Statistical Privacy-Preserving Distributed Online Aggregative Games via Mirror Descent with Correlated Perturbations

Abstract

Distributed online aggregative games are widely used to model sequential decision-making problems in dynamic networked systems. However, the repeated information exchange required by distributed algorithms may disclose players’ sensitive local data. This paper investigates a privacy-preserving distributed online aggregative game over multi-agent networks. A distributed online mirror descent algorithm with correlated perturbations is developed to protect local private information. Under standard assumptions, an expected dynamic regret bound and a statistical privacy guarantee are established for the proposed algorithm. Numerical results demonstrate the effectiveness of the proposed algorithm and reveal the tradeoff between privacy protection and algorithmic performance.

1. Introduction

Sequential decision making over networks arises in resource allocation, energy coordination, communication systems, and other large-scale cyber-physical platforms. In such settings, each agent acts online: future objective functions are unknown, decisions are updated repeatedly, and only local information is available at each stage. Online optimization and online game models therefore provide a natural mathematical language for describing system evolution, while regret serves as the main performance criterion over a finite horizon [1,2,3,4]. When centralized computation is impractical, distributed algorithms are preferable because they require only local processing and neighbor-to-neighbor exchanges [5,6]. Recent application-oriented studies further highlight the broad relevance of online and dynamic decision making in networked engineering systems, including online knowledge seeking in technical R&D teams [7], online computation offloading for collaborative space/aerial-aided edge computing [8], and fine-grained air traffic flow prediction [9]. These studies show that online decision making, dynamic information processing, and networked coordination have found applications in a wide range of fields.

Among distributed interaction models, aggregative games are especially important because each player’s cost depends on its own decision and on an aggregate term generated by the entire population. This structure appears in charging coordination, congestion management, and shared-resource allocation. Distributed equilibrium computation for aggregative games has been widely studied [10,11,12,13]. The online case is more subtle: objective functions and equilibria may both vary with time, so the main issue is equilibrium tracking rather than convergence to a fixed point. Recent contributions published in Mathematics reflect this development from several complementary viewpoints. Yang et al. considered distributed online aggregative optimization in an unknown dynamic environment, Huo et al. studied sampled data average consensus tracking, He et al. proposed event-triggered Nash equilibrium seeking schemes, and Cao et al. investigated privacy-preserving distributed learning based on a Newton mechanism [14,15,16,17]. These results motivate a unified treatment of online game dynamics, consensus tracking, and privacy protection.

In distributed implementations, each player repeatedly communicates local estimates or auxiliary states. Even if a single message carries limited information, the entire communication history may reveal sensitive features of local objectives, decision trajectories, or underlying datasets. Differential privacy and noise injection mechanisms have therefore become standard ingredients in distributed learning, optimization, and consensus [18,19,20,21,22,23,24]. For online aggregative games, however, one still needs a perturbation mechanism that hides transmitted information without destroying the aggregate-tracking structure used by the distributed algorithm.

Among the existing studies on privacy-preserving online aggregative games, the work of Lin et al. [25] is relevant to our setting. In [25], a statistical privacy-preserving online distributed Nash equilibrium tracking algorithm was developed for aggregative games by using correlated perturbations and a privacy criterion based on the Kullback–Leibler divergence. The present paper follows the same statistical privacy viewpoint, but differs from [25] in the algorithmic framework and the corresponding theoretical analysis. Specifically, ref. [25] is based on a Euclidean projected gradient update, whereas this paper develops a distributed online mirror descent method with a general Bregman divergence. Moreover, many existing algorithms rely on Euclidean projection updates, which may be less suitable for structured feasible sets such as simplex or probability constraints [26,27,28]. Therefore, it is still necessary to develop a privacy-preserving distributed online aggregative-game algorithm that can simultaneously handle dynamic equilibrium tracking, non-Euclidean decision geometry, and statistical privacy protection. To further clarify the relationship between the present paper and representative related studies,

Table 1. Comparison with representative related works.

Work	Problem Setting	Method and Privacy Feature	Main Distinction
Yang et al. [14]	Distributed online aggregative optimization	Distributed online update with performance analysis; privacy is not the main focus	Does not address privacy-preserving online aggregative games.
Cao et al. [17]	Privacy-preserving distributed learning	Newton method with a privacy-preserving mechanism	Does not study online game equilibrium tracking.
Lin et al. [25]	Privacy-preserving online aggregative games	Euclidean projected gradient update; privacy with correlated perturbations	Closest to this paper, but only relies on Euclidean projection.
This paper	Privacy-preserving distributed online aggregative games	Distributed online mirror descent; privacy with correlated perturbations and KL-divergence-based statistical privacy	Integrates dynamic equilibrium tracking, non-Euclidean decision geometry, and statistical privacy protection.

provides a structured comparison from the perspectives of problem setting, algorithmic method, privacy mechanism, and main distinction.

Motivated by the above considerations, this paper studies a distributed online aggregative game in which a subset of players may be compromised and the remaining players seek protection of their local information. We adopt a statistical privacy criterion based on the Kullback–Leibler divergence and design a distributed online mirror descent algorithm equipped with correlated perturbations. The perturbations mask the exchanged aggregate estimates while preserving a balancing identity that is crucial for dynamic average tracking. Compared with Euclidean projection-based methods, the proposed mirror-descent framework allows a general Bregman divergence and is therefore better suited to structured feasible sets.

The main contributions are summarized as follows.

• We formulate a privacy-preserving distributed online aggregative game with corrupted players, where the goal is to track the time-varying Nash equilibrium while protecting the local information of the uncorrupted players. Statistical privacy is quantified by a Kullback–Leibler divergence criterion.
• We propose a privacy-preserving distributed online mirror descent algorithm with correlated perturbations. The correlated perturbations mask the exchanged aggregate estimates, while their balancing property preserves the dynamic average-tracking structure required by the distributed algorithm.
• We establish an expected dynamic regret bound for the proposed algorithm under a general Bregman geometry. Unlike Euclidean projection-based analyses, the proof relies on mirror descent updates and Bregman divergence arguments, and the resulting bound explicitly reflects the effects of the equilibrium path variation, the stepsizes, and the perturbation magnitudes.
• We prove a statistical privacy guarantee for the proposed algorithm by bounding the Kullback–Leibler divergence between the observation distributions generated by different datasets. Numerical simulations further demonstrate the tradeoff between privacy level and performance, and the simplex-constrained experiment illustrates the advantage of using a KL-divergence mirror update.

The remainder of this paper is organized as follows. Section 2 introduces the notation, privacy model, game formulation, and standing assumptions. Section 3 presents the privacy-preserving distributed online mirror descent algorithm. Section 4 develops the regret and privacy analysis. Section 5 reports numerical examples. Section 6 discusses the proposed algorithm, and Section 7 concludes the paper.

2. Notation, Privacy Model, and Game Formulation

Consider an undirected communication graph

$$\mathcal{G}=(\mathcal{V},\mathcal{E}),$$

where $\mathcal{V}=\{1,\dots ,N\}$ is the player set and $\mathcal{E}\subseteq \mathcal{V}\times \mathcal{V}$ is the edge set. If $e_{ij}\in \mathcal{E}$, then players i and j can exchange information. For each player i, let

$${\mathcal{N}}_i=\{j\in \mathcal{V}:e_{ij}\in \mathcal{E}\}$$

be its neighbor set. Throughout this paper, the graph is assumed to be connected. Let $W\in {\mathbb{R}}^{N\times N}$ be the mixing matrix associated with $\mathcal{G}$; thus, ${\left[W\right]}_{ij}>0$ if $e_{ij}\in \mathcal{E}$ and ${\left[W\right]}_{ij}=0$ otherwise.

For player $i\in \mathcal{V}$ at time k, the decision variable is denoted by $x_{i,k}\in {\mathcal{X}}_i\subseteq {\mathbb{R}}^n$, and the stacked action vector is

$${\mathbf{x}}_k=col(x_{1,k},\dots ,x_{N,k}).$$

The aggregate term is written as $\sigma \left({\mathbf{x}}_k\right)$. For notational convenience, we also use

$${\mathbf{x}}_{-i,k}=col(x_{1,k},\dots ,x_{i-1,k},x_{i+1,k},\dots ,x_{N,k})$$

for the profile of all players except player i.

2.1. Statistical Privacy

We begin with two graph-theoretic objects that will be used in the privacy analysis.

Definition 1. 

A subset $\mathcal{S}\subset \mathcal{V}$ is called a vertex cut if removing the nodes in $\mathcal{S}$ together with their incident edges disconnects $\mathcal{G}$.

Fix an arbitrary orientation of the edges of $\mathcal{G}$ and index them as $e_q$, $q=1,\dots ,\left|\mathcal{E}\right|$.

Definition 2. 

