper's central 'cannot infer' claim is not supported.","tokens_in":18797,"tokens_out":7789,"would_cite":true,"duration_ms":96249,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A privacy-preserved dispatch scheme lets a distribution system operator exploit building thermal flexibility without seeing the buildings' model parameters or temperature profiles, at zero optimality loss versus the non-private benchmark.","keywords":["privacy-preserving optimization","building thermal flexibility","optimal dispatch","transformation-based encryption","constraint relaxation","constraint extension","distribution system","aggregate thermal dynamic model"],"falsifier":"Run the paper's algorithm on a small test case, generate the masked uploads, then solve the inference system (16) augmented with the duplicate-block structure of $F_k,G_k,H_k,e_k$, the coupling constraint $Az+u=0$, and the optimality conditions for the returned solution; if any private coefficient or temperature profile is recovered uniquely, the privacy claim is refuted.","tokens_in":17708,"feed_emoji":"🔒","tokens_out":9066,"duration_ms":86073,"temperature":0.7,"pith_summary":"This paper claims that a distribution system operator can run the optimal economic dispatch of a grid that includes building thermal flexibility without ever seeing the buildings' private data: the aggregate thermal model parameters, the indoor-temperature bounds, or the temperature profiles themselves. Building-load aggregators encrypt their feasible regions by mapping temperatures through random invertible matrices, converting inequality constraints into equalities with masked slack variables, duplicating those equalities, and then multiplying both sides by another random matrix. Because the uploaded equations have far more unknown masking matrices than equations constrain them, the operator cannot uniquely solve back to the private coefficients. The paper's numerical tests show the dispatch schedule and cost are identical to the non-private centralized solution, while earlier noisy or distributed privacy methods incur optimality loss.","feed_headline":"Grid dispatches building heat storage without seeing private data","feed_subtitle":"A masking scheme gives the operator the exact non-private optimum while hiding temperatures and model parameters.","key_machinery":"The machinery is a masked feasible-region transformation built from three named techniques: transformation-based encryption (TE), constraint relaxation (CRT), and constraint extension (CET). TE hides coefficients by replacing the state with a random linear image ($x_k=W_k\\tilde{x}_k$) and by left-multiplying each equality by a random invertible matrix, so the uploaded matrices are $V_kF_k, V_kG_k, V_kH_k, V_ke_k$. CRT converts the temperature inequalities into equalities with nonnegative slack variables, which is needed because inequality constraints would otherwise force the masking matrix to be a positive diagonal matrix and leave too little randomness. CET duplicates the equalities before applying TE-II; the duplicates make the uploaded system underdetermined ($24T^2+6T$ equations against $36T^2$ unknowns in $V_k$), which is the load-bearing privacy argument. An important secondary element is the aggregate thermal dynamic model (ATDM), the linear state equation that gives the whole scheme a compact matrix form.","core_discovery":"The central discovery is that privacy and exact optimality need not trade off in this setting. The authors model each building cluster by an aggregate linear thermal dynamic relation $R_k x_k + S_k u_k = d_k$ with temperature-box constraints, coupled to the grid through $Az+u=0$, and show that every private quantity can be hidden before the operator solves the problem. Concretely, BLA $k$ replaces its true state $x_k$ by a pseudo-state $\\tilde{x}_k = W_k^{-1}x_k$ with an invertible random $W_k$; rewrites the box constraints as $D_k\\tilde{x}_k+E_k w_k=x_k^{bd}$ with a random positive diagonal $E_k$; duplicates the whole system so $F_k,G_k,H_k,e_k$ contain repeated blocks; and finally multiplies by a random invertible $V_k$. The DSO solves the masked LP/MILP and returns $\\tilde{x}_k^*$, from which the BLA recovers $x_k^* = W_k \\tilde{x}_k^*$. The privacy proof is the underdetermination count: the uploaded $V_kF_k,V_kG_k,V_kH_k,V_ke_k$ provide $24T^2+6T$ known entries, while $V_k$ alone has $36T^2$ unknowns, so no unique inference of $R_k,S_k,d_k,\\bar{x}_k,\\underline{x}_k$, or $x_k$ is possible. Numerical tests on two distribution systems reproduce the non-private dispatch exactly.","pith_inferences":["The privacy definition is 'not uniquely determined,' which is weaker than cryptographic indistinguishability; a follow-up attack simulation could test whether adding the known duplicate-block relations, the coupling constraint, and the optimality of the returned solution shrinks the solution set enough to leak meaningful information, and the paper does not run that attack.","The duplicate-and-scramble recipe is not tied to buildings: any linear program with private coefficients and box constraints could in principle use it, though nonlinear objectives or integer variables may erode the underdetermination count in ways that need separate analysis.","The scheme is passive-privacy only, since the paper excludes noise-injection attacks on the communication channel; combining the masking with lightweight integrity checks or authenticated encryption would be a natural extension that handles active adversaries without changing the dispatch model.","A practical deployment could let each aggregator choose its own duplication count, since the paper notes that more duplicates strengthen privacy at higher computational