REVIEW 3 major objections 5 minor 28 references
Integrating Building Thermal Flexibility Into Distribution System: A Privacy-Preserved Dispatch Approach
T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read A privacy-preserved dispatch scheme lets a distribution system operator exploit building thermal flexibility without seeing the buildings' model parameters or temperature profiles, at zero optimality loss versus the non-private benchmark.
desk verdict The dispatch-equivalence trick is genuinely neat, but the privacy proof is an equation count, not a privacy proof: because Vk is invertible, the DSO actually gets an exact feasibility oracle for the BLA model, so the paper's central 'cannot infer' claim is not supported. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The machinery is a masked feasible-region transformation built from three named techniques: transformation-based encryption (TE), constraint relaxation (CRT), and constraint extension (CET). TE hides coefficients by replacing the state with a random linear image ($x_k=W_k\tilde{x}_k$) and by left-multiplying each equality by a random invertible matrix, so the uploaded matrices are $V_kF_k, V_kG_k, V_kH_k, V_ke_k$. CRT converts the temperature inequalities into equalities with nonnegative slack variables, which is needed because inequality constraints would otherwise force the masking matrix to be a positive diagonal matrix and leave too little randomness. CET duplicates the equalities before applying TE-II; the duplicates make the uploaded system underdetermined ($24T^2+6T$ equations against $36T^2$ unknowns in $V_k$), which is the load-bearing privacy argument. An important secondary element is the aggregate thermal dynamic model (ATDM), the linear state equation that gives the whole scheme a compact matrix form.
What would settle it
Run the paper's algorithm on a small test case, generate the masked uploads, then solve the inference system (16) augmented with the duplicate-block structure of $F_k,G_k,H_k,e_k$, the coupling constraint $Az+u=0$, and the optimality conditions for the returned solution; if any private coefficient or temperature profile is recovered uniquely, the privacy claim is refuted.
Extended reading notes
Core claim
The central discovery is that privacy and exact optimality need not trade off in this setting. The authors model each building cluster by an aggregate linear thermal dynamic relation $R_k x_k + S_k u_k = d_k$ with temperature-box constraints, coupled to the grid through $Az+u=0$, and show that every private quantity can be hidden before the operator solves the problem. Concretely, BLA $k$ replaces its true state $x_k$ by a pseudo-state $\tilde{x}_k = W_k^{-1}x_k$ with an invertible random $W_k$; rewrites the box constraints as $D_k\tilde{x}_k+E_k w_k=x_k^{bd}$ with a random positive diagonal $E_k$; duplicates the whole system so $F_k,G_k,H_k,e_k$ contain repeated blocks; and finally multiplies by a random invertible $V_k$. The DSO solves the masked LP/MILP and returns $\tilde{x}_k^*$, from which the BLA recovers $x_k^* = W_k \tilde{x}_k^*$. The privacy proof is the underdetermination count: the uploaded $V_kF_k,V_kG_k,V_kH_k,V_ke_k$ provide $24T^2+6T$ known entries, while $V_k$ alone has $36T^2$ unknowns, so no unique inference of $R_k,S_k,d_k,\bar{x}_k,\underline{x}_k$, or $x_k$ is possible. Numerical tests on two distribution systems reproduce the non-private dispatch exactly.
Load-bearing premise
The privacy guarantee rests on equating 'not uniquely determined' with 'not leaked': it assumes an adversary who sees the masked uploads, the coupling constraint, and the optimal dispatch solution cannot combine the repeated-block structure and optimality conditions to narrow down the private data.
Editorial extensions
If this is right
- A grid operator can include building thermal flexibility in day-ahead dispatch without collecting model parameters or temperature profiles, removing the main privacy barrier to using buildings as demand-response resources.
- The dispatch result is exactly the non-private centralized optimum; unlike differential-privacy or ADMM-based distributed methods, there is zero optimality loss from the privacy mechanism.
- Because the model is linear and storage-like, the same masking procedure applies to batteries, electric vehicles, and other flexible resources with a state equation and box constraints, as the paper notes.
