# Privacy-Preserving Decentralized Inference with Graph Neural Networks in
Wireless Networks

Mengyuan Lee, Guanding Yu, and Huaiyu Dai M. Lee and G. Yu are with College of
Information Science and Electronic Engineering, Zhejiang University, Hangzhou
310027, China. e-mail: {mengyuan_lee<EMAIL_ADDRESS>(_Corresponding
author: Guanding Yu_) H. Dai is with the Department of Electrical and Computer
Engineering, North Carolina State University, Raleigh, NC 27695, USA. e-mail:
<EMAIL_ADDRESS>
###### Abstract

As an efficient neural network model for graph data, graph neural networks
(GNNs) recently find successful applications for various wireless optimization
problems. Given that the inference stage of GNNs can be naturally implemented
in a decentralized manner, GNN is a potential enabler for decentralized
control/management in the next-generation wireless communications. Privacy
leakage, however, may occur due to the information exchanges among neighbors
during decentralized inference with GNNs. To deal with this issue, in this
paper, we analyze and enhance the privacy of decentralized inference with GNNs
in wireless networks. Specifically, we adopt local differential privacy as the
metric, and design novel privacy-preserving signals as well as privacy-
guaranteed training algorithms to achieve privacy-preserving inference. We
also define the SNR-privacy trade-off function to analyze the performance
upper bound of decentralized inference with GNNs in wireless networks. To
further enhance the communication and computation efficiency, we adopt the
over-the-air computation technique and theoretically demonstrate its advantage
in privacy preservation. Through extensive simulations on the synthetic graph
data, we validate our theoretical analysis, verify the effectiveness of
proposed privacy-preserving wireless signaling and privacy-guaranteed training
algorithm, and offer some guidance on practical implementation.

###### Index Terms:

Artificial intelligence, graph neural network, decentralized inference,
differential privacy, over-the-air computation.

##  I Introduction

With the explosion of mobile users and enhanced QoS requirements, artificial
intelligence (AI) techniques gradually become a necessary enabler for the
next-generation wireless communications [1]. In recent years, AI based
wireless techniques are attracting increasing interest, and shown to
outperform traditional model-based design paradigms in many wireless
applications, such as resource allocation [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12,
13], networking [14, 15], and physical layer design [16, 17, 18, 19, 20]. The
reasons include the following two aspects. On the one hand, the wireless
environments are generally complex due to random channel fading, interference,
and hardware impairments. Therefore, the mathematical model sometimes may fail
to accurately model the reality of wireless communication systems. On the
other hand, large-scale wireless communication schemes, such as the massive
multiple-input multiple-output (MIMO) systems, are the mainstream for the
next-generation wireless communications. The corresponding mathematical models
inevitably become complex, whose related optimization algorithms exhibit
overwhelming computational complexity for practical implementations. AI
techniques, however, are data-driven methods with low inference complexity as
well as powerful representation ability. Therefore, AI is a potential tool to
develop breakthrough wireless techniques for the next-generation wireless
communications.

However, different from the success of AI in other fields, such as computer
vision and natural language processing, applying AI in wireless networks
should meet some special expectations: (i) few labeled training samples since
the labeled training samples are difficult to obtain in wireless networks;
(ii) high generalization ability for dynamic wireless systems; (iii)
feasibility for decentralized implementation in large-scale wireless networks.
Amongst existing AI techniques, graph neural networks (GNNs) [21, 22] exhibit
potential to address the above challenges. First, GNNs can exploit high-
dimensional graph topology and node/edge features more efficiently than other
neural network models, which enables GNNs to achieve good performance with
fewer training samples. Secondly, GNNs can embed each node in the graph to a
low-dimensional vector with functions operated at the node level, which
facilitates the same application for graphs of different sizes. Moreover, all
node-level operations in GNNs are naturally decentralized, which indicates
that the inference stage of well-trained GNN models can be done in the
decentralized manner. Note that most neural network models for wireless
applications, such as convolutional neural networks and recurrent neural
networks, require central processing during the inference stage. Therefore,
the decentralized inference can only be enabled by GNNs. Based on above
analysis, GNNs have great potential for efficient and scalable wireless
decentralized control.