The oriented incidence matrix $D\in {\mathbb{R}}^{N\times \left|\mathcal{E}\right|}$ is defined by

$${\left[D\right]}_{i,q}=\left\{\begin{array}{cc}1,\hfill & \mathit{\text{if}}\mathit{\text{node}}i\mathit{\text{is}}\mathit{\text{the}}\mathit{\text{head}}\mathit{\text{of}}{e}_q,\hfill \\ -1,\hfill & \mathit{\text{if}}\mathit{\text{node}}i\mathit{\text{is}}\mathit{\text{the}}\mathit{\text{tail}}\mathit{\text{of}}{e}_q,\hfill \\ 0,\hfill & \mathit{\text{otherwise}}.\hfill \end{array}\right.$$

The graph Laplacian is $L=D{D}^{\top }$. Its spectral decomposition can be written as

$$L=Udiag({\lambda }_1,{\lambda }_2,\dots ,{\lambda }_N)U^{\top },$$

where U is orthogonal and $0={\lambda }_1<{\lambda }_2\le \cdots \le {\lambda }_N$. The Moore–Penrose inverse is therefore

$$L^{†}=Udiag\left(0,{\displaystyle \frac{1}{{\lambda }_2}},\dots ,{\displaystyle \frac{1}{{\lambda }_N}}\right)U^{\top }.$$

Let $\mathcal{C}$ and $\mathcal{H}$ denote the compromised-player set and the honest-player set, respectively. Over a time horizon T, the adversary collects an observation record

$$\mathsf{O}={\left\{{\mathsf{O}}_k\right\}}_{k=1}^T$$

from the compromised players, where ${\mathsf{O}}_k$ is the information available at time k. The underlying dataset is denoted by $\mathsf{D}$. Privacy is interpreted as indistinguishability: if two candidate datasets can generate the same observation record, then the adversary should find them difficult to distinguish. We measure this indistinguishability with the Kullback–Leibler divergence. For two probability measures P and Q, the Kullback–Leibler divergence is defined by

$$D_{\mathrm{KL}}(P\parallel Q)=\left\{\begin{array}{cc}{\displaystyle \int log\left(\frac{dP}{dQ}\right)dP,}\hfill & P\ll Q,\hfill \\ +\infty ,\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

When P and Q admit densities $h_p$ and $h_{p^{\prime }}$ with respect to a common dominating measure, we also write

$$D_{\mathrm{KL}}(h_p,h_{p^{\prime }})=\int h_p\left(z\right)log{\displaystyle \frac{h_p\left(z\right)}{h_{p^{\prime }}\left(z\right)}}dz.$$

Definition 3 

([25]). Given two datasets ${\mathsf{D}}_1$ and ${\mathsf{D}}_2$, an algorithm $\mathcal{A}$ is said to preserve the statistical privacy of the honest players if

$$\mathsf{O}=\mathcal{A}\left({\mathsf{D}}_1\right)=\mathcal{A}\left({\mathsf{D}}_2\right)$$

and the quantity

$$D_{\mathrm{KL}}\left(h_{\mathsf{O}\mid {\mathsf{D}}_1},h_{\mathsf{O}\mid {\mathsf{D}}_2}\right)$$

is bounded.

Remark 1. 

The private information considered in this paper is the local information of the honest players. This information may determine their local cost functions, gradients, unmasked aggregate estimates, and local decision trajectories. Public system parameters, such as the communication graph, the stepsizes, and the perturbation magnitudes, are not regarded as private. The mechanism is also not intended to protect the corrupted players’ own data or internal states. Its purpose is to prevent the communication transcript from uniquely revealing the honest players’ local information.

Remark 2. 

The equality condition in Definition 3 should be understood as an observational compatibility condition rather than as equality of two output distributions. It means that the same realized observation record O available to the adversary can be generated by two different candidate datasets, possibly under different realizations of the hidden perturbations. The KL divergence then quantifies the statistical distinguishability of these two candidate explanations from the adversary’s viewpoint. For example, in an additive-noise mechanism $O=\theta +\xi$, the same observed value can be compatible with two different values of θ, provided that the hidden noise takes different values. The privacy leakage is not zero in general; it is measured by the likelihood ratio, or equivalently by the KL divergence between the induced observation distributions.

Adversary model: The adversary is assumed to be honest-but-curious. The compromised players follow the prescribed algorithm, but share all their available information. At each time k, they know the algorithm and public parameters, observe their own local data and states, and observe the messages and perturbation variables on edges incident to them. However, they do not observe the honest players’ unmasked variables, nor the perturbation variables generated on edges whose two endpoints are both honest. Hence, after conditioning on the compromised players’ observations, the hidden perturbations among honest players provide the residual uncertainty used in the statistical privacy analysis.

2.2. Game Formulation

At each stage k, player i minimizes a time-varying cost $f_{i,k}$ that depends on its own action and on an aggregate of all players’ actions. Because the environment is dynamic, the stage game and its Nash equilibrium may change with k. The goal is to construct a distributed online algorithm that uses only local communication, tracks the time-varying equilibrium, and protects the information of the honest players.

For player i, we measure online performance by the expected dynamic regret over the horizon T,

$${\mathrm{Reg}}_i\left(T\right)\triangleq {\displaystyle \sum _{k=1}^T}\mathbb{E}\left[f_{i,k}\left(x_{i,k},\sigma (x_{i,k},{\mathbf{x}}_{-i,k}^{\ast })\right)-f_{i,k}\left(x_{i,k}^{\ast },\sigma \left({\mathbf{x}}_k^{\ast }\right)\right)\right],$$

where ${\mathbf{x}}_k^{\ast }$ is the Nash equilibrium of the stage-k game and ${\mathbf{x}}_{-i,k}^{\ast }$ is the equilibrium profile of all players except player i.

2.3. Assumptions

Let $\omega$ be the mirror map, and let

$$D(\xi ,\zeta )\triangleq \omega \left(\xi \right)-\omega \left(\zeta \right)-\langle \nabla \omega \left(\zeta \right),\xi -\zeta \rangle$$

denote the associated Bregman divergence. For each player $i\in \mathcal{V}$ and each time k, define

$$\begin{array}{cc}\hfill & g_{i,k}(x_{i,k},y_{i,k})\triangleq \left({\nabla }_{x_{i,k}}{f}_{i,k}(·,\beta )+{\displaystyle \frac{1}{N}}{\nabla }_{\beta }{f}_{i,k}(x_{i,k},·)\right){|}_{\beta =y_{i,k}},\hfill \\ \hfill & {\varphi }_{i,k}\left({\mathbf{x}}_k\right)\triangleq {\nabla }_{x_{i,k}}{f}_{i,k}\left(x_{i,k},\sigma \left({\mathbf{x}}_k\right)\right),\hfill \\ \hfill & {\varphi }_k\left({\mathbf{x}}_k\right)\triangleq col\left({\varphi }_{1,k}\left({\mathbf{x}}_k\right),\dots ,{\varphi }_{N,k}\left({\mathbf{x}}_k\right)\right).\hfill \end{array}$$

When $y_{i,k}=\sigma \left({\mathbf{x}}_k\right)$, the two quantities coincide; i.e.,

$${\varphi }_{i,k}\left({\mathbf{x}}_k\right)=g_{i,k}\left(x_{i,k},\sigma \left({\mathbf{x}}_k\right)\right).$$

The next assumptions are standard in analyses of aggregative games, mirror descent, and distributed online optimization [10,25,29].

Assumption 1. 

The mirror map ω is ${\sigma }_{\omega }$-strongly convex with respect to $\parallel ·\parallel$, namely,

$$\omega \left(x\right)\ge \omega \left(y\right)+\langle \nabla \omega \left(y\right),x-y\rangle +{\displaystyle \frac{{\sigma }_{\omega }}{2}}{\parallel x-y\parallel }^2.$$

Assumption 2. 

There exists $G>0$ such that

$$\parallel g_{i,k}(x_{i,k},y_{i,k})\parallel \le G,\forall y_{i,k}\in {\mathbb{R}}^n,$$

for all players i and all stages k.

Assumption 3. 

For every player i and every fixed $x_i\in {\mathcal{X}}_i$, the mapping $z\mapsto g_{i,k}(x_i,z)$ is $L_i$-Lipschitz on ${\mathbb{R}}^n$; i.e.,

$$\parallel g_{i,k}(x_i,z_1)-g_{i,k}(x_i,z_2)\parallel \le L_i\parallel z_1-z_2\parallel ,\forall z_1,z_2\in {\mathbb{R}}^n.$$

Assumption 4. 

The pseudo-gradient mapping ${\varphi }_k$ is μ-strongly monotone on ${\mathcal{X}}_1\times \cdots \times {\mathcal{X}}_N$ for some $\mu >0$, namely,

$${\left({\varphi }_k\left(\mathbf{x}\right)-{\varphi }_k\left(\mathbf{y}\right)\right)}^{\top }(\mathbf{x}-\mathbf{y})\ge \mu {\parallel \mathbf{x}-\mathbf{y}\parallel }^2$$

for all $\mathbf{x},\mathbf{y}\in {\mathcal{X}}_1\times \cdots \times {\mathcal{X}}_N$.

Assumption 5. 

For each $i\in \left[N\right]$ and each $\zeta \in {\mathcal{X}}_i$, the function $D(·,\zeta )$ is K-Lipschitz on ${\mathcal{X}}_i$; i.e.,

$$|D({\xi }_1,\zeta )-D({\xi }_2,\zeta )|\le K\parallel {\xi }_1-{\xi }_2\parallel ,\forall {\xi }_1,{\xi }_2\in {\mathcal{X}}_i.$$

Assumption 6. 

The graph $\mathcal{G}$ is undirected and connected, and the weight matrix W is doubly stochastic:

$$W{1}_N=1_N,1_N^{\top }W=1_N^{\top }.$$

3. Our Proposed Algorithm

To track the time-varying Nash equilibrium while preserving the statistical privacy of the uncorrupted players, we propose a privacy-preserving distributed online mirror descent algorithm. The proposed method combines online mirror descent with dynamic average consensus, and incorporates a correlated perturbation mechanism to mask the exchanged aggregate estimates.

The detailed procedure is presented in Algorithm 1. For each player $i\in \mathcal{V}$, let the initial action be $x_{i,0}\in {\mathbb{R}}^n$ and let the initial aggregate estimate satisfy $y_{i,0}=x_{i,0}$. At each iteration k, player i first generates independent Gaussian noises for all its neighbors and constructs a correlated perturbation by aggregating the differences between the received and transmitted noises. This perturbation is then added to the local aggregate estimate before communication, so that the exchanged message is masked from the adversary’s viewpoint.

Algorithm 1 Privacy-Preserving Distributed Online Algorithm

Initialization: For each player $i\in \mathcal{V}$, initialize $x_{i,0}\in {\mathbb{R}}^n$ and $y_{i,0}=x_{i,0}$.

