Search NASA⌕ Search

SEARCH · Search NASA

Results for “privacy”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Privacy Preserving Federated Learning for Advanced Scientific Ecosystems

We present a framework to provide privacy preserving (PP) federating learning (FL) across multiple computational and experimental facilities. This work joins the compute capabilities of National Energy Research Scientific Computing Center (NERSC) and Oak Ridge National Laboratory Research Cloud (ORC) with simulated experimental data, such as those produced at the SLAC National Accelerator Laboratory and Spallation Neutron Source (SNS). We describe the software infrastructure developed to provide privacy for computational and experimental networks. We developed algorithmic privacy across the federated system by embedding database security, computation, and communication into the federation architecture, utilizing scientific tools developed by the experimental community.

Archibald, Rick [ORNL] (ORCID:0000000245389780)↗
DOE OSTI2025

Enhancing Smart Home Privacy: A Tutorial on Local Differential Privacy Techniques for Frequency and Mean Estimation

The ubiquity of Internet of Things (IoT) systems has seamlessly integrated into our daily lives, particularly in smart homes where devices continuously monitor and optimize our living environments. These systems significantly contribute to home automation, energy efficiency, and overall comfort. However, this widespread connectivity poses inherent risks linked to the streaming of sensitive household data, necessitating robust privacy preservation mechanisms. This tutorial systematically examines privacy preservation through local differential privacy (LDP), with a particular focus on frequency and mean estimation techniques for smart home applications. Here, we present a comprehensive taxonomy of smart home data formats and provide detailed implementation guidance for event-based and w-event LDP mechanisms. Through practical examples using smart thermostats and HVAC systems, we demonstrate how these techniques can be effectively deployed in real-world scenarios. The tutorial concludes by examining emerging research directions, including adaptive privacy budgets and federated learning approaches, establishing a foundation for privacy-preserving smart home deployments.

Kotevska, Olivera [Oak Ridge National Laboratory (↗
DOE OSTI2025

Engineering Privacy at the Edge: A Practical Guide to Differential Privacy in System Architectures

The rapid expansion of distributed and edge computing platforms—spanning autonomous vehicles, IoT sensors, and healthcare monitors—has heightened concerns about data privacy. Differential Privacy (DP) offers a rigorous mathematical framework to protect sensitive information while retaining analytical utility. This tutorial introduces the foundations of DP for both numerical and categorical datasets and extends the discussion to correlation-aware techniques tailored for structured and high-dimensional data. Hands-on demonstrations will begin with the PETINA (Privacy prEservaTIoN Algorithms) package for numerical data and continue with MIC-DP (Maximum Information Correlated Differential Privacy) for tabular data. Designed for researchers and practitioners in secure systems, embedded architectures, and AI accelerators, the tutorial emphasizes practical and scalable methods for integrating DP into real-world system designs.

