---
title: Privacy-Preserving Fusion Estimation
url: https://www.emergentmind.com/topics/privacy-preserving-fusion-estimation-ppfe
type: topic
---

# Privacy-Preserving Fusion Estimation

Searching arXiv for recent and foundational papers on privacy-preserving fusion estimation and adjacent formulations.
Privacy-preserving fusion estimation (PPFE) denotes a family of estimation and fusion procedures in which multiple parties, sensors, sites, or models collaborate to produce a single estimate, fused state, or fused model while withholding raw private information. In the literature gathered under this heading, PPFE includes vertically partitioned distributed estimation with perturbed random projections, mixed estimators that combine public and private subgroups under heterogeneous privacy needs, multi-sensor fusion under local differential privacy, encrypted multi-party dynamic state estimation with data and model privacy, vertical federated learning for traffic state estimation, privacy-preserving multimodal pose estimation, and decentralized differentially private model fusion without retraining [1703.00403] [2111.00115] [2508.15175] [2101.00666] [2401.11836] [2202.10704] [2311.03396].

## 1. Problem classes and representational scope

PPFE is not tied to a single data geometry. One recurring setting is the **vertically-partitioned** design matrix, where “information about each record in the dataset is held by different data owners,” so the classical setup of a single trusted curator does not apply [1703.00403]. A second setting partitions data by privacy requirement rather than by feature ownership: public data may have $\epsilon=\infty$, while private groups carry heterogeneous $\epsilon_i$, and the task is to produce one aggregate estimate over the pooled population [2111.00115]. A third setting is dynamic multi-sensor estimation, where a fusion center releases privatized outputs derived from correlated sensor measurements of an underlying process, and a remote estimator uses those releases to estimate the hidden state [2602.21525]. Related formulations include distributed fusion estimation with unknown exogenous inputs, in which the privacy target is the exogenous input sequence rather than the state, and collaborative state estimation in which multiple parties estimate a common physical process while protecting both data and local observation-model parameters [2512.22914] [2101.00666].

The same umbrella extends beyond conventional sensor fusion. In traffic state estimation, municipal authorities and mobility providers hold complementary, vertically partitioned information and jointly estimate link-level flow and density through vertical federated learning [2401.11836]. In distributed semiparametric modeling, horizontally partitioned sites exchange only aggregated summaries so that component-wise gradient boosting for generalized additive mixed models yields equivalent estimates to pooled-data boosting [2210.07723]. In healthcare and mobile systems, PPFE also appears as multimodal feature fusion over depth, long-wave infrared, pressure maps, Wi-Fi RSSI, Cellular RSSI, sound, and light, where privacy concerns attach to the sensing modalities themselves as much as to the fusion protocol [2202.10704] [1710.08306]. In model-as-a-service scenarios, “model fusion” is treated as a privacy-preserving fusion problem in its own right, with local differential privacy constraints and decentralized federated graph matching [2311.03396].

## 2. Privacy models, threat assumptions, and what is protected

The privacy semantics in PPFE are heterogeneous. One strand works with $(\epsilon,\delta)$-distributed differential privacy, introduced as an extension of single-party differential privacy to the distributed, vertically partitioned case [1703.00403]. Another strand argues that centralized differential privacy is not a good fit for multi-sensor fusion estimation because it is designed for aggregate queries such as sums and averages rather than for protecting individual local state estimates, and because it assumes an architecture unlike the usual fusion-center setting; on that basis, it replaces CDP with $(\varepsilon,\delta)$-local differential privacy for randomized mechanisms $M:\mathbb{R}^{n_x}\to\mathbb{R}^{n_x}$ acting on local estimates [2508.15175]. Sequential fusion work adopts Rényi differential privacy, with per-step leakage $L_k$ and a trajectory-level budget constraint
$$
\sum_{k=1}^{K} L_k\!\left(\mathcal{F}_k\!\left(\cdot \mid \cdot, Z^{k-1}\right), \alpha \right)\le \mathsf{B_G},
$$
so that the whole adaptive mechanism satisfies $(\alpha,\mathsf{B_G})$-RDP under composition [2602.21525].