Iterations: For $k=0,1,\dots ,T$, each player i performs:

1:  For each neighbor $j\in {\mathcal{N}}_i$, generate an independent Gaussian noise $${\eta }_{ij,k}\sim \mathcal{N}({\mathbf{0}}_n,M_k^2{I}_n),$$    and compute the correlated perturbation $${\eta }_{i,k}=\sum _{j\in {\mathcal{N}}_i}({\eta }_{ji,k}-{\eta }_{ij,k}).$$

2:  Update the masked aggregate estimate: $${\tilde{y}}_{i,k}=y_{i,k}+{\eta }_{i,k}.$$

3:  Update the local action: $$x_{i,k+1}=\underset{x\in {\mathcal{X}}_i}{arg\; min}\left\{〈x,g_{i,k}(x_{i,k},y_{i,k})〉+{\displaystyle \frac{1}{{\alpha }_k}}D(x,x_{i,k})\right\}.$$

4:  Exchange ${\tilde{y}}_{i,k}$ with neighbors and update the aggregate estimate: $$y_{i,k+1}={\displaystyle \sum _{j=1}^N}{\left[W\right]}_{ij}{\tilde{y}}_{j,k}+x_{i,k+1}-x_{i,k}.$$

More specifically, for each neighbor $j\in {\mathcal{N}}_i$, player i generates an independent Gaussian noise ${\eta }_{ij,k}\sim \mathcal{N}({\mathbf{0}}_n,M_k^2{I}_n)$ and computes the correlated perturbation

$${\eta }_{i,k}=\sum _{j\in {\mathcal{N}}_i}({\eta }_{ji,k}-{\eta }_{ij,k}).$$

The masked aggregate estimate is then updated as

$${\tilde{y}}_{i,k}=y_{i,k}+{\eta }_{i,k}.$$

Based on the current local estimate $y_{i,k}$, player i updates its action via the mirror-descent step

$$x_{i,k+1}=\underset{x\in {\mathcal{X}}_i}{arg\; min}\left\{〈x,g_{i,k}(x_{i,k},y_{i,k})〉+{\displaystyle \frac{1}{{\alpha }_k}}D(x,x_{i,k})\right\}.$$

After exchanging ${\tilde{y}}_{i,k}$ with its neighbors, player i updates its aggregate estimate according to

$$y_{i,k+1}={\displaystyle \sum _{j=1}^N}{\left[W\right]}_{ij}{\tilde{y}}_{j,k}+x_{i,k+1}-x_{i,k}.$$

The above mechanism preserves privacy by masking the communicated aggregate estimates, while still allowing each player to maintain an accurate estimate of the aggregate action through dynamic average consensus. In particular, the correlated perturbation is globally balanced, since

$${\displaystyle \sum _{i=1}^N}{\eta }_{i,k}={\displaystyle \sum _{i=1}^N}\sum _{j\in {\mathcal{N}}_i}({\eta }_{ji,k}-{\eta }_{ij,k})=0_n.$$

Therefore, although the individual aggregate estimates are perturbed before transmission, the average of the aggregate estimates remains unchanged. This property is essential for achieving both privacy preservation and aggregate tracking performance.

For better readability, Figure 1 provides a visual summary of the proposed privacy-preserving distributed online algorithm. At each iteration, each player first generates pairwise Gaussian noises and constructs a correlated perturbation. The perturbation is added to the local aggregate estimate before communication, so that the exchanged message is masked. After forming the masked aggregate estimate, each player first computes the next decision by the mirror-descent update. Then the masked aggregate estimates are exchanged with neighboring players, and the local aggregate estimate is updated through the dynamic average consensus step. This process is repeated over the time horizon and jointly achieves online equilibrium tracking and privacy protection.

Remark 3. 

The pairwise noise-exchange step is an auxiliary protocol for implementing the correlated perturbation. For each ordered pair $(i,j)$ and each time k, the variable ${\eta }_{ij,k}$ is sampled independently of all local private data, cost functions, gradients, decisions, and aggregate estimates. Hence, revealing ${\eta }_{ij,k}$ to its neighboring endpoint does not directly disclose private information. In the adversarial model considered in this paper, corrupted players may observe all messages and all pairwise noise variables on edges incident to them. These observed variables are therefore conditioned on in the privacy analysis. The privacy guarantee relies only on the residual randomness of pairwise noises on edges whose two endpoints are both honest.

4. Main Results

This section derives two theoretical properties of the proposed algorithm, including the regret bound and the statistical privacy guarantee.

4.1. Regret Analysis

We first give the deviation of the local action by mirror descent update.

Lemma 1. 

Under Assumptions 1 and 2, each player $i\in \mathcal{V}$ satisfies

$$\parallel x_{i,k+1}-x_{i,k}\parallel \le {\displaystyle \frac{{\alpha }_{k}G}{{\sigma }_{\omega }}},k\ge 0.$$

Proof. 

Optimality of the mirror update implies that, for any $x\in {\mathcal{X}}_i$,

$$〈g_{i,k}(x_{i,k},y_{i,k})+{\displaystyle \frac{1}{{\alpha }_k}}\left(\nabla \omega \left(x_{i,k+1}\right)-\nabla \omega \left(x_{i,k}\right)\right),x-x_{i,k+1}〉\ge 0.$$

Choosing $x=x_{i,k}$ and using the ${\sigma }_{\omega }$-strong convexity of $\omega$ gives

$${\displaystyle \frac{{\sigma }_{\omega }}{{\alpha }_k}}\parallel x_{i,k+1}-x_{i,k}{\parallel }^2\le \parallel g_{i,k}(x_{i,k},y_{i,k})\parallel \parallel x_{i,k+1}-x_{i,k}\parallel .$$

Assumption 2 then yields the claim. □

The next lemma shows that the balancing property of the perturbations preserves the network average.

Lemma 2. 

Under Assumptions 1–6,

$${\overline{y}}_k={\overline{x}}_k,\forall k\ge 0,$$

where

$${\overline{y}}_k\triangleq {\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{y}_{i,k},{\overline{x}}_k\triangleq {\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{x}_{i,k}.$$

Proof. 

From Algorithm 1,

$$y_{i,k+1}={\displaystyle \sum _{j=1}^N}{w}_{ij}(y_{j,k}+{\eta }_{j,k})+x_{i,k+1}-x_{i,k}.$$

Summing over i and using the double stochasticity of W gives

$${\displaystyle \sum _{i=1}^N}{y}_{i,k+1}={\displaystyle \sum _{i=1}^N}{y}_{i,k}+{\displaystyle \sum _{i=1}^N}{\eta }_{i,k}+{\displaystyle \sum _{i=1}^N}{x}_{i,k+1}-{\displaystyle \sum _{i=1}^N}{x}_{i,k}.$$

Because ${\sum }_{i=1}^N{\eta }_{i,k}=\mathbf{0}$, we obtain

$${\overline{y}}_{k+1}={\overline{y}}_k+{\overline{x}}_{k+1}-{\overline{x}}_k.$$

Since $y_{i,0}=x_{i,0}$ for all i, we have ${\overline{y}}_0={\overline{x}}_0$, and induction completes the proof. □

We next estimate the disagreement between a local aggregate estimate and the network average.

Lemma 3. 

Under Assumptions 1–6, for every player $i\in \mathcal{V}$ and every $k\ge 1$,

$$\mathbb{E}\parallel y_{i,k}-{\overline{x}}_k\parallel \le \sqrt{N}{\gamma }^k{P}_1+{\displaystyle \frac{\sqrt{N}G}{{\sigma }_{\omega }}}{\displaystyle \sum _{l=0}^{k-1}}{\gamma }^{k-l-1}{\alpha }_l+\sqrt{N}{\displaystyle \sum _{l=0}^{k-1}}{\gamma }^{k-l}\mathbb{E}{\parallel {\eta }_l\parallel }_{\infty },$$

where $P_1\triangleq {max}_{j\in \mathcal{V}}\parallel y_{j,0}\parallel$ and $\gamma \in (0,1)$ is the contraction factor associated with W.

Proof. 

Denote

$$\begin{array}{cc}\hfill {\mathbf{y}}_k& =col(y_{1,k},\dots ,y_{N,k}),\hfill \\ \hfill {\mathbf{x}}_k& =col(x_{1,k},\dots ,x_{N,k}),\hfill \\ \hfill {\mathsf{\eta }}_k& =col({\eta }_{1,k},\dots ,{\eta }_{N,k}).\hfill \end{array}$$

In vector form, the update of the aggregate estimate can be written as

$${\mathbf{y}}_{k+1}=W{\mathbf{y}}_k+W{\mathsf{\eta }}_k+{\mathbf{x}}_{k+1}-{\mathbf{x}}_k.$$

By recursion,

$${\mathbf{y}}_k=W^k{\mathbf{y}}_0+{\displaystyle \sum _{l=0}^{k-1}}{W}^{k-l}{\mathsf{\eta }}_l+{\displaystyle \sum _{l=0}^{k-1}}{W}^{k-l-1}({\mathbf{x}}_{l+1}-{\mathbf{x}}_l).$$

On the other hand, by Lemma 2,

$${\overline{x}}_k={\overline{y}}_k={\displaystyle \frac{1}{N}}{1}_N^{\top }{\mathbf{y}}_k.$$

Hence,

$$\begin{array}{cc}\hfill y_{i,k}-{\overline{x}}_k=& {\displaystyle \sum _{j=1}^N}\left({\left[W^k\right]}_{ij}-{\displaystyle \frac{1}{N}}\right)y_{j,0}+{\displaystyle \sum _{j=1}^N}{\displaystyle \sum _{l=0}^{k-1}}\left({\left[W^{k-l}\right]}_{ij}-{\displaystyle \frac{1}{N}}\right){\eta }_{j,l}\hfill \\ & +{\displaystyle \sum _{j=1}^N}{\displaystyle \sum _{l=0}^{k-1}}\left({\left[W^{k-l-1}\right]}_{ij}-{\displaystyle \frac{1}{N}}\right)(x_{j,l+1}-x_{j,l}).\hfill \end{array}$$

Taking norms and expectations, and using the standard mixing estimate

$${\displaystyle \sum _{j=1}^N}\left|{\left[W^s\right]}_{ij}-{\displaystyle \frac{1}{N}}\right|\le \sqrt{N}{\gamma }^s,s\ge 0,$$

we obtain

$$\mathbb{E}\parallel y_{i,k}-{\overline{x}}_k\parallel \le \sqrt{N}{\gamma }^k{P}_1+{\displaystyle \sum _{l=0}^{k-1}}\sqrt{N}{\gamma }^{k-l}\mathbb{E}\parallel {\eta }_l{\parallel }_{\infty }+{\displaystyle \sum _{l=0}^{k-1}}\sqrt{N}{\gamma }^{k-l-1}\mathbb{E}{\parallel {\mathbf{x}}_{l+1}-{\mathbf{x}}_l\parallel }_{\infty }.$$

By Lemma 1,

$$\mathbb{E}\parallel {\mathbf{x}}_{l+1}-{\mathbf{x}}_l{\parallel }_{\infty }\le {\displaystyle \frac{G}{{\sigma }_{\omega }}}{\alpha }_l.$$

Substituting this estimate into the above inequality yields the desired result. □

The following identity of the Bregman divergence will be used repeatedly.