Kotevska, Olivera [ORNL] (ORCID:0000000316772243)↗
NASA NTRS2015

Space in Space: Designing for Privacy in the Workplace

Privacy is cultural, socially embedded in the spatial, temporal, and material aspects of the lived experience. Definitions of privacy are as varied among scholars as they are among those who fight for their personal rights in the home and the workplace. Privacy in the workplace has become a topic of interest in recent years, as evident in discussions on Big Data as well as the shrinking office spaces in which people work. An article in The New York Times published in February of this year noted that "many companies are looking to cut costs, and one way to do that is by trimming personal space". Increasingly, organizations ranging from tech start-ups to large corporations are downsizing square footage and opting for open-office floorplans hoping to trim the budget and spark creative, productive communication among their employees. The question of how much is too much to trim when it comes to privacy, is one that is being actively addressed by the National Aeronautics and Space Administration (NASA) as they explore habitat designs for future space missions. NASA recognizes privacy as a design-related stressor impacting human health and performance. Given the challenges of sustaining life in an isolated, confined, and extreme environment such as Mars, NASA deems it necessary to determine the acceptable minimal amount for habitable volume for activities requiring at least some level of privacy in order to support optimal crew performance. Ethnographic research was conducted in 2013 to explore perceptions of privacy and privacy needs among astronauts living and working in space as part of a long-distance, long-duration mission. The allocation of space, or habitable volume, becomes an increasingly complex issue in outer space due to the costs associated with maintaining an artificial, confined environment bounded by limitations of mass while located in an extreme environment. Privacy in space, or space in space, provides a unique case study of the complex notions of privacy, the impact of design and others on achieving it, and the sensemaking that occurs when privacy is less than expected. The findings show that privacy is not just a personal, individual need but is also a need that is shared among teams and groups. Moreover, the case of space in space reveals the influence the design of the built and social environments have on privacy needs and on achieving privacy. When the level of privacy is less than expected, sensemaking occurs and the lack of privacy is dealt with by means of absencing the present. creating new social norms, and "making space" by manipulating the spatial, temporal, material aspects of the lived experience. Although the Mars habitat study represents an extreme case of privacy in the workplace, lessons learned from outer space are applicable to life in the Earth-bound workplace. A mini-case study was conducted to evaluate office space at the headquarters of a major American airline that illustrates the usefulness of building unexpected bridges between the unknown, unfamiliar Mars habitat and the everyday workplace. The comparative studies reveal insight into the interconnected, social nature of the spatial, temporal, and material aspects of the lived experience and how users of the habitat and office workspace view privacy, self, and others through an embodied, design interaction.

Akin, Jonie↗
DOE OSTI2026

Differential Privacy in Grid Kitchen: Implementation & Software Documentation

Sharing of power grid feeder models faces significant challenges due to the potential risk of exposing sensitive operational information. Traditional anonymization techniques have shown notable limitations in other sensitive domains, as evidenced by documented re-identification attacks that combine supposedly anonymized datasets with auxiliary information, raising concerns that similar vulnerabilities could affect power grid data. Consequently, there is a pressing need for a more rigorous privacy protection strategy that not only delivers formal mathematical guarantees but also preserves the analytical value of the shared models. To address this challenge, we have enhanced the Grid Kitchen framework by implementing differential privacy mechanisms within the distribution model dehydration pipeline. This implementation carefully calibrates and applies noise to sensitive attributes in feeder models according to configurable privacy levels—low, moderate, and high—each offering different balances between data utility and privacy protection. Our approach uses established noise functions (Gaussian for continuous data and Discrete Laplace for integer values) with parameters carefully calibrated so that the impact of individual data points is effectively masked in the final output. The integration leverages our Noise Catalog, which we developed to categorize feeder model properties by component type, data type, and sensitivity. This catalog guides the application of appropriate noise functions and privacy parameters ($\varepsilon$ and $\delta$) to each attribute, ensuring consistent privacy protection across the model while maintaining its structural integrity and analytical usefulness. This implementation also includes evaluation tools that allow model owners to assess the impact of privacy-preserving transformations before sharing data with external parties. This report provides documentation for the differential privacy capabilities added to the Grid Kitchen project. It includes a primer on differential privacy concepts and their importance in modern data sharing, details the architecture of our implementation, explains the privacy modes and parameter configurations, and offers practical guidance on using the code for applying differential privacy to grid feeder models. Through examples and code snippets, we demonstrate the effective application of these privacy-enhancing technologies, enabling utility operators and researchers to confidently share grid data while protecting sensitive information.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

MIC-DP: A Scalable Correlation-Aware Differential Privacy Framework for High-Dimensional Data

Conventional differential privacy (DP) assumes record independence, limiting effectiveness on real-world datasets with temporal, spatial, or structural correlations. These dependencies undermine privacy guarantees and degrade utility in domains like healthcare, IoT, and smart city analytics. We propose Maximum Information Correlated Differential Privacy (MIC-DP), a novel framework that dynamically calibrates noise based on statistical dependencies. MIC-DP uses the Maximum Information Coefficient (MIC) to capture both linear and nonlinear correlations without explicit modeling, enabling adaptive sensitivity adjustment and improved privacy–utility trade-offs. Evaluations on healthcare (MIMIC), demographic (ACI), and synthetic datasets show that MIC-DP reduces mean absolute error (MAE) by up to 5.2% under strict privacy budgets (ϵ≤1), with aggregate utility improvements reaching 18% across datasets and evaluation metrics. MIC-DP provides formal (ϵ,δ)-privacy guarantees, scales efficiently with feature count, and supports deployment in moderate-scale, privacy-sensitive applications. Its tunable performance and runtime efficiency make MIC-DP suitable for privacy-sensitive applications where low-latency analytics and strong privacy guarantees must coexist. These results demonstrate MIC-DP’s effectiveness as a correlation-aware solution for practical DP.