In this paper, we focus on decentralized inference with GNNs in wireless
networks. As mentioned in [13], information exchanges among neighboring nodes
are achieved through wireless channels during decentralized inference with
GNNs. Fading and noisy channels may deteriorate the information exchanges and
have inevitably adverse impacts on the inference performance. In [13], the
authors focus on the possible errors induced by the imperfect wireless
transmission and propose a novel communication-efficient wireless
retransmission mechanism to enhance the inference robustness of GNNs, which is
essential to bring GNN based wireless techniques from theory to practice. In
practical systems, wireless transmission may also incur privacy leakage.
Specifically, when neighboring nodes exchange information, personal features
may be inferred/detected by honest-but-curious neighbors or possibly anonymous
hackers. Generally, personal features may include private information and
important parameters that the users do not want to share with others. With the
ever-increasing awareness of personal information leakage, privacy
preservation for the decentralized inference with GNNs in wireless networks is
a significant and non-negligible issue. Therefore, the goal of this paper is
to analyze and enhance the privacy of decentralized inference with GNNs in
wireless networks.

###  I-A Related Work

####  I-A1 GNNs in Wireless Networks

Recently, there are some existing works about incorporating GNNs into wireless
applications [6, 7, 8, 9, 10, 11, 12, 18, 19, 20]. Most of them have employed
GNNs for wireless resource allocation, such as link scheduling [7], power
allocation [8, 9] and user association [10]. Some have paid attention to
physical layer design, such as channel estimation [18, 19] and MIMO detection
[20]. In these existing works, GNN based solutions are generally implemented
in the centralized server. Meanwhile, other existing works in literature have
used GNNs for decentralized control, such as multi-robot management [23, 24,
25] and wireless channel allocation [26]. However, they generally assume
perfect information exchanges between nodes and do not pay attention to
possible privacy leakage issue.

####  I-A2 Privacy Preservation for GNNs

Existing techniques targeting privacy preservation of GNNs can be summarized
as follows: (i) making use of collaborative learning schemes, such as
federated/split learning, to protect the training privacy of GNNs [27, 28];
(ii) modifying existing training algorithms, such as adding noise to the
gradients generated by the SGD/Adam algorithm, for preserving the training
privacy of GNNs [30, 29, 31]; (iii) adding noise or coding on the private
information, such as node/edge features, to achieve privacy-preserving GNN’s
inference [32]. Compared to privacy protection of GNNs at the training stage,
much less is done at the inference stage, and none of existing works takes
wireless environments into consideration. This motivates us to study the role
of wireless fading and noise for privacy preservation and develop novel
privacy-preserving techniques for decentralized inference with GNNs in
wireless networks.

####  I-A3 Privacy Preservation in Wireless Networks

Some existing works in literature have already paid attention to privacy
preservation by exploiting wireless fading and noise [33, 34, 35, 36, 37, 38,
39]. However, all of them focus on the federated learning scenario and protect
the privacy for distributed/decentralized training, rather than the inference
stage. Therefore, these aforementioned existing methods are only applicable to
distributed/decentralized training of GNNs in wireless networks. Note that the
characteristics of the training and inference stages are different. First, the
training stage makes use of stochastic algorithms (such as SGD) and is
inherently tolerant of noise. Inference stage, however, is a deterministic
process and more vulnerable to noise. Therefore, exploiting noise for privacy
preservation imposes a more severe impact on the inference stage than on the
training stage. Second, the performance metric of the training stage is the
well-studied “convergence rate” while that of the inference stage is difficult
to be expressed in closed form. To some extent, privacy preservation at the
inference stage with performance guarantee incurs more challenges and requires
further considerations compared with that at the training stage. Therefore,
these aforementioned works are not applicable to decentralized inference with
GNNs in wireless networks, which motivates the study in this paper.

###  I-B Contributions and Outline

As far as we know, this is the first piece of work to study privacy-preserving
decentralized inference with GNNs in wireless networks. Specifically, our main
contributions are summarized as follows.

1\. Privacy-Preserving Wireless Signaling: We adopt local differential privacy
as the privacy-preserving metric and propose novel wireless signaling to
achieve privacy-preserving decentralized inference with GNNs in wireless
networks. Based on the optimal parameter solutions for privacy-preserving
signaling, we define the SNR-privacy trade-off function to theoretically
analyze the performance upper bound of the proposed wireless signaling.