- Computation remains practical: the masked problem adds only slack variables and duplicated constraints, and the reported solve times stay close to the non-private baseline on 33-bus and 141-bus cases.
- Against semi-honest operators, colluding aggregators, and external eavesdroppers, no individual building's private data is uniquely determined from the uploaded information, assuming the secure-communication setting stated in the paper.
Reading between the lines
- The privacy definition is 'not uniquely determined,' which is weaker than cryptographic indistinguishability; a follow-up attack simulation could test whether adding the known duplicate-block relations, the coupling constraint, and the optimality of the returned solution shrinks the solution set enough to leak meaningful information, and the paper does not run that attack.
- The duplicate-and-scramble recipe is not tied to buildings: any linear program with private coefficients and box constraints could in principle use it, though nonlinear objectives or integer variables may erode the underdetermination count in ways that need separate analysis.
- The scheme is passive-privacy only, since the paper excludes noise-injection attacks on the communication channel; combining the masking with lightweight integrity checks or authenticated encryption would be a natural extension that handles active adversaries without changing the dispatch model.
- A practical deployment could let each aggregator choose its own duplication count, since the paper notes that more duplicates strengthen privacy at higher computational cost; optimizing that count per resource type is a natural design question.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a centralized, privacy-preserved optimal dispatch method for distribution systems with building thermal flexibility. The BLA model is masked through transformation-based encryption (a random invertible state mapping Wk and row transformation Vk), constraint relaxation (slack variables), and constraint extension (duplication of constraints). The DSO solves a masked optimization problem that is claimed to be exactly equivalent to the original centralized dispatch problem, with zero optimality loss, while the BLA's private parameters and indoor temperature profiles are hidden. Case studies on modified IEEE 33-bus and 141-bus systems show identical operational cost to the non-private benchmark, modest computational overhead, and a visualization of masked matrices.
Significance. If the privacy guarantee were sound, the paper would be valuable: it combines exact optimality with a centralized computing paradigm, avoids the accuracy loss of differential privacy and the computational burden of homomorphic encryption, and applies to a relevant class of storage-like flexible resources. The algebraic equivalence between the masked and original optimization problems is real and is supported by the identical costs in the case study. The computational experiments are reasonable and the proposed method is scalable in the tested settings. However, the central contribution is the privacy claim, and that claim is not established by the analysis in Section III-C; as detailed below, the masking is an invertible linear transformation that gives the DSO an exact model of the BLA, contradicting the paper's assertion that the DSO cannot infer private information.
major comments (3)
- [Section III-C and Eq. (14)] The privacy argument is invalid because Vk is invertible. The constraint set in (14), together with wk >= 0, is equivalent to Fk \tilde{x}_k + Gk uk + Hk wk = ek, wk >= 0, which is in turn equivalent to the original BLA model (4b)-(4c) under the bijective change xk = Wk \tilde{x}_k. The DSO therefore receives an exact feasibility oracle for the BLA model and can compute the true flexibility region Uk by projection onto uk, as well as evaluate any linear function over that region. The equation count in Section III-C, comparing 24T^2+6T known entries with 36T^2 entries of Vk, is not relevant to this operational capability: the uploaded data are invariant under the gauge Vk -> Vk Q^{-1}, (Fk,Gk,Hk,ek) -> Q(Fk,Gk,Hk,ek), so the DSO does not need to determine Vk or Fk to exploit the model. This directly contradicts the claim in Section III-C that 'the DSO cannot infer the private information of the BLA k' under the paper's own Definition 1.
- [Section III-C, Eqs. (16a)-(16d)] The identifiability analysis ignores the known block structure of the uploaded matrices and the information contained in the optimal solution. The row space of [VkFk, VkGk, VkHk, Vkek] equals the row space of [Fk, Gk, Hk, ek]; because the CET duplicates the dynamic rows and the CRT uses a diagonal Ek, the DSO can separate the dynamic equations from the bound equations. The bound equations define the parallelotope {xlow_k <= Wk \tilde{x}_k <= xbar_k}, whose facet normals and widths determine Wk up to multiplication by the scalar (xbar_k - xlow_k). The dynamic equations then yield alpha_k, beta1_k/beta0_k, gamma_k/beta0_k, and (xbar_k - xlow_k)/beta0_k. In the numerical setup of Section IV, the distribution of Wk entries, N(0.1,0.1), is public, so this scalar is identifiable and the DSO can recover xk = Wk \tilde{x}_k from the returned \tilde{x}_k. Even without using the distribution, the DSO recovers the shape of the temperature profile and the ratios of all model parameters, which is far from 'cannot infer private information.' The optimal solution (u*, \tilde{x}*) and the coupling constraint Az+u=0 are additional sources of information that are not accounted for in (16a)-(16d).