Lemma 4. 

For any vectors $a,b,c$,

$$\langle a-b,\nabla \omega \left(b\right)-\nabla \omega \left(c\right)\rangle =D(a,c)-D(a,b)-D(b,c).$$

Lemma 5. 

Under Assumption 5, for each player $i\in \mathcal{V}$ and each $k>0$,

$$D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k}^{\ast },x_{i,k+1})\le D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k+1}^{\ast },x_{i,k+1})+K\parallel x_{i,k+1}^{\ast }-x_{i,k}^{\ast }\parallel .$$

Proof. 

Insert and subtract $D(x_{i,k+1}^{\ast },x_{i,k+1})$:

$$\begin{array}{cc}& D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k}^{\ast },x_{i,k+1})\hfill \\ \hfill =& D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k+1}^{\ast },x_{i,k+1})+\left(D(x_{i,k+1}^{\ast },x_{i,k+1})-D(x_{i,k}^{\ast },x_{i,k+1})\right).\hfill \end{array}$$

The second term is bounded by the Lipschitz property of $D(·,x_{i,k+1})$ from Assumption 5, which gives the result. □

We then give the regret bound.

Theorem 1. 

Suppose Assumptions 1–6 hold. Then the expected dynamic regret of Algorithm 1 satisfies

$${\mathrm{Reg}}_i\left(T\right)=O\left(\sqrt{T\left({\displaystyle \frac{{\mathcal{V}}_T+1}{{\alpha }_T}}+\sum _{k=1}^T{\alpha }_k+\sum _{k=1}^T{M}_k\right)}\right),$$

where

$${\mathcal{V}}_T\triangleq {\displaystyle \sum _{k=1}^{T-1}}\parallel {\mathbf{x}}_{k+1}^{\ast }-{\mathbf{x}}_k^{\ast }\parallel$$

denotes the path variation of the equilibrium sequence.

Proof. 

Denote

$${\delta }_{i,k}=y_{i,k}-\sigma \left({\mathbf{x}}_k\right).$$

For the average aggregative game considered in this paper, $\sigma \left({\mathbf{x}}_k\right)={\overline{x}}_k$, and hence Lemma 3 can be applied to ${\delta }_{i,k}$.

By the convexity of $f_{i,k}$ and the boundedness of the corresponding gradient in Assumption 2, we have

$$\begin{array}{cc}& f_{i,k}\left(x_{i,k},\sigma (x_{i,k},{\mathbf{x}}_{-i,k}^{\ast })\right)-f_{i,k}\left(x_{i,k}^{\ast },\sigma \left({\mathbf{x}}_k^{\ast }\right)\right)\le G\parallel x_{i,k}-x_{i,k}^{\ast }\parallel .\hfill \end{array}$$

Therefore,

$${\mathrm{Reg}}_i\left(T\right)\le G{\displaystyle \sum _{k=1}^T}\mathbb{E}\parallel x_{i,k}-x_{i,k}^{\ast }\parallel \le G\sqrt{T\sum _{k=1}^T\mathbb{E}{\parallel {\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }\parallel }^2}.$$

Thus, it remains to bound ${\sum }_{k=1}^T\mathbb{E}{\parallel {\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }\parallel }^2$.

From the optimality condition of the mirror descent update, for any $x\in {\mathcal{X}}_i$,

$$〈g_{i,k}(x_{i,k},y_{i,k})+{\displaystyle \frac{1}{{\alpha }_k}}\left(\nabla \omega \left(x_{i,k+1}\right)-\nabla \omega \left(x_{i,k}\right)\right),x-x_{i,k+1}〉\ge 0.$$

Taking $x=x_{i,k}^{\ast }$ gives

$${\alpha }_k〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k+1}-x_{i,k}^{\ast }〉\le 〈x_{i,k}^{\ast }-x_{i,k+1},\nabla \omega \left(x_{i,k+1}\right)-\nabla \omega \left(x_{i,k}\right)〉.$$

By the three-point identity of the Bregman divergence in Lemma 4,

$$\begin{array}{cc}& {\alpha }_k〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k+1}-x_{i,k}^{\ast }〉\le D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k}^{\ast },x_{i,k+1})-D(x_{i,k+1},x_{i,k}).\hfill \end{array}$$

Since

$$x_{i,k+1}-x_{i,k}^{\ast }=x_{i,k}-x_{i,k}^{\ast }+x_{i,k+1}-x_{i,k},$$

we obtain

$$\begin{array}{cc}& {\alpha }_k〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k}-x_{i,k}^{\ast }〉\hfill \\ \hfill \le & D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k}^{\ast },x_{i,k+1})+{\alpha }_k〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k}-x_{i,k+1}〉.\hfill \end{array}$$

Using Assumption 2 and Lemma 1, the last term satisfies

$${\alpha }_k〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k}-x_{i,k+1}〉\le {\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }}}.$$

Hence,

$$\begin{array}{cc}& {\alpha }_k〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k}-x_{i,k}^{\ast }〉\hfill \\ \hfill \le & D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k}^{\ast },x_{i,k+1})+{\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }}}.\hfill \end{array}$$

Applying Lemma 5 further gives

$$\begin{array}{cc}& {\alpha }_k〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k}-x_{i,k}^{\ast }〉\hfill \\ \hfill \le & D(x_{i,k}^{\ast },x_{i,k})-D(x_{i,k+1}^{\ast },x_{i,k+1})+K\parallel x_{i,k+1}^{\ast }-x_{i,k}^{\ast }\parallel +{\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }}}.\hfill \end{array}$$

Next, we lower bound the left-hand side. Since

$${\varphi }_{i,k}\left({\mathbf{x}}_k\right)=g_{i,k}(x_{i,k},\sigma \left({\mathbf{x}}_k\right)),$$

we have

$$\begin{array}{cc}& {\displaystyle \sum _{i=1}^N}〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k}-x_{i,k}^{\ast }〉\hfill \\ \hfill =& 〈{\varphi }_k\left({\mathbf{x}}_k\right),{\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }〉+{\displaystyle \sum _{i=1}^N}〈g_{i,k}(x_{i,k},y_{i,k})-g_{i,k}(x_{i,k},\sigma \left({\mathbf{x}}_k\right)),x_{i,k}-x_{i,k}^{\ast }〉.\hfill \end{array}$$

Since ${\mathbf{x}}_k^{\ast }$ is the Nash equilibrium of the stage-k game, it satisfies the variational inequality

$$〈{\varphi }_k\left({\mathbf{x}}_k^{\ast }\right),\mathbf{x}-{\mathbf{x}}_k^{\ast }〉\ge 0,\forall \mathbf{x}\in {\mathcal{X}}_1\times \cdots \times {\mathcal{X}}_N.$$

Taking $\mathbf{x}={\mathbf{x}}_k$ and using the strong monotonicity of ${\varphi }_k$ yields

$$〈{\varphi }_k\left({\mathbf{x}}_k\right),{\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }〉\ge \mu {\parallel {\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }\parallel }^2.$$

Moreover, by Assumption 3,

$$∥g_{i,k}(x_{i,k},y_{i,k})-g_{i,k}(x_{i,k},\sigma \left({\mathbf{x}}_k\right))∥\le L_i\parallel {\delta }_{i,k}\parallel .$$

Let $L_{max}={max}_{i\in \mathcal{V}}{L}_i$. By Assumption 2, $\parallel {\varphi }_k\left(\mathbf{x}\right)\parallel \le \sqrt{N}G$ for all feasible $\mathbf{x}$. Combining this bound with the strong monotonicity of ${\varphi }_k$ gives a uniform tracking bound

$$\parallel {\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }\parallel \le {\displaystyle \frac{2\sqrt{N}G}{\mu }}\triangleq B_e.$$

Therefore,

$$\begin{array}{cc}& {\displaystyle \sum _{i=1}^N}〈g_{i,k}(x_{i,k},y_{i,k}),x_{i,k}-x_{i,k}^{\ast }〉\ge \mu \parallel {\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }{\parallel }^2-L_{max}{B}_e{\displaystyle \sum _{i=1}^N}\parallel {\delta }_{i,k}\parallel .\hfill \end{array}$$

Combining the preceding upper and lower bounds and summing over all players gives, for $k=1,\dots ,T-1$,

$$\begin{array}{cc}\hfill \mu \parallel {\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }{\parallel }^2\le & {\displaystyle \frac{A_k-A_{k+1}}{{\alpha }_k}}+{\displaystyle \frac{K}{{\alpha }_k}}{\displaystyle \sum _{i=1}^N}\parallel x_{i,k+1}^{\ast }-x_{i,k}^{\ast }\parallel \hfill \\ & +{\displaystyle \frac{N{G}^2}{{\sigma }_{\omega }}}{\alpha }_k+L_{max}{B}_e{\displaystyle \sum _{i=1}^N}\parallel {\delta }_{i,k}\parallel ,\hfill \end{array}$$

where

$$A_k={\displaystyle \sum _{i=1}^N}D(x_{i,k}^{\ast },x_{i,k}).$$

For the terminal index $k=T$, we do not introduce $x_{T+1}^{\ast }$. Instead, using the inequality before applying Lemma 5 and the nonnegativity of the Bregman divergence, we obtain

$$\mu \parallel {\mathbf{x}}_T-{\mathbf{x}}_T^{\ast }{\parallel }^2\le {\displaystyle \frac{A_T}{{\alpha }_T}}+{\displaystyle \frac{N{G}^2}{{\sigma }_{\omega }}}{\alpha }_T+L_{max}{B}_e{\displaystyle \sum _{i=1}^N}\parallel {\delta }_{i,T}\parallel .$$