Threat models are equally varied. Some papers assume **honest-but-curious** participants that follow the protocol but may try to infer private data from exchanged messages, as in vertical federated learning for traffic state estimation [2401.11836]. Others assume a **full eavesdropper** that observes all transmissions to the fusion center and knows the system parameters, or a wiretap channel with its own packet-success probabilities [2512.22914] [2507.13286]. Collaborative localization distinguishes requester privacy and provider privacy: onion routing hides request paths through hierarchical Phone Masters, while perturbation and randomization obscure provider-side label distributions [1710.08306]. Multi-party dynamic state estimation further separates **data privacy** from **model privacy**, the latter covering sensitive parameters such as $C_i$ and $R_i$ [2101.00666].

A recurring technical principle is **post-processing**. In the local-DP multi-sensor setting, once local state estimates satisfy LDP, fusion at the center does not weaken privacy by the post-processing lemma [2508.15175]. The same logic is used in distributed fusion with exogenous-input protection: after the center computes a fused estimate from already DP-sanitized local estimates, broadcasting that fused estimate for feedback refinement does not consume extra privacy budget [2512.22914]. This undercuts a common assumption that every additional fusion or refinement stage necessarily incurs a new privacy cost.

## 3. Fusion mechanisms and estimator architectures

One of the cleanest PPFE constructions is the mixed estimator for heterogeneous privacy groups. For the mean, each group $i$ privatizes its sum $\Sigma_i$ with Laplace noise $z_i\sim \mathrm{Lap}(r/\epsilon_i)$ and contributes the private mean $(\Sigma_i+z_i)/n_i$. The fused estimator is
$$
\tilde{X} = \sum_{i=1}^{k} \beta_i \frac{\Sigma_i + z_i}{n_i}, \qquad \beta_i \ge 0,\quad \sum_{i=1}^{k}\beta_i=1,
$$
with inverse-variance weights chosen to minimize total variance; the same estimate-first-then-fuse philosophy is extended to medians by applying the exponential mechanism independently to each subgroup and then combining the subgroup releases with the same variance-based weights [2111.00115]. In a different vertically partitioned formulation, PriDE asks each party to communicate perturbed random projections of locally held features, yielding a scalable framework for $\ell_2$-penalized supervised learning with bounded estimation error relative to the non-private, non-distributed optimum [1703.00403].

Multi-sensor state-estimation papers typically privatize at the level of **local state estimates**. Under LDP with system intrinsic randomness, each sensor computes a steady-state Kalman local state estimate, and the fusion center forms the distributed fusion estimate
$$
\hat{x}_{f,k}=\sum_{i=1}^{L}W_i\hat{x}_{i,k},
$$
with linear minimum-variance weights derived from the local and cross-covariances; if intrinsic randomness is insufficient, Gaussian perturbation is added to each local estimate and the weights are recomputed using the perturbed covariance matrix [2508.15175]. In exogenous-input protection, local unbiased unknown-input filters produce $\hat x_{i,k|k}$ and $P_{i,k|k}$, sensors inject mutually independent Gaussian noises with block-diagonal covariance, and the fusion center uses covariance intersection on the perturbed quantities $\bar x_{i,k|k}$ and $\bar P_{i,k|k}$ [2512.22914]. Wireless-sensor-network work replaces additive noise by an encoding-based privacy-preserving mechanism in which each sensor encodes measurements relative to a previously decoded reference packet and a growth factor $a_i>1$; the legitimate user decodes and feeds a centralized fusion filter, whereas an eavesdropper that misses a critical packet loses synchronization [2507.13286].