- [Section IV-B] The privacy experiment does not provide evidence for the privacy claim. It plots G1 and V1G1 and observes that the numerical entries differ, but any invertible linear map changes the entries of a matrix. The section does not attempt to recover parameters or states from the uploaded data, does not test the feasibility-oracle or row-space attacks described above, and gives no quantitative privacy metric such as estimation error or indistinguishability. A claim of privacy-preserved performance requires an attack model and a success metric; the current demonstration is purely visual and cannot distinguish masking from a complete lack of protection.
minor comments (5)
- [Eq. (15)] The definition of Uk as {uk | VkFk \tilde{x}_k + VkGk uk + VkHk wk = Vkek} is ambiguous and, taken literally, incorrect: the set should be the projection Uk = {uk | there exist \tilde{x}_k and wk >= 0 satisfying the masked equation}. The nonnegativity constraint wk >= 0 is essential for the equivalence with the original bounds and should appear explicitly in (15).
- [Section III-C] The statement that the information accessible to other BLAs is a subset of that available to the DSO is only true if colluding BLAs do not exchange their own private information; the sentence should clarify the collusion model, since the paper says 'even if they collude with each other.'
- [Figure 6] The heatmaps in Figure 6 use different color scales, and the claim of 'great differences' is unquantified. If this figure is retained, add a quantitative comparison, such as the Frobenius norm of the difference normalized by the original norm, or an information-theoretic metric.
- [Section II-B] There is a typo in 'paramters' in the definition of dk in Eq. (4a); it should read 'parameters.'
- [Table II] The nonzero optimality loss at phi = 0 is not explained. Since phi = 0 means no injected noise, the loss likely comes from the ADMM convergence tolerance; this should be stated explicitly so that the comparison with PPCC is not misinterpreted.
Circularity Check
No significant circularity: the dispatch derivation and privacy argument are self-contained; self-citations are context, not load-bearing.
full rationale
The paper's central derivation in Section III builds the masked dispatch model (13)-(15) from the BLA model in (4), using standard invertible linear transformations Wk and Vk, slack variables, and row duplication. No parameter is fitted to data and then renamed a prediction: the accuracy result that PPCC matches NPPCC follows exactly from the invertibility of Wk and Vk, and the privacy claim in Section III-C is argued from an equation-count of the inference system (16a)-(16d) constructed from the uploaded matrices. That equation-count is the paper's own proof rather than an imported conclusion; it may be operationally contestable because an invertible Vk preserves the row space and feasible region, so the DSO could recover flexibility information through the masked constraints, and the label 'complete inference equation system' is an assumption rather than a derived fact. Those are correctness or security-model concerns, not circularity under the stated definitions. Citations to the authors' prior work ([4], [10], [28]) are present, but [10] supplies the external aggregate thermal dynamic model used as an input, [28] supplies test-case parameters, and [4] is related work; none of them is invoked to justify the privacy-preservation claim. Therefore no self-definitional step, fitted-input-as-prediction, or load-bearing self-citation chain is exhibited.