Yang, Wenjun [Univ. of Washington, Tacoma, WA (Uni↗
DOE OSTI2026

Optimal Client Sampling in Federated Learning with Client-level Heterogeneous Differential Privacy

Federated Learning with client-level differential privacy (DP) provides a promising framework for collaboratively training models while rigorously protecting clients’ privacy. However, classic approaches like DP-FedAvg struggle when clients have heterogeneous privacy requirements, as they must uniformly enforce the strictest privacy level across all clients, leading to excessive DP noise and significant degradation in model utility. Existing methods to improve the model utility in such heterogeneous privacy settings often assume a trusted server and are largely heuristic, resulting in suboptimal performance and lacking strong theoretical foundations. Here, in this work, we address these challenges under a practical attack model where both clients and the server are honest-but-curious. We propose GDPFed, which partitions clients into groups based on their privacy budgets and achieves client-level DP within each group to reduce the privacy budget waste and hence improve the model utility. Based on the privacy and convergence analysis of GDPFed, we find that the magnitude of DP noise depends on both model dimensionality and the per-group client sampling ratios. To further improve the performance of GDPFed, we introduce GDPFed+, which integrates model sparsification to eliminate unnecessary noise and optimizes per-group client sampling ratios to minimize convergence error. Extensive empirical evaluations on multiple benchmark datasets demonstrate the effectiveness of GDPFed+, showing substantial performance gains compared with state-of-the-art methods.

Xu, Jiahao [Univ. of Nevada, Reno, NV (United Stat↗
DOE OSTI2025

Balancing Trade-offs: Adaptive Differential Privacy in Interpretable Machine Learning Models

In the advancing field of machine learning, balancing accuracy, interpretability, and privacy represents a significant challenge. The problem is exacerbated by the widespread deployment of pre-trained models locally in diverse applications, which could lead to various amounts of privacy leakage. Conventional Differential Privacy strategies, in which uniform noises are applied to model gradients, guarantee data privacy at the expense of accuracy and interpretability. This paper introduces a Feature-Sensitive Adaptive Differential Privacy (FADP) framework with a unique noise-adding strategy. Noises are adaptively added based on feature importance clustering, where important features are considered for interpretability. By employing a unique masking technique, FADP selectively preserves crucial features with minimal noise interference, maintaining accuracy while enhancing interpretability. The FADP framework addresses the limitations of traditional DP methods by preserving critical channels and improving interpretability — a vital requirement in machine learning applications that demand transparency in model decisions. Through comprehensive testing, FADP is shown to balance the trade-offs among accuracy, privacy, and interpretability, marking a substantial advancement in the field of privacy-preserving machine learning.

Farhad Riya, Farhin [University of Tennessee, Knox↗
DOE OSTI2026

IntraShuffler: A Privacy Preserving Framework for Heterogeneous DP Federated Learning