Other PPFE architectures move privacy into the communication or representation layer. In encrypted multi-party dynamic state estimation, each party computes a local intermediate estimate
$$
\hat{x}_i^{-}(k)=A\hat{x}_i(k-1)+K_i\big(y_i(k)-C_iA\hat{x}_i(k-1)\big),
$$
encrypts it with an additively homomorphic scheme, the cloud sums ciphertexts, and a security module decrypts only the aggregate average
$$
\bar{x}(k)=\frac{1}{N}\sum_{i=1}^N \hat{x}_i^{-}(k),
$$
which then synchronizes all parties’ estimates [2101.00666]. In vertical federated learning for traffic state estimation, each mobility provider computes a private embedding $\bm z_t^k=\bm\phi^k(\bm x_t^k;\bm\theta^k)$ and sends only the embedding to the municipal authority, which computes the final estimate $\hat{\bm y}_t$ from its own features and the received embeddings [2401.11836]. Distributed GAMM estimation similarly avoids raw-record exchange by communicating only crossproduct matrices, response crossproducts, site-level SSE values, selected learner indices, and fitted parameter vectors, which is sufficient to reproduce pooled-data component-wise gradient boosting exactly [2210.07723]. In multimodal in-bed pose estimation, the fusion objects are intermediate HRNet features, combined by addition, concatenation, learned modal weights, or an end-to-end fully trainable approach; a conditional GAN reconstructs a visible-like modality from LWIR when raw visible images are unavailable [2202.10704]. In privacy-preserving model fusion, PrivFusion uses a graph-based structure, hybrid local differential privacy, decentralized federated graph matching, and a perturbation filter adapter so that models from multiple parties can be fused without retraining [2311.03396].

## 4. Optimization principles, utility criteria, and theoretical guarantees

A central design principle in PPFE is that privacy calibration and fusion weighting can be separated. In the mixed mean estimator, the optimal linear combination of independent unbiased subgroup estimators is obtained by inverse-variance weighting, yielding a minimum-variance unbiased estimator; the argument is explicitly contrasted with personalized differential privacy mechanisms that subsample points and thereby entangle privacy with effective sample size [2111.00115]. This principle reappears in linear minimum-variance fusion for perturbed local state estimates and in covariance intersection for unknown inter-sensor correlations, where the privacy perturbation alters the covariance structure but not the estimator class [2508.15175] [2512.22914].

Sequential PPFE introduces a different optimization geometry. The RDP-constrained fusion problem is posed as a finite-horizon constrained optimization over both the fusion policy $\mathcal F=\{\mathcal F_k\}_{k=1}^K$ and the estimator policy $\mathcal E=\{\mathcal E_k\}_{k=1}^K$:
$$
\min_{\mathcal{F},\,\mathcal{E}} \mathsf{E}\!\left[\sum_{k=1}^{K} d(X_k,\tilde{X}_k)\right]
\quad\text{subject to}\quad
\sum_{k=1}^{K} L_k\!\left(\mathcal{F}_k\!\left(\cdot \mid \cdot, Z^{k-1}\right), \alpha \right) \leq \mathsf{B_G}.
$$
The resulting constrained Bellman equations show that the optimal fusion policy depends on the current measurements, the remaining privacy budget, and a belief state over the latent process and private measurements; the paper emphasizes that the optimal policy allocates privacy budget in a closed loop rather than by a fixed uniform split $\mathsf{B_G}/K$ [2602.21525]. To make the problem tractable, the fusion policy is parameterized as a structured conditional Gaussian with a closed-form RDP leakage, and the numerical method alternates between joint optimization of the filtering function and estimator and a PPO-based update of the adaptive fusion vector [2602.21525].