Assumptions & free parameters
free parameters (3)
- Wk =
random T x T invertible matrix, entries ~ N(0.1,0.1) in tests
- Ek =
random positive diagonal 2T x 2T matrix in tests
- Vk =
random 6T x 6T invertible matrix in tests
assumptions (5)
- domain assumption The aggregate thermal dynamic model (ATDM) from [10] accurately represents the thermal response of the building cluster
- domain assumption Wk and Vk are invertible and private to BLA k, and Ek is positive diagonal and private
- domain assumption Semi-honest adversary model: DSO and other BLAs follow the protocol but may try to infer private information
- domain assumption Secure communication environment
- ad hoc to paper Underdetermination of the inference equation system is a sufficient privacy metric
Cite this review
Pith. "Pith review of Integrating Building Thermal Flexibility Into Distribution System: A Privacy-Preserved Dispatch Approach." pith.science (2026). https://pith.science/paper/7FRCIIJO
@misc{pith2026250505859,
author = {Pith},
title = {Pith review of: Integrating Building Thermal Flexibility Into Distribution System: A Privacy-Preserved Dispatch Approach},
year = {2026},
howpublished = {\url{https://pith.science/paper/7FRCIIJO}},
note = {Machine review of arXiv:2505.05859}
}
read the original abstract
The inherent thermal storage capacity of buildings brings considerable thermal flexibility to the heating/cooling loads, which are promising demand response resources for power systems. It is widely believed that integrating the thermal flexibility of buildings into the distribution system can improve the operating economy and reliability of the system. However, the private information of the buildings needs to be transferred to the distribution system operator (DSO) to achieve a coordinated optimization, bringing serious privacy concerns to users. Given this issue, we propose a novel privacy-preserved optimal dispatch approach for the distribution system incorporating buildings. Using it, the DSO can exploit the thermal flexibility of buildings without accessing their private information, such as model parameters and indoor temperature profiles. Specifically, we first develop an optimal dispatch model for the distribution system integrating buildings, which can be extended to other storage-like flexibility resources. Second, we reveal that the privacy-preserved integration of buildings is a joint privacy preservation problem for both parameters and state variables and then design a privacy-preserved algorithm based on transformation-based encryption, constraint relaxation, and constraint extension techniques. Besides, we implement a detailed privacy analysis for the proposed method, considering both semi-honest adversaries and external eavesdroppers. Case studies demonstrate the accuracy, privacy-preserved performance, and computational efficiency of the proposed method.
Figures
Figures from the paper (3 more)
Reference graph
Works this paper leans on
-
[1]
Robust energy management through aggregation of flexible resource s in multi- home micro energy hub,
G. Wang, Y . Zhou, Z. Lin, S. Zhu, R. Qiu, Y . Chen, and J. Y an, “Robust energy management through aggregation of flexible resource s in multi- home micro energy hub,” Applied Energy , vol. 357, p. 122471, 2024
work page 2024
-
[2]
J. Zhong, Y . Li, Y . Wu, Y . Cao, Z. Li, Y . Peng, X. Qiao, Y . Xu, Q. Y u, X. Y ang et al. , “Optimal operation of energy hub: An integrated model combined distributionally robust optimization method wit h stackelberg game,” IEEE Transactions on Sustainable Energy , vol. 14, no. 3, pp. 1835–1848, 2023
work page 2023
-
[3]
Buildi ngs-to-grid integration framework,
A. F. Taha, N. Gatsis, B. Dong, A. Pipri, and Z. Li, “Buildi ngs-to-grid integration framework,” IEEE Trans. Smart Grid , vol. 10, no. 2, pp. 1237–1249, 2017
work page 2017
-
[4]