We now sum the above inequalities and take expectations. Since the stepsize sequence is nonincreasing,

$${\displaystyle \sum _{k=1}^{T-1}}{\displaystyle \frac{A_k-A_{k+1}}{{\alpha }_k}}+{\displaystyle \frac{A_T}{{\alpha }_T}}={\displaystyle \frac{A_1}{{\alpha }_1}}+{\displaystyle \sum _{k=2}^T}{A}_k\left({\displaystyle \frac{1}{{\alpha }_k}}-{\displaystyle \frac{1}{{\alpha }_{k-1}}}\right).$$

By the uniform boundedness of the Bregman divergence, there exists a constant $B_D>0$ such that $A_k\le B_D$ for all k. Therefore,

$${\displaystyle \sum _{k=1}^{T-1}}{\displaystyle \frac{A_k-A_{k+1}}{{\alpha }_k}}+{\displaystyle \frac{A_T}{{\alpha }_T}}\le {\displaystyle \frac{B_D}{{\alpha }_T}}.$$

Moreover,

$${\displaystyle \sum _{k=1}^{T-1}}{\displaystyle \frac{1}{{\alpha }_k}}{\displaystyle \sum _{i=1}^N}\parallel x_{i,k+1}^{\ast }-x_{i,k}^{\ast }\parallel \le {\displaystyle \frac{\sqrt{N}}{{\alpha }_T}}{\displaystyle \sum _{k=1}^{T-1}}\parallel {\mathbf{x}}_{k+1}^{\ast }-{\mathbf{x}}_k^{\ast }\parallel ={\displaystyle \frac{\sqrt{N}{\mathcal{V}}_T}{{\alpha }_T}}.$$

It remains to bound the aggregate-estimation error term. By Lemma 3,

$$\mathbb{E}\parallel {\delta }_{i,k}\parallel =\mathbb{E}\parallel y_{i,k}-{\overline{x}}_k\parallel \le \sqrt{N}{\gamma }^k{P}_1+{\displaystyle \frac{\sqrt{N}G}{{\sigma }_{\omega }}}{\displaystyle \sum _{l=0}^{k-1}}{\gamma }^{k-l-1}{\alpha }_l+\sqrt{N}{\displaystyle \sum _{l=0}^{k-1}}{\gamma }^{k-l}\mathbb{E}{\parallel {\mathsf{\eta }}_l\parallel }_{\infty }.$$

Since each perturbation component is Gaussian with standard deviation proportional to $M_l$, there exists a constant $C_{\eta }>0$, independent of l and T, such that

$$\mathbb{E}\parallel {\mathsf{\eta }}_l{\parallel }_{\infty }\le C_{\eta }{M}_l.$$

Using the geometric summability of ${\gamma }^k$, we obtain

$${\displaystyle \sum _{k=1}^T}{\displaystyle \sum _{i=1}^N}\mathbb{E}\parallel {\delta }_{i,k}\parallel =O\left(1+{\displaystyle \sum _{k=1}^T}{\alpha }_k+{\displaystyle \sum _{k=1}^T}{M}_k\right).$$

Combining the above estimates yields

$${\displaystyle \sum _{k=1}^T}\mathbb{E}{\parallel {\mathbf{x}}_k-{\mathbf{x}}_k^{\ast }\parallel }^2=O\left({\displaystyle \frac{{\mathcal{V}}_T+1}{{\alpha }_T}}+{\displaystyle \sum _{k=1}^T}{\alpha }_k+{\displaystyle \sum _{k=1}^T}{M}_k\right).$$

Substituting this bound into the regret estimate at the beginning of the proof gives

$${\mathrm{Reg}}_i\left(T\right)=O\left(\sqrt{T\left({\displaystyle \frac{{\mathcal{V}}_T+1}{{\alpha }_T}}+\sum _{k=1}^T{\alpha }_k+\sum _{k=1}^T{M}_k\right)}\right).$$

This completes the proof. □

Remark 4. 

The effectiveness of Algorithm 1 in a rapidly changing environment can be interpreted through the path variation term

$$V_T={\displaystyle \sum _{k=1}^{T-1}}\parallel x_{k+1}^{\ast }-x_k^{\ast }\parallel$$

in Theorem 1. This quantity measures the cumulative movement of the time-varying Nash equilibrium. A slowly varying environment corresponds to a small value of $V_T$, whereas a rapidly changing environment leads to a larger $V_T$.

From Theorem 1, the normalized dynamic regret satisfies

$${\displaystyle \frac{{\mathrm{Reg}}_i\left(T\right)}{T}}=O\left(\sqrt{{\displaystyle \frac{1}{T}}\left({\displaystyle \frac{{\mathcal{V}}_T+1}{{\alpha }_T}}+\sum _{k=1}^T{\alpha }_k+\sum _{k=1}^T{M}_k\right)}\right).$$

Therefore, the proposed algorithm can achieve vanishing average dynamic regret when

$${\displaystyle \frac{{\mathcal{V}}_T+1}{{\alpha }_T}}+{\displaystyle \sum _{k=1}^T}{\alpha }_k+{\displaystyle \sum _{k=1}^T}{M}_k=o\left(T\right).$$

For example, if ${\alpha }_k=O\left(k^{-1/2}\right)$ and $M_k=O\left(k^{-\beta }\right)$ with $0<\beta <1$, then

$${\displaystyle \frac{{\mathrm{Reg}}_i\left(T\right)}{T}}=O\left(\sqrt{{\displaystyle \frac{{\mathcal{V}}_T+1}{\sqrt{T}}}+T^{-1/2}+T^{-\beta }}\right).$$

Hence, when $V_T=o\left(T\right)$, the average dynamic regret converges to zero even though the equilibrium is time-varying. However, if the environment changes very rapidly so that $V_T=\mathsf{\Theta }\left(T\right)$, the bound predicts a non-vanishing average regret. This is consistent with the intrinsic difficulty of tracking a fast-moving equilibrium using only causal online information. In such cases, the algorithm can still operate in a distributed and privacy-preserving manner, but the tracking error and regret are expected to increase.

4.2. Statistical Privacy Guarantee

Assumption 7. 

The set of corrupted players $\mathcal{C}$ is not a vertex cut of the communication graph $\mathcal{G}$. Hence, the subgraph induced by the uncorrupted players, denoted by ${\mathcal{G}}_{\mathcal{H}}$, is connected.

We first characterize the distribution of the correlated perturbation.

Lemma 6. 

Suppose that the communication graph $\mathcal{G}$ is undirected and connected. For each edge $e_q=(i,j)$ with $i<j$, define

$${\eta }_{e_q,k}={\eta }_{ji,k}-{\eta }_{ij,k}.$$

Let ${\mathsf{\eta }}_{E,k}=col({\eta }_{e_1,k},\dots ,{\eta }_{e_{\left|\mathcal{E}\right|},k})$, and let D be the oriented incidence matrix of $\mathcal{G}$. Then, for each coordinate $\ell \in \left[n\right]$,

$${\left[{\mathsf{\eta }}_k\right]}_{\ell }\sim {\mathcal{N}}^{†}\left(0_N,2M_k^{2}L\right),$$

where

$${\mathsf{\eta }}_k=col({\eta }_{1,k},\dots ,{\eta }_{N,k}),$$

$L=D{D}^{\top }$ is the Laplacian matrix of $\mathcal{G}$, and ${\mathcal{N}}^{†}$ denotes the degenerate Gaussian distribution.

Proof. 

For each edge $e_q=(i,j)$ with $i<j$, since ${\eta }_{ij,k}$ and ${\eta }_{ji,k}$ are independent and both follow $\mathcal{N}(0_n,M_k^2{I}_n)$, one has

$${\eta }_{e_q,k}={\eta }_{ji,k}-{\eta }_{ij,k}\sim \mathcal{N}(0_n,2M_k^2{I}_n).$$

Hence, for each coordinate $\ell \in \left[n\right]$,

$${\left[{\eta }_{e_q,k}\right]}_{\ell }\sim \mathcal{N}(0,2M_k^2).$$

By the definition of the correlated perturbation,

$${\eta }_{i,k}=\sum _{j\in {\mathcal{N}}_i}({\eta }_{ji,k}-{\eta }_{ij,k}),$$

and thus, in vector form,

$${\mathsf{\eta }}_k=D{\mathsf{\eta }}_{E,k}.$$

Therefore,

$${\left[{\mathsf{\eta }}_k\right]}_{\ell }=D{\left[{\mathsf{\eta }}_{E,k}\right]}_{\ell }.$$

Since all edge noises are independent, it follows that

$$\mathbb{E}\left[{\left[{\mathsf{\eta }}_k\right]}_{\ell }\right]=0_N,$$

and

$$\mathrm{Cov}\left({\left[{\mathsf{\eta }}_k\right]}_{\ell }\right)=D\mathrm{Cov}\left({\left[{\mathsf{\eta }}_{E,k}\right]}_{\ell }\right)D^{\top }=2M_k^{2}D{D}^{\top }=2M_k^{2}L.$$

Hence,

$${\left[{\mathsf{\eta }}_k\right]}_{\ell }\sim {\mathcal{N}}^{†}\left(0_N,2M_k^{2}L\right).$$

This completes the proof. □

The next lemma shows that the Kullback–Leibler divergence between two candidate observations can be bounded by the distance between the corresponding aggregate-estimate vectors.

Lemma 7. 