Several papers recast privacy design as a constrained covariance-allocation problem. For exogenous-input protection, the injected Gaussian covariances $\Sigma_{i,k}$ are chosen by minimizing $\sum_i \operatorname{tr}(\Sigma_{i,k})$ subject to an $(\epsilon,\delta)$-DP constraint; the original non-convex problem is relaxed to a semidefinite program with the sufficient condition $\bar P_k \succeq bI$, and the relaxation is conservative but “does not weaken privacy” because any feasible SDP solution satisfies the original privacy condition [2512.22914]. In multi-party dynamic state estimation, stabilization and asymptotic MMSE design are both converted into convex SDPs and then implemented distributively through carefully structured two-block ADMM, so that estimator gains can be designed collaboratively without directly revealing $C_i$ or $R_i$ [2101.00666]. In packet-dropout PPFE, boundedness of the legitimate user’s covariance is analyzed through a modified algebraic Riccati equation, and a useful sufficient condition is that the total channel capacity $\mathscr C$ exceeds the system’s topological entropy $\bar h(A)$ [2507.13286].

A distinct theoretical endpoint appears in distributed semiparametric learning. For generalized additive mixed models fitted by component-wise gradient boosting, the distributed algorithm is explicitly claimed to be **lossless**: because row-wise partitioning makes pooled crossproducts decomposable into sums of sitewise crossproducts, each boosting step and therefore the entire boosting trajectory coincide with pooled-data CWB [2210.07723]. This is an important limiting case in which privacy preservation is achieved without any estimation loss beyond the communication of aggregated summaries.

## 5. Applications and empirical evidence

Traffic estimation is one of the most fully developed PPFE application domains in the present literature. In FedTSE, real-world validation on the pNEUMA corridor shows that privacy-preserving vertical federated learning can yield accuracy close to the oracle method without privacy protection: at $80\%$ mobility-provider penetration, reported density RMSE values are $6.79$ for Oracle and $6.02$ for FedTSE, while flow RMSE values are $0.99$ for Oracle and $1.02$ for FedTSE [2401.11836]. The communication-efficiency study reports that to reach density RMSE $7.7$, FedTSE requires $812$ communication rounds for $Q=1$, $420$ for $Q=2$, and $308$ for $Q=3$ [2401.11836]. In the scarce-label setting, FedTSE-PI combines a Cell Transmission Model with privacy-preserving gradient computation via inner-product encryption and remains close to Oracle-PI; at $20\%$ penetration, the reported density RMSE values are $6.37$ for FedTSE-PI, $6.32$ for Oracle-PI, $7.95$ for UKF, $6.89$ for QEST-f, and $11.91$ for TSE-PI-p [2401.11836].

Sequential sensor fusion under RDP is validated on a traffic density estimation case study using the US Highway 101 dataset with a 400-meter road segment, sampling interval $0.2$ s, horizon $K=100$, and up to $12$ simultaneously transmitting vehicles [2602.21525]. The reported finding is that, for the same total privacy budget $\mathsf{B_G}$, adaptive privacy-aware fusion achieves lower estimation error than a classical DP mechanism with uniform budget allocation, and with $\mathsf{B_G}=1.5$ the adaptive policy allocates more budget in the $2$–$8$ s interval and tracks the true traffic density more closely [2602.21525]. In wireless multi-sensor systems with packet dropouts, simulations on an Internet-based three-tank system show that the legitimate user’s MSE is essentially unchanged across groups while the eavesdropper’s MSE diverges whenever at least one privacy channel has $a_i>1$; finer quantization, implemented by smaller $\delta_i$, improves the legitimate user’s MSE [2507.13286]. In exogenous-input protection, a two-sensor 4D example reports that feedback CI refinement reduces average MSE from about $26.12$ for the base algorithm to $16.86$ for the feedback version, with the same $(\epsilon,\delta)$-DP budget [2512.22914].