Heterogeneous Differential Privacy (HDP) in Federated Learning (FL) allows clients to select individual privacy budgets () according to institutional policies and data sensitivity. In practice, many HDP-FL systems employ -aware server aggregation to improve model utility by re-weighting client updates according to their declared privacy budgets. However, gradient updates in FL retain structural patterns induced by non-independent and identically-distributed (non-IID) data, and these additional signals exposed by -aware aggregation create new opportunities for inference by an honest-but-curious server. In this work, we first show that a server equipped with gradient denoising and surrogate modeling can mount a Privacy Inference Attack that infers distributional attributes of clients and links updates from the same client across training rounds, measured via surrogate inference accuracy and linkage success, under realistic knowledge constraints. The Shuffle-Model has been widely studied as a defense against such inference risks by anonymizing update sources, but it is fundamentally incompatible with HDP-FL -aware aggregation. To address this challenge, we propose IntraShuffler, a middleware defense framework designed for HDP-FL systems. IntraShuffler introduces a privacy-aware shuffling mechanism that groups clients into privacy-compatible buckets and performs parameter-level shuffling within each bucket to disrupt persistent gradient structure while preserving -aware aggregation. Experiments across four different datasets show that IntraShuffler reduces gradient recoverability by over 60% and decreases surrogate inference accuracy from 0.78 to 0.33 while maintaining comparable model utility across multiple FL aggregation rules.

Riya, Farhin Farhad [ORNL]↗
DOE OSTI2024

Privacy-Preserving Federated Learning for Science: Challenges and Research Directions

This paper discusses the key challenges and future research directions for privacy-preserving federated learning (PPFL), with a focus on its application to large-scale scientific AI models, in particular, foundation models~(FMs). PPFL enables collaborative model training across distributed datasets while preserving privacy-- an important collaborative approach for science. We discuss the need for efficient and scalable algorithms to address the increasing complexity of FMs, particularly when dealing with heterogeneous clients. In addition, we underscore the need for developing advance privacy-preserving techniques, such as differential privacy, to balance privacy and utility in large FMs emphasizing fairness and incentive mechanisms to ensure equitable participation among heterogeneous clients. Finally, we emphasize the need for a robust software stack supporting scalable and secure PPFL deployments across multiple high-performance computing facilities. We envision that PPFL would play a crucial role to advance scientific discovery and enable large-scale, privacy-aware collaborations across science domains.

Kim, Kibaek [Argonne National Laboratory (ANL)]↗
DOE OSTI2025

Exploring the Utility-Privacy Trade-Off: Impacts of Semantic and Visit Types Ambiguities on Human Mobility Simulation

Humans are in perpetual movement, constantly traversing buildings, cities, waters, oceans, and countries. Mobility stands out as a major driving force shaping our modern societies. Capturing and explaining human behavior in a world of eight billion distinct mobility agendas is a complex challenge. With the rise of interconnected devices and platforms, such as smartphones, wearables, and point-of-interest data, largescale behavioral data has become more accessible, enabling rich insights into mobility patterns. However, the widespread availability of such data introduces significant ethical challenges. Detailed mobility data can inadvertently reveal sensitive personal information, including individuals' locations, habits, social interactions, and even political or religious affiliations. Beyond privacy breaches, the ethical implications of uncovering and potentially manipulating underlying behavioral patterns demand attention. Striking a balance between the utility of mobility models and the protection of individual privacy is therefore paramount. This paper explores the utility-privacy trade-offs in human mobility modeling, focusing on the impacts of introducing semantic and visit type ambiguities. By systematically examining how these ambiguities affect the fidelity of simulated trajectories and privacy risks, we provide a framework for evaluating ethical and privacy-conscious modeling practices. Our findings emphasize the need for methods that safeguard privacy without undermining the usefulness of mobility models, contributing to the responsible advancement of mobility science in alignment with ethical standards and societal expectations.

Amichi, Licia [ORNL] (ORCID:0000000177631394)↗
DOE OSTI2026

Heterogeneous Multi-Domain Dataset Synthesis to Facilitate Privacy and Risk Assessments in Smart City IoT