Let ${\mathbf{y}}_k$ and ${\mathbf{y}}_k^{\prime }$ be two candidate aggregate-estimate vectors that lead to the same masked observation ${\tilde{\mathbf{y}}}_k$, that is,

$${\tilde{\mathbf{y}}}_k={\mathbf{y}}_k+{\mathsf{\eta }}_k={\mathbf{y}}_k^{\prime }+{\mathsf{\eta }}_k^{\prime }.$$

Then, for each coordinate $\ell \in \left[n\right]$,

$$D_{\mathrm{KL}}\left(h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k\right]}_{\ell }},h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell }}\right)\le {\displaystyle \frac{\parallel {\left[{\mathbf{y}}_k\right]}_{\ell }-{\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell }{\parallel }^2}{4M_k^2\underline{\lambda }\left(L\right)}},$$

where $\underline{\lambda }\left(L\right)$ denotes the smallest nonzero eigenvalue of L. Consequently,

$$D_{\mathrm{KL}}\left(h_{{\tilde{\mathbf{y}}}_k\mid {\mathbf{y}}_k},h_{{\tilde{\mathbf{y}}}_k\mid {\mathbf{y}}_k^{\prime }}\right)\le {\displaystyle \frac{\parallel {\mathbf{y}}_k-{\mathbf{y}}_k^{\prime }{\parallel }^2}{4M_k^2\underline{\lambda }\left(L\right)}}.$$

Proof. 

Since G is connected, we have

$$\mathcal{R}\left(L\right)=\{z\in {\mathbb{R}}^N:1_N^{\top }z=0\}.$$

By Lemma 6, for each coordinate $\ell \in \left[n\right]$, both ${\left[{\eta }_k\right]}_{\ell }$ and ${\left[{\eta }_k^{\prime }\right]}_{\ell }$ are supported on $\mathcal{R}\left(L\right)$. Hence the conditional laws of ${\left[{\tilde{y}}_k\right]}_{\ell }$ given ${\left[y_k\right]}_{\ell }$ and ${\left[y_k^{\prime }\right]}_{\ell }$ are supported on

$${\left[y_k\right]}_{\ell }+\mathcal{R}\left(L\right)\mathrm{and}{\left[y_k^{\prime }\right]}_{\ell }+\mathcal{R}\left(L\right),$$

respectively. Since the two candidate aggregate-estimate vectors lead to the same masked observation,

$${\tilde{y}}_k=y_k+{\eta }_k=y_k^{\prime }+{\eta }_k^{\prime },$$

we have, for each $\ell \in \left[n\right]$,

$${\left[y_k\right]}_{\ell }-{\left[y_k^{\prime }\right]}_{\ell }={\left[{\eta }_k^{\prime }\right]}_{\ell }-{\left[{\eta }_k\right]}_{\ell }\in \mathcal{R}\left(L\right).$$

Therefore,

$${\left[y_k\right]}_{\ell }+\mathcal{R}\left(L\right)={\left[y_k^{\prime }\right]}_{\ell }+\mathcal{R}\left(L\right),$$

which means that the two singular Gaussian measures have the same affine support. The densities below are understood with respect to the $(N-1)$-dimensional Lebesgue measure on this common affine support.

By Lemma 6, for each $\ell \in \left[n\right]$, the random vector ${\left[{\mathsf{\eta }}_k\right]}_{\ell }$ follows the degenerate Gaussian distribution

$${\mathcal{N}}^{†}(0_N,2M_k^{2}L).$$

Hence, the conditional density of ${\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }$ given ${\left[{\mathbf{y}}_k\right]}_{\ell }$ is

$$h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k\right]}_{\ell }}\left(z\right)={\displaystyle \frac{1}{\sqrt{{det}^{\ast }\left(4\pi M_k^{2}L\right)}}}exp\left(-{\displaystyle \frac{{(z-{\left[{\mathbf{y}}_k\right]}_{\ell })}^{\top }{L}^{†}(z-{\left[{\mathbf{y}}_k\right]}_{\ell })}{4M_k^2}}\right),$$

and similarly,

$$h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell }}\left(z\right)={\displaystyle \frac{1}{\sqrt{{det}^{\ast }\left(4\pi M_k^{2}L\right)}}}exp\left(-{\displaystyle \frac{{(z-{\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell })}^{\top }{L}^{†}(z-{\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell })}{4M_k^2}}\right).$$

Substituting the above densities into the definition of KLD yields

$$D_{\mathrm{KL}}\left(h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k\right]}_{\ell }},h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell }}\right)={\displaystyle \frac{1}{4M_k^2}}{({\left[{\mathbf{y}}_k\right]}_{\ell }-{\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell })}^{\top }{L}^{†}({\left[{\mathbf{y}}_k\right]}_{\ell }-{\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell }).$$

Since ${\left[y_k\right]}_{\ell }-{\left[y_k^{\prime }\right]}_{\ell }\in \mathcal{R}\left(L\right)$ and the eigenvalues of $L^{†}$ on $\mathcal{R}\left(L\right)$ are $1/{\lambda }_2\left(L\right),\dots ,1/{\lambda }_N\left(L\right)$, we have

$${({\left[y_k\right]}_{\ell }-{\left[y_k^{\prime }\right]}_{\ell })}^{\top }{L}^{†}({\left[y_k\right]}_{\ell }-{\left[y_k^{\prime }\right]}_{\ell })\le {\displaystyle \frac{\parallel {\left[y_k\right]}_{\ell }-{\left[y_k^{\prime }\right]}_{\ell }{\parallel }^2}{{\lambda }_2\left(L\right)}}.$$

Then, we obtain

$$D_{\mathrm{KL}}\left(h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k\right]}_{\ell }},h_{{\left[{\tilde{\mathbf{y}}}_k\right]}_{\ell }\mid {\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell }}\right)\le {\displaystyle \frac{\parallel {\left[{\mathbf{y}}_k\right]}_{\ell }-{\left[{\mathbf{y}}_k^{\prime }\right]}_{\ell }{\parallel }^2}{4M_k^2\underline{\lambda }\left(L\right)}}.$$

Summing over all coordinates $\ell \in \left[n\right]$ gives

$$D_{\mathrm{KL}}\left(h_{{\tilde{\mathbf{y}}}_k\mid {\mathbf{y}}_k},h_{{\tilde{\mathbf{y}}}_k\mid {\mathbf{y}}_k^{\prime }}\right)\le {\displaystyle \frac{\parallel {\mathbf{y}}_k-{\mathbf{y}}_k^{\prime }{\parallel }^2}{4M_k^2\underline{\lambda }\left(L\right)}}.$$

This completes the proof. □

We are now ready to establish the statistical privacy guarantee of Algorithm 1.

Theorem 2 (Statistical Privacy).

Suppose Assumptions 1–7 hold. Then, during the time horizon T, Algorithm 1 preserves the statistical privacy of the uncorrupted players. Specifically, for any $k\le T$,

$$D_{\mathrm{KL}}\left(h_{{\tilde{\mathbf{y}}}_{\mathcal{H},k}\mid {\mathbf{y}}_{\mathcal{H},k}},h_{{\tilde{\mathbf{y}}}_{\mathcal{H},k}\mid {\mathbf{y}}_{\mathcal{H},k}^{\prime }}\right)\le {\displaystyle \frac{N{G}^2{\alpha }_k^2}{{\sigma }_{\omega }^2\underline{\lambda }\left(L_{\mathcal{H}}\right)M_k^2}},$$

where $L_{\mathcal{H}}$ is the Laplacian matrix of the subgraph ${\mathcal{G}}_{\mathcal{H}}$ induced by the uncorrupted players, and $\underline{\lambda }\left(L_{\mathcal{H}}\right)$ denotes its smallest nonzero eigenvalue.

Proof. 

For each honest player $i\in \mathcal{H}$, decompose its perturbation as

$${\eta }_{i,k}=b_{i,k}+{\xi }_{i,k},$$

where

$$b_{i,k}=\sum _{j\in {\mathcal{N}}_i\cap \mathcal{C}}({\eta }_{ji,k}-{\eta }_{ij,k})$$

is the contribution from edges incident to corrupted players, and

$${\xi }_{i,k}=\sum _{j\in {\mathcal{N}}_i\cap \mathcal{H}}({\eta }_{ji,k}-{\eta }_{ij,k})$$

is the contribution from edges whose two endpoints are honest.

The variables $b_{i,k}$ are observed by the adversary and are therefore conditioned on in the privacy analysis. They act only as known deterministic shifts. Let

$${\widehat{y}}_{\mathcal{H},k}={\tilde{y}}_{\mathcal{H},k}-b_{\mathcal{H},k}.$$

Then

$${\widehat{y}}_{\mathcal{H},k}=y_{\mathcal{H},k}+{\xi }_{\mathcal{H},k}.$$

Since Assumption 7 guarantees that the honest-player subgraph ${\mathcal{G}}_{\mathcal{H}}$ is connected, Lemma 6 applied to ${\mathcal{G}}_{\mathcal{H}}$ gives, for each coordinate $\ell \in \left[n\right]$,

$${\left[{\xi }_{\mathcal{H},k}\right]}_{\ell }\sim {\mathcal{N}}^{†}(0,2M_k^2{L}_{\mathcal{H}}),$$

and

$${\left[{\xi }_{\mathcal{H},k}\right]}_{\ell }\in \mathcal{R}\left(L_{\mathcal{H}}\right).$$

Now consider two candidate honest-player datasets that generate the same observation record. Since $b_{\mathcal{H},k}$ is part of the conditioned adversarial observation, the same realization of $b_{\mathcal{H},k}$ is used for both candidates. Hence

$${\widehat{y}}_{\mathcal{H},k}=y_{\mathcal{H},k}+{\xi }_{\mathcal{H},k}=y_{\mathcal{H},k}^{\prime }+{\xi }_{\mathcal{H},k}^{\prime }.$$

Therefore, by Lemma 7 applied to the honest-player subgraph ${\mathcal{G}}_{\mathcal{H}}$,

$$D_{\mathrm{KL}}\left(h_{{\widehat{y}}_{\mathcal{H},k}|y_{\mathcal{H},k}},h_{{\widehat{y}}_{\mathcal{H},k}|y_{\mathcal{H},k}^{\prime }}\right)\le {\displaystyle \frac{\parallel y_{\mathcal{H},k}-y_{\mathcal{H},k}^{\prime }{\parallel }^2}{4M_k^2{\lambda }_2\left(L_{\mathcal{H}}\right)}}.$$

Since ${\widehat{y}}_{\mathcal{H},k}={\tilde{y}}_{\mathcal{H},k}-b_{\mathcal{H},k}$ differs from ${\tilde{y}}_{\mathcal{H},k}$ only by a known translation, the same KL bound holds for the conditional laws of ${\tilde{y}}_{\mathcal{H},k}$.