2\. Privacy-Guaranteed Training Algorithm: Traditional training algorithms may
incur inference performance loss when adopting the proposed privacy-preserving
wireless signaling. Therefore, we design privacy-guaranteed training algorithm
to further enhance the performance of privacy-preserving decentralized
inference with GNNs in wireless networks.

3\. Advantages of AirComp on Privacy Preservation: We exploit the over-the-air
computation (Aircomp) technique for the decentralized inference with GNNs in
wireless networks, and theoretically and experimentally demonstrate that it
can enhance the communication and computation efficiency as well as the
privacy preservation.

The rest of this paper is organized as follows. In Section II, we introduce
preliminaries and backgrounds for some important techniques we adopted in this
paper. In Section III, we formulate the wireless optimization problem,
introduce its corresponding graphical model, and discuss the decentralized
implementation of GNNs to solve it. In Section IV, privacy-preserving wireless
signaling is proposed, based on which the SNR-privacy trade-off is analyzed.
The privacy-guaranteed training algorithm is introduced in Section V.
Extension analysis to the system without the Aircomp technique and advantages
of the Aircomp technique are discussed in Section VI. The simulation results
are given in Section VII. Finally, we conclude the paper and provide
directions for future research in Section VIII. For ease of reading, the
notations used in this paper are summarized in Table I.

TABLE I: Notations in this Paper Notations | Meaning
---|---
$G$ | Graph
$\mathcal{V}$ | Node set
$\mathcal{E}$ | Edge set
$N(v)$ |  Neighbors of node $v$
$\mbox{\boldmath{$x$}}_{v}$ |  Features of node $v$
$\mbox{\boldmath{$e$}}_{vu}$ |  Features of edge $e(v,u)$
$f_{M}^{(k)}(\cdot)$ |  Local message function at the $k$-th layer
$f_{U}^{(k)}(\cdot)$ |  Local update function at the $k$-th layer
${\rm Agg}(\cdot)$ | Aggregation function
$\mbox{\boldmath{$h$}}_{v}^{(k)}$/$\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}$ |  Hidden state/Message of node $v$ at the $k$-th layer
$g_{vu}$ |  Channel gain from node $v$ to $u$
$P_{v}$ |  Maximum transmit power of node $v$
$\mbox{\boldmath{$w$}}_{uv}^{(k)}$/$\mbox{\boldmath{$\tilde{w}$}}_{uv}^{(k)}$ |  Original/Privacy-preserving signal from node $u$ to $v$ at the $k$-th iteration
$\mbox{\boldmath{$R$}}_{v}^{(k)}$/$\mbox{\boldmath{$\tilde{R}$}}_{v}^{(k)}$ |  Received signal of node $v$ at the $k$-th iteration with original/privacy-preserving signal
$\gamma_{uv}$, $\alpha_{uv}$, $\beta_{uv}$ |  Parameters for privacy-preserving signals from node $u$ to $v$
$\mbox{\boldmath{$m$}}_{uv}$ |  Artificial Gaussian noise vector for privacy-preserving signals from node $u$ to $v$
$C_{v}$ |  Aligned amplitudes for signals transmitted from the neighbors of node $v$
$\epsilon_{v}^{*}$ | Pre-given target privacy budget
$\rho_{v}$ |  SNR of $\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$

##  II Preliminaries

###  II-A Graph Neural Networks

GNNs, as the name implies, are especially designed for graph data over the
non-Euclidean domain [21, 22]. By taking the graph adjacency matrix and the
node/edge features as the input, GNNs follow the layer-wise structure and
output embedding vectors for each node in the graph. The graphical
illustration of GNNs can be found in Fig. 1. Specifically, each layer of GNNs
consists of the following two steps: (i) local message function and
aggregation function that collect information from the neighborhood of each
node in the graph; (ii) local update function that updates the hidden state of
each node in the graph at a certain layer. Note that the local message and
update functions are the same for all nodes in the graph and are generally
realized through multi-layer perceptrons (MLPs). For a graph
$G(\mathcal{V},\mathcal{E})$ with node features
$\\{\mbox{\boldmath{$x$}}_{v}\\}_{v\in\mathcal{V}}$ and edge features
$\\{\mbox{\boldmath{$e$}}_{vu}\\}_{e(v,u)\in\mathcal{E}}$, the operations at
the $k$-th layer of GNNs can be mathematically presented as follows