The emergence of the Smart Cities paradigm and the rapid expansion and integration of Internet of Things (IoT) technologies within this context have created unprecedented opportunities for high-resolution behavioral analytics, urban optimization, and context-aware services. However, this same proliferation intensifies privacy risks, particularly those arising from cross-modal data linkage across heterogeneous sensing platforms. To address these challenges, this paper introduces a comprehensive, statistically grounded framework for generating synthetic, multimodal IoT datasets tailored to Smart City research. The framework produces behaviorally plausible synthetic data suitable for preliminary privacy risk assessment and as a benchmark for future re-identification studies, as well as for evaluating algorithms in mobility modeling, urban informatics, and privacy-enhancing technologies. As part of our approach, we formalize probabilistic methods for synthesizing three heterogeneous and operationally relevant data streams—cellular mobility traces, payment terminal transaction logs, and Smart Retail nutrition records—capturing the behaviors of a large number of synthetically generated urban residents over a 12-week period. The framework integrates spatially explicit merchant selection using K-Dimensional (KD)-tree nearest-neighbor algorithms, temporally correlated anchor-based mobility simulation reflective of daily urban rhythms, and dietary-constraint filtering to preserve ecological validity in consumption patterns. In total, the system generates approximately 116 million mobility pings, 5.4 million transactions, and 1.9 million itemized purchases, yielding a reproducible benchmark for evaluating multimodal analytics, privacy-preserving computation, and secure IoT data-sharing protocols. To show the validity of this dataset, the underlying distributions of these residents were successfully validated against reported distributions in published research. We present preliminary uniqueness and cross-modal linkage indicators; comprehensive re-identification benchmarking against specific attack algorithms is planned as future work. This framework can be easily adapted to various scenarios of interest in Smart Cities and other IoT applications. By aligning methodological rigor with the operational needs of Smart City ecosystems, this work fills critical gaps in synthetic data generation for privacy-sensitive domains, including intelligent transportation systems, urban health informatics, and next-generation digital commerce infrastructures.

IoT↗
DOE OSTI2025

A Privacy First Path Analysis using Clickstream Data

In the modern digital economy, data-driven decision making is crucial for effectively meeting the ever-evolving demands of consumer engagement and satisfaction. Clickstream data has become invaluable for understanding customer behavior, yet concerns over privacy and security persist, especially with some internet service providers profiting from its sale. This article introduces an innovative methodology that blends experiential learning with advanced cryptographic techniques, including differential privacy and graph analytics. The core objective of this methodology is to estimate Customer Lifetime Value (CLV) by analyzing clickstream data, achieving an average prediction accuracy of 92.4% in user engagement levels while ensuring user anonymity through Recency, Frequency, and Monetary (RFM) analysis. Our study introduces the concept of a “data depositor” and a privacy manager, employing the composition theorem to merge non-adaptive queries effectively. Privacy budgets (? = 1.0, d = 10-5), sensitivity-specific techniques, and data partitioning were applied. Randomization and noise addition protect data integrity, with special handling for categorical values. This approach, differing from prior studies, offers a 12.6% improvement in privacy-preserving targeting accuracy while maintaining strict confidentiality, presenting a novel path forward in data-driven decision-making.

Frequency and Monetary (RFM) analysis↗
NASA NTRS1988

Implications of privacy needs and interpersonal distancing mechanisms for space station design

Isolation, confinement, and the characteristics of microgravity will accentuate the need for privacy in the proposed NASA space station, yet limit the mechanism available for achieving it. This study proposes a quantitative model for understanding privacy, interpersonal distancing, and performance, and discusses the practical implications for Space Station design. A review of the relevant literature provided the basis for a database, definitions of physical and psychological distancing, loneliness, and crowding, and a quantitative model of situational privacy. The model defines situational privacy (the match between environment and task), and focuses on interpersonal contact along visual, auditory, olfactory, and tactile dimensions. It involves summing across pairs of crew members, contact dimensions, and time, yet also permits separate analyses of subsets of crew members and contact dimensions. The study concludes that performance will benefit when the type and level of contact afforded by the environment align with that required by the task. The key to achieving this is to design a flexible, definable, and redefinable interior environment that provides occupants with a wide array of options to meet their needs for solitude, limited social interaction, and open group activity. The report presents 49 recommendations in five categories to promote a wide range of privacy options despite the space station's volumetric limitations.