It remains to bound $\parallel {\mathbf{y}}_{\mathcal{H},k}-{\mathbf{y}}_{\mathcal{H},k}^{\prime }\parallel$.

From Algorithm 1, the aggregate-estimate update is

$${\mathbf{y}}_{k+1}=W{\tilde{\mathbf{y}}}_k+{\mathbf{x}}_{k+1}-{\mathbf{x}}_k.$$

Hence, for two candidate datasets generating the same masked estimate ${\tilde{\mathbf{y}}}_k$, one has

$${\mathbf{y}}_{k+1}-{\mathbf{y}}_{k+1}^{\prime }=({\mathbf{x}}_{k+1}-{\mathbf{x}}_k)-({\mathbf{x}}_{k+1}^{\prime }-{\mathbf{x}}_k^{\prime }).$$

Restricting the above equality to the uncorrupted players gives

$${\mathbf{y}}_{\mathcal{H},k+1}-{\mathbf{y}}_{\mathcal{H},k+1}^{\prime }=({\mathbf{x}}_{\mathcal{H},k+1}-{\mathbf{x}}_{\mathcal{H},k})-({\mathbf{x}}_{\mathcal{H},k+1}^{\prime }-{\mathbf{x}}_{\mathcal{H},k}^{\prime }).$$

Therefore,

$$\parallel {\mathbf{y}}_{\mathcal{H},k+1}-{\mathbf{y}}_{\mathcal{H},k+1}^{\prime }\parallel \le \parallel {\mathbf{x}}_{\mathcal{H},k+1}-{\mathbf{x}}_{\mathcal{H},k}\parallel +\parallel {\mathbf{x}}_{\mathcal{H},k+1}^{\prime }-{\mathbf{x}}_{\mathcal{H},k}^{\prime }\parallel .$$

By Lemma 1, for each $i\in \mathcal{H}$,

$$\parallel x_{i,k+1}-x_{i,k}\parallel \le {\displaystyle \frac{{\alpha }_{k}G}{{\sigma }_{\omega }}},\parallel x_{i,k+1}^{\prime }-x_{i,k}^{\prime }\parallel \le {\displaystyle \frac{{\alpha }_{k}G}{{\sigma }_{\omega }}}.$$

Thus,

$$\parallel {\mathbf{x}}_{\mathcal{H},k+1}-{\mathbf{x}}_{\mathcal{H},k}{\parallel }^2\le \left|\mathcal{H}\right|{\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }^2}}\le N{\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }^2}},$$

and similarly,

$$\parallel {\mathbf{x}}_{\mathcal{H},k+1}^{\prime }-{\mathbf{x}}_{\mathcal{H},k}^{\prime }{\parallel }^2\le N{\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }^2}}.$$

Hence,

$$\parallel {\mathbf{y}}_{\mathcal{H},k+1}-{\mathbf{y}}_{\mathcal{H},k+1}^{\prime }\parallel \le 2\sqrt{N}{\displaystyle \frac{{\alpha }_{k}G}{{\sigma }_{\omega }}},$$

which implies

$$\parallel {\mathbf{y}}_{\mathcal{H},k+1}-{\mathbf{y}}_{\mathcal{H},k+1}^{\prime }{\parallel }^2\le 4N{\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }^2}}.$$

Replacing $k+1$ by k in the above bound, we obtain

$$\parallel {\mathbf{y}}_{\mathcal{H},k}-{\mathbf{y}}_{\mathcal{H},k}^{\prime }{\parallel }^2\le 4N{\displaystyle \frac{{\alpha }_k^2{G}^2}{{\sigma }_{\omega }^2}}.$$

Substituting this estimate into the KLD inequality yields

$$D_{\mathrm{KL}}\left(h_{{\tilde{\mathbf{y}}}_{\mathcal{H},k}\mid {\mathbf{y}}_{\mathcal{H},k}},h_{{\tilde{\mathbf{y}}}_{\mathcal{H},k}\mid {\mathbf{y}}_{\mathcal{H},k}^{\prime }}\right)\le {\displaystyle \frac{N{\alpha }_k^2{G}^2}{M_k^2{\sigma }_{\omega }^2\underline{\lambda }\left(L_{\mathcal{H}}\right)}}.$$

According to Definition 3, Algorithm 1 preserves the statistical privacy of the uncorrupted players. □

Remark 5. 

The quantity bounded in Theorem 2 has a direct statistical interpretation. For two candidate honest-player datasets, the KL divergence can be written as

$$D_{\mathrm{KL}}\left(P_{\mathsf{O}|{\mathsf{D}}_{\mathcal{H}}}\parallel P_{\mathsf{O}|{\mathsf{D}}_{\mathcal{H}}^{\prime }}\right)={\mathbb{E}}_{\mathsf{O}\sim P_{\mathsf{O}|{\mathsf{D}}_{\mathcal{H}}}}\left[log{\displaystyle \frac{d{P}_{\mathsf{O}|{\mathsf{D}}_{\mathcal{H}}}}{d{P}_{\mathsf{O}|{\mathsf{D}}_{\mathcal{H}}^{\prime }}}}\right],$$

which is the expected log-likelihood ratio available to the adversary for distinguishing the two candidate datasets. Therefore, a small KL divergence means that the observation record provides limited statistical evidence for distinguishing these two candidates. Moreover, by Pinsker’s inequality, if the KL divergence is bounded by ρ, then the total variation distance between the two observation distributions is at most $\sqrt{\rho /2}$.

For each stage k, Theorem 2 gives the privacy leakage bound

$${\rho }_k={\displaystyle \frac{N{G}^2{\alpha }_k^2}{{\sigma }_{\omega }^2\lambda \left(L_{\mathcal{H}}\right)M_k^2}}.$$

Thus, increasing the perturbation magnitude $M_k$ or improving the algebraic connectivity $\lambda \left(L_{\mathcal{H}}\right)$ of the honest subgraph reduces the statistical leakage, while larger stepsizes may increase it. This interpretation also explains the privacy-performance tradeoff: larger perturbations improve privacy but may increase the estimation error and regret.

The above KL-based notion is different from the standard $(ϵ,\delta )$-differential privacy [19,20]. Differential privacy imposes a worst-case output likelihood-ratio bound for adjacent datasets. In contrast, the present criterion controls the average log-likelihood ratio, namely the KL divergence, between two candidate observation distributions.

5. Numerical Case Study: Privacy-Preserving EV Charging Coordination

In this section, we validate the proposed privacy-preserving distributed online algorithm through a practical electric vehicle (EV) charging coordination case study. The case study is motivated by residential or workplace charging networks, where a group of EV users repeatedly update their charging powers according to time-varying electricity prices, charging preferences, and the aggregate load of the network. In such systems, the charging profile of an individual user may reveal private information, such as daily routines, travel habits, and energy consumption patterns. Therefore, privacy-preserving distributed coordination is important for enabling cooperative charging control without directly exposing users’ local information.

In the considered EV charging network, each player corresponds to one EV user. The decision variable represents the charging power, the aggregate term represents the average charging load, and the local cost captures both the price-related payment and the deviation from the user’s preferred charging demand. This application naturally fits the online aggregative game model because the charging environment varies over time and each user’s cost depends on both its own charging action and the aggregate behavior of the charging population.

Consider a charging network with $N=20$ users. For each user $i\in \mathcal{V}$, let $x_i\left(k\right)\in \mathbb{R}$ denote the charging power at iteration k, and let the local feasible set be

$${\mathcal{X}}_i=[0,{\overline{x}}_i],i=1,\dots ,N,$$

where ${\overline{x}}_i=6$. The aggregative term is defined as

$$\sigma \left(x\left(k\right)\right)={\displaystyle \frac{1}{N}}{\displaystyle \sum _{j=1}^N}{x}_j\left(k\right).$$

For each user i, the time-varying local cost function is given by

$$J_{i,k}(x_i\left(k\right),\sigma \left(x\left(k\right)\right))=\left(a_k\sigma \left(x\left(k\right)\right)+b_k\right)x_i\left(k\right)+c_i{\left(x_i\left(k\right)-r_{i,k}\right)}^2,$$

where $a_k=0.35+0.10sin(k/90)$, $b_k=0.40+0.08cos(k/110)$, $r_{i,k}=2.2+{\displaystyle \frac{i}{25}}+0.40sin\left({\displaystyle \frac{k}{120}}+{\displaystyle \frac{i}{7}}\right)$, $c_i=1+{\displaystyle \frac{i}{40}}.$

The communication graph is chosen as an undirected ring graph, and the mixing matrix W is constructed by the Metropolis rule. Since each node in the ring graph has degree two, the nonzero weights are $w_{ii}=1/3$ and $w_{ij}=1/3$ for $j\in {\mathcal{N}}_i$. The proposed algorithm is implemented under the Euclidean Bregman divergence $D(x,z)={\displaystyle \frac{1}{2}}{\parallel x-z\parallel }^2$. The simulation horizon is $T=800$, and the iteration index is $k=1,\dots ,T$. The stepsize is ${\alpha }_k={\displaystyle \frac{{\alpha }_0}{\sqrt{k+1}}},$ where ${\alpha }_0=0.35$. For the Gaussian perturbation mechanism, the perturbation magnitude is $M_k={\displaystyle \frac{M_0}{{(k+1)}^{\beta }}},$ with $\beta =0.25$ and $M_0=0.45$. For the Laplace-noise benchmark, the Laplace scale is $M_k^{\mathrm{L}}={\displaystyle \frac{1.60}{{(k+1)}^{0.25}}}.$ The privacy-free baseline corresponds to $M_k=0$. The initial action of each user is sampled uniformly from $[0,6]$, and the initial aggregate estimate is chosen as $y_i\left(0\right)=x_i\left(0\right)$.