$\mbox{\boldmath{$h$}}_{v}^{(k)}=f_{U}^{(k)}(\mbox{\boldmath{$h$}}_{v}^{(k-1)},{\rm
Agg}_{u\in
N(v)}(f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu}))),$
(1)

where $f_{M}^{(k)}(\cdot)$ and $f_{U}^{(k)}(\cdot)$ are the local message and
update functions at the $k$-th layer, respectively111$M$ and $U$ are initials
of “message” and “update”, respectively.. ${\rm Agg}(\cdot)$ is the
aggregation function whose popular candidates include $\sum(\cdot)$, ${\rm
mean}(\cdot)$, and $\max(\cdot)$. $\mbox{\boldmath{$h$}}_{v}^{(k)}$ represents
the hidden state of node $v$ at the $k$-th layer. Note that
$\mbox{\boldmath{$h$}}_{v}^{(0)}=\mbox{\boldmath{$x$}}_{v}$. Moreover, $N(v)$
denotes the neighbors of node $v$. By stacking multiple layers, the local
information of each node in the graph propagates through the network. The
final embedding vectors
$\\{\mbox{\boldmath{$h$}}_{v}^{(K)}\\}_{v\in\mathcal{V}}$ can be used for
further node/edge/graph-level analysis.

Figure 1: Graph illustration for the structure of GNNs.

###  II-B Local Differential Privacy

Local differential privacy (LDP) generally serves as a strong criterion of
preserving privacy in decentralized systems, which finds successful
applications in many commercial companies, such as Google [40] and Microsoft
[41]. The key idea of LDP is enabling statistical analysis without divulging
the personal information, which is more than data security. Specifically, LDP
can be defined formally as follows.

Definition 1: ($(\epsilon,\delta)$-LDP [42]) A randomized mechanism
$\mathcal{M}:\mathbb{N}^{|\mathcal{X}|}\rightarrow\mathbb{R}^{d}$ is
$(\epsilon,\delta)$-LDP if for any two adjacent databases
$\mbox{\boldmath{$x$}},\mbox{\boldmath{$x$}}^{\prime}\in\mathbb{N}^{|\mathcal{X}|}$
and any measurable subset $\mathcal{O}\subseteq Range(\mathcal{M})$, we have
$Pr(\mathcal{M}(\mbox{\boldmath{$x$}})\in\mathcal{O})\leq
e^{\epsilon}Pr(\mathcal{M}(\mbox{\boldmath{$x$}}^{\prime})\in\mathcal{O})+\delta,$
where $\epsilon$ is called privacy budget and controls the similarities
between the probabilities that the mechanism $\mathcal{M}$ assigns to the
outputs of adjacent databases
$\mbox{\boldmath{$x$}},\mbox{\boldmath{$x$}}^{\prime}$. The smaller the
$\epsilon$ is, the more difficult an adversary could distinguish two adjacent
databases with high probability by only looking at the output. Therefore, a
smaller $\epsilon$ leads to stronger privacy guarantee. Moreover, $\delta$
denotes the probability of violating the above privacy guarantee. Similarly, a
smaller $\delta$ also leads to stronger privacy guarantee.

According to how adjacent databases are defined, LDP can be categorized into
client-level LDP and record-level LDP that provide privacy preservation for
one client’s records and a single record of one client, respectively [43].
Generally, client-level LDP provides stronger privacy preservation than
record-level LDP. Therefore, we use client-level LDP in this paper to protect
node features for decentralized inference with GNNs in wireless networks and
define that two graphs are neighboring if only one node feature differs.

Furthermore, for numerical data, $(\epsilon,\delta)$-LDP can be achieved by
using the Gaussian mechanism defined as follows.

Definition 2: (Gaussian Mechanism [42]) Let
$f(\cdot):\mathbb{N}^{|\mathcal{X}|}\rightarrow\mathbb{R}^{d}$ be an arbitrary
function and define its $l_{2}$ sensitivity to be bounded by $\Delta_{2f}$,
i.e.,
$||f(\mbox{\boldmath{$x$}})-f(\mbox{\boldmath{$x$}}^{\prime})||_{2}\leq\Delta_{2f},\forall\text{adjacent
}\mbox{\boldmath{$x$}},\mbox{\boldmath{$x$}}^{\prime}\in\mathbb{N}^{|\mathcal{X}|}$.
The Gaussian mechanism is defined as $M(\mbox{\boldmath{$x$}})\triangleq
f(\mbox{\boldmath{$x$}})+\mathcal{N}(0,\sigma^{2}\mbox{\boldmath{$I$}}),$
where $\mathcal{N}(0,\sigma^{2}\mbox{\boldmath{$I$}})$ denotes the
$d$-dimensional Gaussian noise whose mean is 0 and variance is $\sigma^{2}$.