Harrison, Albert A.↗
DOE OSTI2025

Privacy-Aware RAG-Enabled LLMs for Collaborative AI in Organizations

Recent advancements in Large Language Models (LLMs) based on Transformer architectures have significantly improved capabilities in natural language processing and generation. However, deploying LLMs for inter-organizational communication poses challenges, in ensuring privacy and facilitating effective collaboration. This paper introduces a novel decentralized inference meta-agent chatbot that leverages privacy-aware Retrieval-Augmented Generation (RAG)-enabled LLMs for collaborative AI communication across organizations. Built on Microsoft’s Autogen, the platform enables LLMs to autonomously refine responses, enhancing accuracy and relevance. It incorporates advanced hallucination mitigation techniques using Uptrain and a privacy-focused RAG framework that employs synthetic document generation to protect sensitive information. Comprehensive evaluations demonstrate the platform’s effectiveness in maintaining contextual relevance and stringent privacy standards, effectively addressing critical challenges in LLM-enhanced collaborative AI communication. This work represents a significant step toward secure and efficient inter-organizational collaboration using advanced generative AI technologies.

97 - MATHEMATICS AND COMPUTING↗
DOE OSTI2026

Roadmap and Benchmarking: Privacy in Federated Load Forecasting

Data-driven techniques for energy demand forecasting continue to emerge with promising impacts on distribution grid planning. However, the development of robust and generalizable machine learning models requires that representative high quality training data are available. Distributed energy resources have begun to embed intelligence, gathering large amounts of data on customer demand, behavior, and household devices that are connected to the grid. Though utilities aggregate meter-level demand data for load shaping, demand response, outage management, reliability planning, and billing applications, there lies an inherent privacy concern in sharing consumption data that may identify individual consumer behavioral patterns. Hence, while sharing the data is crucial, the private sensitive customer data must be safeguarded from being exposed or manipulated. In this study, we propose a roadmap for implementing a based privacy preserving framework to support the advancement of data-driven analytics in data-sensitive distributed energy resources environments. The roadmap incorporates federated learning–a distributed training framework, differential privacy–a statistical framework that provides guarantees to safeguard the leakage of sensitive data, secure multiparty computation and homomorphic encryption– techniques for encrypting model gradients and applying secure aggregation on the server. Moreover, we perform baseline experiments on the federated short-term load forecasting (STLF) task using open-source residential load profile datasets, offering insights into the challenges of integrating differential privacy into federated learning.

Abebe, Waqwoya [Oak Ridge National Laboratory (ORN↗
NASA NTRS1985

Implications of privacy needs and interpersonal distancing mechanisms for space station design

Privacy needs, or the need of people to regulate their degree of contact with one another, and interpersonal distancing mechanisms, which serve to satisfy these needs, are common in all cultures. Isolation, confinement, and other conditions accociated with space flight may at once accentuate privacy needs and limit the availability of certain common interpersonal contact. Loneliness occurs when people have less contact with one another than they desire. Crowding occurs when people have more contact with one another than they desire. Crowding, which is considered the greater threat to members of isolated and confined groups, can contribute to stress, a low quality of life, and poor performance. Drawing on the general literature on privacy, personal space, and interpersonal distancing, and on specialized literature on life aboard spacecraft and in spacecraft-analogous environments, a quantitative model for understanding privacy, interpersonal distancing, loneliness, and crowding was developed and the practical implications of this model for space station design were traced.

Harrison, A. A.↗
NASA NTRS1988

Incorporation of privacy elements in space station design

Privacy exists to the extent that individuals can control the degree of social contact that they have with one another. The opportunity to withdraw from other people serves a number of important psychological and social functions, and is in the interests of safety, high performance, and high quality of human life. Privacy requirements for Space Station crew members are reviewed, and architectual and other guidelines for helping astronauts achieve desired levels of privacy are suggested. In turn, four dimensions of privacy are discussed: the separation of activities by areas within the Space Station, controlling the extent to which astronauts have visual contact with one another, controlling the extent to which astronauts have auditory contact with one another, and odor control. Each section presents a statement of the problem, a review of general solutions, and specific recommendations. The report is concluded with a brief consideration of how selection, training, and other procedures can also help Space Station occupants achieve satisfactory levels of seclusion.

Harrison, Albert A.↗