All reported curves are averaged over 20 independent Monte Carlo runs. For Figure 2 and Figure 3, the random seeds are 1000–1019 for the privacy-free baseline, 2000–2019 for the Gaussian perturbation mechanism, and 3000–3019 for the Laplace-noise benchmark. The corrupted-player set used for the privacy interpretation is fixed as $\mathcal{C}=\{1,2\},$ and hence $\left|\mathcal{C}\right|=2$ and $\mathcal{H}=\{3,\dots ,20\}$. Removing nodes 1 and 2 from the ring graph leaves the honest-player subgraph connected, so Assumption 7 is satisfied.

For the experiment with different privacy calibrations in Figure 4, we set a calibration constant $\Delta =7.5$. For positive $ϵ\in \{5,10,15\}$, the Gaussian perturbation parameter is chosen as $M_0={\displaystyle \frac{\Delta }{ϵ}},$ which gives $M_0=1.50,0.75,0.50$, respectively. The case $ϵ=0$ denotes the privacy-free no-noise baseline. The random seeds are 4000–4019, 4100–4119, 4200–4219, and 4300–4319 for $ϵ=0,5,10,15$, respectively. The plotted curves are Monte Carlo means. For a plotted quantity $z\left(k\right)$, the corresponding $95\%$ confidence interval is computed as $\overline{z}\left(k\right)\pm 1.96{\displaystyle \frac{s_z\left(k\right)}{\sqrt{20}}},$ where $\overline{z}\left(k\right)$ and $s_z\left(k\right)$ are the sample mean and sample standard deviation over the 20 Monte Carlo runs.

The practical interpretation of the main variables and parameters in the EV charging case study is summarized in

Table 2. Practical interpretation of the EV charging case study.

Symbol or Parameter	Practical Meaning
$i\in V$	EV user in the distributed charging network.
$x_i\left(k\right)$	Charging power selected by user i at iteration k.
$X_i=[0,{\overline{x}}_i]$	Physical charging-power limit of user i.
$\sigma \left(x\right(k\left)\right)$	Average charging load of all users, reflecting the aggregate demand level.
$a_k$ and $b_k$	Time-varying price or grid-condition coefficients.
$r_{i,k}$	Preferred charging demand of user i at time k.
$c_i$	User penalty weight for deviating from the preferred charging demand.

. This interpretation shows how the abstract online aggregative game model corresponds to a concrete charging coordination problem.

To evaluate the algorithm performance, we consider the maximum average estimate error

$$e_{\mathrm{est}}\left(k\right)=\underset{i\in \mathcal{V}}{max}\left|y_i\left(k\right)-\overline{x}\left(k\right)\right|,\overline{x}\left(k\right)={\displaystyle \frac{1}{N}}{\displaystyle \sum _{j=1}^N}{x}_j\left(k\right),$$

and the normalized regret $Reg\left(T\right)/T,$ where

$$Reg\left(T\right)={\displaystyle \sum _{k=1}^T}\left({\displaystyle \sum _{i=1}^N}{J}_{i,k}(x_i\left(k\right),\sigma \left(x\left(k\right)\right))-{\displaystyle \sum _{i=1}^N}{J}_{i,k}(x_i^{\ast }\left(k\right),\sigma \left(x^{\ast }\left(k\right)\right))\right),$$

and $x^{\ast }\left(k\right)$ is the time-varying Nash equilibrium at iteration k.

Figure 2 compares the maxima of average estimate errors for three algorithms, namely, the privacy-free distributed online algorithm, the proposed algorithm with correlated Gaussian perturbation, and the proposed algorithm with correlated Laplace perturbation. It can be observed that the privacy-free algorithm achieves the smallest estimate error, while both privacy-preserving algorithms lead to slightly larger errors due to the injected perturbations. Moreover, the Gaussian perturbation yields slightly better tracking accuracy than the Laplace perturbation.

Figure 3 shows the corresponding curves of $Reg\left(T\right)/T$ for the above three algorithms. The privacy-free algorithm gives the smallest normalized regret. After introducing privacy-preserving perturbations, the regret becomes slightly larger, but all curves still decrease as the iteration proceeds. This shows that the proposed method can preserve satisfactory online decision performance while protecting the exchanged aggregate estimates.

To further evaluate the robustness of the proposed algorithm, we provide a statistical summary of the numerical results over 20 independent Monte Carlo runs. For each run, we compute the time-averaged maximum estimation error and the time-averaged normalized regret over the horizon $T=800$.

Table 3. Statistical summary over 20 independent Monte Carlo runs.

Algorithm	Time-Averaged Estimation Error		Time-Averaged $Reg\left(\mathit{T}\right)/\mathit{T}$
	Mean ± Std.	Median	Mean ± Std.	Median
Privacy-free	$0.0657\pm 0.0013$	$0.0655$	$0.1430\pm 0.0124$	$0.1408$
Gaussian perturbation	$0.1897\pm 0.0055$	$0.1899$	$0.1555\pm 0.0105$	$0.1544$
Laplace perturbation	$0.8633\pm 0.0215$	$0.8674$	$0.2246\pm 0.0279$	$0.2174$

reports the mean, sample standard deviation, and median of these quantities. The results show that Algorithm 1 has a slightly larger estimation error and regret than the privacy-free baseline due to the injected perturbations, but it remains stable across different random trials. Compared with the Laplace-noise benchmark, the proposed correlated Gaussian perturbation achieves smaller average estimation error and smaller normalized regret, which further supports the reliability of the proposed mechanism.

To further illustrate the influence of privacy levels, Figure 4 plots the curves of $Reg\left(T\right)/T$ for different privacy values. It is seen that higher privacy level magnitudes generally lead to larger regret, which reveals the tradeoff between privacy protection and online performance.

Finally, we modify the feasible set from an interval to a simplex set and compare the Euclidean-distance-based algorithm with the KL-divergence-based algorithm. Specifically, for each user i, the decision variable is changed to

$$x_i\left(k\right)={\left[x_i^1\left(k\right),x_i^2\left(k\right),\dots ,x_i^d\left(k\right)\right]}^{\top }\in {\mathbb{R}}^d,$$

with $d=3$, and the feasible set is

$$\Delta =\left\{x\in {\mathbb{R}}^d|x_{\ell }\ge 0,{\displaystyle \sum _{\ell =1}^d}{x}_{\ell }=1\right\}.$$

To examine the influence of network topology, we compare the proposed algorithm under three connected communication graphs: a ring graph, a ring graph with additional chordal edges, and a star graph. For the star graph, the hub node is selected outside the corrupted-player set to keep the honest-player subgraph connected. Figure 5 compares the aggregate-estimation error under these communication graphs. The results show that the proposed algorithm remains effective under all tested topologies and is not restricted to a single ring graph. The graph with additional chordal edges generally gives a smaller estimation error, indicating that better network connectivity improves the information-mixing ability of the dynamic average consensus step.

Figure 6 presents the corresponding curves of $Reg\left(T\right)/T$. It is observed that both methods can solve the problem over the simplex set, while the KL-divergence algorithm achieves better regret performance, which indicates that the induced non-Euclidean geometry is more suitable for simplex constrained charging allocation problems.

6. Discussion

The simulation results show that the proposed method can balance privacy protection and online decision performance in distributed online aggregative games. After introducing perturbations into the exchanged aggregate estimates, the estimate errors and normalized regret become slightly larger than those of the privacy-free algorithm. However, the overall performance remains stable, which indicates that the correlated perturbation mechanism does not destroy the online tracking ability of the algorithm.

The results also show that the perturbation distribution affects performance. In the considered setting, the correlated Gaussian perturbation achieves slightly better estimate accuracy and regret performance than the correlated Laplace perturbation. In addition, the experiments under different privacy levels reveal a clear relationship between privacy strength and online performance. Stronger privacy protection requires larger perturbations, which improves privacy but also increases the regret.

The simplex constrained experiment provides another useful observation. Compared with the Euclidean distance based update, the KL-divergence update achieves better performance. This result suggests that when the feasible set has a simplex structure, choosing a geometry that matches the constraint set is beneficial. Overall, the proposed method provides an effective way to protect privacy while maintaining satisfactory online performance.

The EV charging case study also illustrates the practical relevance of the proposed framework. In a distributed charging network, users may be unwilling to share their charging states or aggregate-load estimates directly, since such information can be linked to personal mobility and energy consumption habits. Therefore, the method is suitable for privacy-sensitive networked resource allocation problems in which local decisions are coupled through an aggregate quantity. Beyond EV charging, similar structures appear in demand response, shared energy management, communication resource allocation, congestion control, and cloud resource allocation. In these applications, each agent optimizes its own online decision while being affected by the aggregate behavior of the whole population, and privacy protection is needed during repeated information exchange.

7. Conclusions

This paper studied statistical privacy preservation in distributed online aggregative games with time-varying costs. To protect sensitive local information during repeated communication, we proposed a privacy-preserving distributed online mirror descent algorithm with correlated perturbations. The correlated perturbations mask the exchanged aggregate estimates while preserving a global balancing property, which allows the dynamic average-tracking mechanism to be maintained. Under the stated assumptions, we established an expected dynamic regret bound and a Kullback–Leibler divergence statistical privacy guarantee. The numerical simulations on electric vehicle charging further illustrate the effectiveness of the proposed algorithm, the tradeoff between privacy protection and online performance, and the advantage of using a KL-divergence-based mirror geometry for simplex-constrained problems.

The proposed framework can be applied to broader distributed online decision-making problems, such as energy management, communication networks, traffic control, and resource allocation. Several directions remain open for future research. First, it would be meaningful to extend the method to directed, time-varying, lossy, or asynchronous communication networks. Second, adaptive choices of stepsizes and perturbation magnitudes may further improve the tradeoff between privacy and regret performance. Finally, stronger adversarial or collusion models, extensions to coupled constraints, stochastic feedback, and large-scale practical applications deserve further investigation.