  This paper studies initial-value privacy problems of linear dynamical
systems. We consider a standard linear time-invariant system with random
process and measurement noises. For such a system, eavesdroppers having access
to system output trajectories may infer the system initial states, leading to
initial-value privacy risks. When a finite number of output trajectories are
eavesdropped, we consider a requirement that any guess about the initial values
can be plausibly denied. When an infinite number of output trajectories are
eavesdropped, we consider a requirement that the initial values should not be
uniquely recoverable. In view of these two privacy requirements, we define
differential initial-value privacy and intrinsic initial-value privacy,
respectively, for the system as metrics of privacy risks. First of all, we
prove that the intrinsic initial-value privacy is equivalent to
unobservability, while the differential initial-value privacy can be achieved
for a privacy budget depending on an extended observability matrix of the
system and the covariance of the noises. Next, the inherent network nature of
the considered linear system is explored, where each individual state
corresponds to a node and the state and output matrices induce interaction and
sensing graphs, leading to a network system. Under this network system
perspective, we allow the initial states at some nodes to be public, and
investigate the resulting intrinsic initial-value privacy of each individual
node. We establish necessary and sufficient conditions for such individual node
initial-value privacy, and also prove that the intrinsic initial-value privacy
of individual nodes is generically determined by the network structure. These
results may be extended to linear systems with time-varying dynamics under the
same analysis framework.