Robu st parameter estimation of aggregate thermal dynamic model: A privacy- preserved approach,
Z. Hou, S. Lu, Z. Wu, W. Gu, H. Zhang, Y . Xu, and Z. Gao, “Robu st parameter estimation of aggregate thermal dynamic model: A privacy- preserved approach,” CSEE Journal of Power and Energy Systems , 2025
work page 2025
-
[5]
Modeling and control of buildin g-integrated microgrids for optimal energy management–a review,
H. Fontenot and B. Dong, “Modeling and control of buildin g-integrated microgrids for optimal energy management–a review,” Appl. Energy, vol. 254, p. 113689, 2019
work page 2019
-
[6]
Y . Guo, Y . Li, S. Zhou, Z. Zhang, Y . Wang, Y . Xu, X. Y ang, Z. L i, and M. Shahidehpour, “Optimal dispatch for integrated ener gy system considering data-driven dynamic energy hubs and thermal dy namics of pipeline networks,” IEEE Transactions on Smart Grid , 2024
work page 2024
-
[7]
J. Niu, Z. Tian, Y . Lu, and H. Zhao, “Flexible dispatch of a building en- ergy system using building thermal storage and battery ener gy storage,” Appl. Energy , vol. 243, pp. 274–287, 2019
work page 2019
-
[8]
State space modeling and control of aggregated tcls for regulatio n services in power grids,
M. Song, C. Gao, M. Shahidehpour, Z. Li, J. Y ang, and H. Y an , “State space modeling and control of aggregated tcls for regulatio n services in power grids,” IEEE Trans. Smart Grid , vol. 10, no. 4, pp. 4095–4106, 2018
work page 2018
Show all 28 references
-
[9]
Optimal participation of residential aggregators in energy and loc al flexibility markets,
C. A. Correa-Florez, A. Michiorri, and G. Kariniotakis, “Optimal participation of residential aggregators in energy and loc al flexibility markets,” IEEE Trans. Smart Grid , vol. 11, no. 2, pp. 1644–1656, 2019
2019
-
[10]
Data-dri ven aggregate thermal dynamic model for buildings: A regressio n approach,
S. Lu, W. Gu, S. Ding, S. Y ao, H. Lu, and X. Y uan, “Data-dri ven aggregate thermal dynamic model for buildings: A regressio n approach,” IEEE Trans. Smart Grid , vol. 13, no. 1, pp. 227–242, 2021
2021
-
[11]
Day-a head scheduling of integrated electricity and district heating system with an aggregated model of buildings for wind power accommodation ,
R. Zhang, T. Jiang, W. Li, G. Li, H. Chen, and X. Li, “Day-a head scheduling of integrated electricity and district heating system with an aggregated model of buildings for wind power accommodation ,” IET Renewable Power Gener ., vol. 13, no. 6, pp. 982–989, 2019
2019
-
[12]
Tang and S
H. Tang and S. Wang, “Multi-level optimal dispatch stra tegy and profit- sharing mechanism for unlocking energy flexibilities of non -residential building clusters in electricity markets of multiple flexib ility services,” Renewable Energy, vol. 201, pp. 35–45, 2022
2022
-
[13]
A survey on smart agriculture: Development modes , tech- nologies, and security and privacy challenges,
X. Y ang, L. Shu, J. Chen, M. A. Ferrag, J. Wu, E. Nurellari , and K. Huang, “A survey on smart agriculture: Development modes , tech- nologies, and security and privacy challenges,” IEEE/CAA J. Autom. Sin., vol. 8, no. 2, pp. 273–302, 2021
2021
-
[14]
An admm-enabled robust optim ization framework for self-healing scheduling of smart grids integ rated with smart prosumers,
P . Zhang, S. A. Mansouri, A. R. Jordehi, M. Tostado-V´ el iz, Y . Z. Alharthi, and M. Safaraliev, “An admm-enabled robust optim ization framework for self-healing scheduling of smart grids integ rated with smart prosumers,” Applied Energy , vol. 363, p. 123067, 2024
2024
-
[15]
Admm based privacy-pre serving decentralized optimization,
C. Zhang, M. Ahmad, and Y . Wang, “Admm based privacy-pre serving decentralized optimization,” IEEE Trans. Inf. F orensics Secur ., vol. 14, no. 3, pp. 565–580, 2018
2018
-
[16]
Diff eren- tially private admm algorithms for machine learning,
F. Shang, T. Xu, Y . Liu, H. Liu, L. Shen, and M. Gong, “Diff eren- tially private admm algorithms for machine learning,” IEEE Trans. Inf. F orensics Secur ., vol. 16, pp. 4733–4745, 2021