Healthcare and human-centric sensing provide a second large empirical cluster. In in-bed pose monitoring with privacy-preserving modalities, unimodal HRNet results are reported as $93.2$ for LWIR, $96.1$ for depth, $90.3$ for pressure maps, and $93.7$ for visible images, while end-to-end trainable fusion reaches average PCKh@0.5 values around $96.63$–$96.77$; cGAN-based synthetic visible plus LWIR yields $90.2\%$ total PCKh@0.5 without square bounding-box cropping [2202.10704]. In collaborative localization, utility-based weighted fusion of provider label distributions improves accuracy by about $4$–$5\%$ relative to uniform weighting in some noisy settings, and the reported optimum for the returned top-$k$ labels lies roughly around $20$–$30$ [1710.08306]. In distributed GAMM estimation on a four-site heart-disease dataset, the distributed and pooled CWB fits have a perfect overlap of partial effects and identical empirical risk $0.4245$, compared with $0.4441$ for a pooled mgcv fit; the model stops after $5578$ iterations, of which $782$ select shared effects and $4796$ site-specific effects [2210.07723]. In heterogeneous-privacy aggregate estimation, the proposed weighted estimator usually has lower variance than the personalized-DP Sample baseline in mean experiments over $1000$ trials, and the weighted median is competitive with or better than the $\mathcal{PE}$ mechanism in RMSE over $500$ trials [2111.00115].

## 6. Interpretive issues, misconceptions, and open directions

A recurrent misconception is that PPFE is simply differential privacy plus additive noise at a central server. The surveyed literature does not support that reduction. One paper explicitly states that the classical trusted-curator setup does not apply in vertically partitioned estimation [1703.00403]; another argues that centralized differential privacy is not a good fit for multi-sensor fusion estimation and replaces it with local differential privacy grounded in local state estimates and covariance-based sensitivity [2508.15175]. Other works protect privacy through homomorphic encryption, inner-product encryption, covariance-intersection over perturbed local estimates, distributed encoding over lossy channels, or onion routing combined with perturbation and weighted collaboration [2101.00666] [2401.11836] [2512.22914] [2507.13286] [1710.08306]. This suggests that PPFE is better understood as a design space organized by what is private, where fusion occurs, and which adversary is modeled, rather than by a single privacy formalism.

Another misconception is that privacy necessarily implies severe utility loss. Several papers report the opposite in restricted regimes. Intrinsic process and measurement randomness may already suffice for $(\varepsilon,\delta)$-LDP, in which case “no extra noise is needed” and the optimal privacy-preserving distributed fusion estimate equals the original distributed fusion estimate [2508.15175]. Distributed GAMM estimation can be lossless in the precise sense of reproducing pooled-data boosting exactly [2210.07723]. FedTSE and FedTSE-PI are reported to achieve similar or near-oracle accuracy while protecting raw cross-silo data [2401.11836]. The mixed estimator for heterogeneous privacy groups is presented as usually preferable to subsampling-based PDP baselines because it avoids discarding information and decouples per-group privatization from fusion weighting [2111.00115]. At the same time, utility costs remain explicit in many formulations: added Gaussian noise inflates fusion error covariance, end-to-end multimodal fusion is computationally more expensive, and reconstructed visible images from LWIR do not fully match the performance of real visible images [2512.22914] [2202.10704].

Open directions are also visible in the current record. Vertical federated traffic estimation notes that stronger privacy mechanisms such as differential privacy or secure multiparty computation could be added, and that malicious or strategic data forgery is not fully addressed [2401.11836]. Multi-party dynamic state estimation remarks that a more formal privacy analysis of what can be inferred from products such as $Z_iC_iA$ or $\overline Z_i\sqrt{R_i}B_i$ is future work [2101.00666]. Multimodal pose monitoring points to extensions beyond two-modality fusion and better reconstruction, while privacy-preserving model fusion highlights decentralized graph matching and perturbation filtering as an emerging model-level variant of the PPFE problem [2202.10704] [2311.03396]. The overall trajectory suggests continued convergence between privacy theory, estimation theory, and communication-constrained fusion, with application domains ranging from cyber-physical systems and intelligent transportation to healthcare sensing and model-as-a-service.

Source: https://www.emergentmind.com/topics/privacy-preserving-fusion-estimation-ppfe