cost; optimizing that count per resource type is a natural design question."],"forward_implications":["A grid operator can include building thermal flexibility in day-ahead dispatch without collecting model parameters or temperature profiles, removing the main privacy barrier to using buildings as demand-response resources.","The dispatch result is exactly the non-private centralized optimum; unlike differential-privacy or ADMM-based distributed methods, there is zero optimality loss from the privacy mechanism.","Because the model is linear and storage-like, the same masking procedure applies to batteries, electric vehicles, and other flexible resources with a state equation and box constraints, as the paper notes.","Computation remains practical: the masked problem adds only slack variables and duplicated constraints, and the reported solve times stay close to the non-private baseline on 33-bus and 141-bus cases.","Against semi-honest operators, colluding aggregators, and external eavesdroppers, no individual building's private data is uniquely determined from the uploaded information, assuming the secure-communication setting stated in the paper."],"supporting_citations":[{"why":"Supplies the aggregate thermal dynamic model (ATDM) that the BLA model and the compact matrix form build on.","marker":"[10]"},{"why":"Supplies the transformation-based encryption masking theory and the TE-I/TE-II idea the proposed algorithm extends.","marker":"[22]"},{"why":"Shows an existing TE application to chance-constrained optimal power flow that motivates adapting TE to the centralized dispatch setting.","marker":"[23]"},{"why":"Provides the differentially private ADMM baseline (DP-ADMM) whose optimality loss the paper's zero-loss result is compared against.","marker":"[18]"},{"why":"Provides the linearized DistFlow branch power model used in the distribution-system constraints.","marker":"[26]"},{"why":"Supplies the parameter settings for the 33-bus and 141-bus test systems used in the numerical validation.","marker":"[28]"},{"why":"Documents how intermediate information exchanged in ADMM can be used to infer private data, motivating the centralized masking approach.","marker":"[15]"}],"fun_headline_variants":["Privacy-preserving dispatch: grid taps building heat flexibility","Masked LP dispatch hides building data, keeps exact optimum","Grid exploits building thermal storage without seeing private data","Exact grid dispatch, zero privacy leaks for building heat flexibility"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy guarantee rests on equating 'not uniquely determined' with 'not leaked': it assumes an adversary who sees the masked uploads, the coupling constraint, and the optimal dispatch solution cannot combine the repeated-block structure and optimality conditions to narrow down the private data.","fun_headline_variants_meta":{"raw":{"variants":["Privacy-preserving dispatch: grid taps building heat flexibility","Masked LP dispatch hides building data, keeps exact optimum","Grid exploits building thermal storage without seeing private data","Exact grid dispatch, zero privacy leaks for building heat flexibility"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000279,"raw_usage":{"total_tokens":1732,"prompt_tokens":1094,"completion_tokens":638,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":710,"completion_tokens_details":{"reasoning_tokens":573}},"tokens_in":710,"tokens_out":638,"duration_ms":7282,"temperature":1.0,"reasoning_tokens":573,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:54:47.906831+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the paper's algorithm on a small test case, generate the masked uploads, then solve the inference system (16) augmented with the duplicate-block structure of $F_k,G_k,H_k,e_k$, the coupling constraint $Az+u=0$, and the optimality conditions for the returned solution; if any private coefficient or temperature profile is recovered uniquely, the privacy claim is refuted.","supporting_citations":[{"cited_title":"Data-dri ven aggregate thermal dynamic model for buildings: A regressio n approach,","cited_arxiv_id":null,"evidence_quote":"Supplies the aggregate thermal dynamic model (ATDM) that the BLA model and the compact matrix form build on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the transformation-based encryption masking theory and the TE-I/TE-II idea the proposed algorithm extends."},{"cited_title":"Chance-constrained o pf: A distributed method with confidentiality preservation,","cited_arxiv_id":null,"evidence_quote":"Shows an existing TE application to chance-constrained optimal power flow that motivates adapting TE to the centralized dispatch setting."},{"cited_title":"Dp-adm m: Admm-based distributed learning with differential privac y,","cited_arxiv_id":null,"evidence_quote":"Provides the differentially private ADMM baseline (DP-ADMM) whose optimality loss the paper's zero-loss result is compared against."},{"cited_title":"An iterative linear distflo w for dynamic optimization in distributed generation planning studies,","cited_arxiv_id":null,"evidence_quote":"Provides the linearized DistFlow branch power model used in the distribution-system constraints."},{"cited_title":"Parameter settings: 33 and 141 bus distribution systems,","cited_arxiv_id":null,"evidence_quote":"Supplies the parameter settings for the 33-bus and 141-bus test systems used in the numerical validation."},{"cited_title":"Admm based privacy-pre serving decentralized optimization,","cited_arxiv_id":null,"evidence_quote":"Documents how intermediate information exchanged in ADMM can be used to infer private data, motivating the centralized masking approach."}],"review_version":1}