2021
-
[17]
Dif- ferentially private distributed algorithm for energy shar ing game with generalized demand bidding,
H. Liu, S. Lei, L. Zhang, Y . Huang, H. Zhang, and C. Peng, “ Dif- ferentially private distributed algorithm for energy shar ing game with generalized demand bidding,” in 2024 IEEE Power & Energy Society General Meeting (PESGM) . IEEE, 2024, pp. 1–5
2024
-
[18]
Dp-adm m: Admm-based distributed learning with differential privac y,
Z. Huang, R. Hu, Y . Guo, E. Chan-Tin, and Y . Gong, “Dp-adm m: Admm-based distributed learning with differential privac y,” IEEE Trans. Inf. F orensics Secur ., vol. 15, pp. 1002–1012, 2019
2019
-
[19]
Differentially private optimal power flow for distributio n grids,
V . Dvorkin, F. Fioretto, P . V an Hentenryck, P . Pinson, and J. Kazempour, “Differentially private optimal power flow for distributio n grids,” IEEE Trans. Power Syst. , vol. 36, no. 3, pp. 2186–2196, 2020
2020
-
[20]
Privacy-preserving distributed optimal power flow with partially homomorphic encryption,
T. Wu, C. Zhao, and Y .-J. A. Zhang, “Privacy-preserving distributed optimal power flow with partially homomorphic encryption,” IEEE Trans. Smart Grid , vol. 12, no. 5, pp. 4506–4521, 2021
2021
-
[21]
Privacy-aware quadratic optimiz ation using partially homomorphic encryption,
Y . Shoukry, K. Gatsis, A. Alanwar, G. J. Pappas, S. A. Ses hia, M. Sri- vastava, and P . Tabuada, “Privacy-aware quadratic optimiz ation using partially homomorphic encryption,” in 2016 IEEE 55th Conference on Decision and Control (CDC) . IEEE, 2016, pp. 5053–5058
2016
-
[22]
S. Xin, Q. Guo, J. Wang, C. Chen, H. Sun, and B. Zhang, “Inf orma- tion masking theory for data protection in future cloud-bas ed energy LU, et al.: INTEGRA TING BUILDING THERMAL FLEXIBILITY INTO D ISTRIBUTION SYSTEM: A PRIV ACY -PRESERVED DISPA TCH APPROACH 11 management,” IE...
2017
-
[23]
Chance-constrained o pf: A distributed method with confidentiality preservation,
M. Jia, G. Hug, Y . Su, and C. Shen, “Chance-constrained o pf: A distributed method with confidentiality preservation,” IEEE Trans. Power Syst., vol. 38, no. 4, pp. 3373–3387, 2022
2022
-
[24]
A transformation-based multi-area dynamic eco nomic dispatch approach for preserving information privacy of individual areas,
L. Wu, “A transformation-based multi-area dynamic eco nomic dispatch approach for preserving information privacy of individual areas,” IEEE Trans. Smart Grid , vol. 10, no. 1, pp. 722–731, 2017
2017
-
[25]
A critical overview of privacy- preserving approaches for collaborative forecasting,
C. Gonc ¸alves, R. J. Bessa, and P . Pinson, “A critical overview of privacy- preserving approaches for collaborative forecasting,” Int. J. F orecasting, vol. 37, no. 1, pp. 322–342, 2021
2021
-
[26]
An iterative linear distflo w for dynamic optimization in distributed generation planning studies,
R. Rigo-Mariani and V . V ai, “An iterative linear distflo w for dynamic optimization in distributed generation planning studies, ” International Journal of Electrical Power & Energy Systems , vol. 138, p. 107936, 2022
2022
-
[27]
Robust operation o f microgrids via two-stage coordinated energy storage and direct load co ntrol,
C. Zhang, Y . Xu, Z. Y . Dong, and J. Ma, “Robust operation o f microgrids via two-stage coordinated energy storage and direct load co ntrol,” IEEE Trans. Power Syst. , vol. 32, no. 4, pp. 2858–2868, 2016
2016
-
[28]
Parameter settings: 33 and 141 bus distribution systems,
Z. Hou and S. Lu, “Parameter settings: 33 and 141 bus distribution systems,” 2025. [Online]. Available: https://github.com/GreatTM/ZeyinHou--Data-for-Integ rating-Building-Thermal-Flexibility-Into-Distributi on-System Shuai Lu (Member, IEEE) is currently an Associate Professor...
2025
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.