Moreover, for any $\epsilon\in(0,1]$ and $\delta\in(0,1]$, the above defined
Gaussian mechanism is $(\epsilon,\delta)$-LDP, where
$\epsilon=\Delta_{2f}\sqrt{2\ln\frac{1.25}{\delta}}/\sigma$. Given that noise
generally follows Gaussian distribution in communication systems, we will make
use of the Gaussian mechanism in this paper to achieve privacy-preserving
decentralized inference with GNNs in wireless networks.

###  II-C Over-the-Air Computation

Over-the-air computation (Aircomp) recently becomes prevalent in distributed
learning schemes, such as federated learning [44, 45]. By exploiting the
signal-superposition property, Aircomp can simultaneously transmit and compute
the analog signals from users in a multiple-access channel (MAC), and thus
significantly enhance the communication and computation efficiency compared
with the orthogonal transmit-then-compute protocol. Using an ideal MAC with
$K$ users as an example, each user transmits a signal $s_{k}\in\mathbb{R}$,
and the received signal at the receiver with signal-superposition property is
given by $r=\sum_{k=1}^{K}s_{k},$ which achieves the task of computing the sum
of $K$ users’ signals. Similarly, by additionally adopting pre- and post-
processing functions, the above Aircomp process can also achieve other real-
valued multivariate functions, such as the arithmetic/geometric mean.

The key observation for GNNs is that aggregating neighborhood information to
update the hidden state of each node in the graph falls in the category of
computing functions of distributed data if ${\rm Agg}(\cdot)$ is set as
$\sum(\cdot)$ or ${\rm mean}(\cdot)$. Therefore, in this paper, we propose
adopting the Aircomp technique for communication- and computation-efficient
aggregation during the inference stage of GNNs.

##  III System Model

In this section, we first introduce the general formulation of the wireless
optimization problem and its corresponding graphical model. Then we discuss
using GNNs for the wireless optimization problem as well as its decentralized
implementation in wireless networks.

###  III-A Wireless Optimization Problem and Corresponding Graphical Model

Wireless optimization problems can be generally formulated as optimizing over
graph data, $G(\mathcal{V},\mathcal{E})$, with the node set $\mathcal{V}$ and
the edge set $\mathcal{E}$222$G(\mathcal{V},\mathcal{E})$ can be either
directed or undirected according to specific wireless optimization problems.
Moreover, if $G(\mathcal{V},\mathcal{E})$ is dynamic but remains static within
the coherence time, our proposed method is applicable for each instant of the
dynamic graph.. According to specific applications, nodes in $\mathcal{V}$
correspond to wireless devices, such as mobile devices, edge servers, access
points, or base stations, while edges in $\mathcal{E}$ indicate that two nodes
(devices) can communicate or interfere with each other. Moreover, all nodes
and edges may have corresponding features, denoted as
$\\{\mbox{\boldmath{$x$}}_{v}\\}_{v\in\mathcal{V}}$ and
$\\{\mbox{\boldmath{$e$}}_{vu}\\}_{e(v,u)\in\mathcal{E}}$, respectively.
Specifically, the features for nodes and edges include the needed
characteristics/hyperparameters for wireless optimization problems, such as
the power limit of each user and the channel gain between two users. The node
features may also include extra sensitive and private information such as
gender and self-preference that the wireless devices do not want to share with
others. With the above graphical model, wireless optimization problems can be
formulated as node/edge/graph-level analysis tasks. For example, link
scheduling [7] corresponds to node-level classification and power control [8,
9] corresponds to node-level regression. A graphical illustration of the above
process can be found in Fig. 2.

Figure 2: A graphical illustration of the wireless network (left) and its
graphical model (right).

###  III-B Decentralized Implementation of GNNs for Wireless Optimization
Problems

With the graphical model, we can use the $K$-layer GNN introduced in Section
II-A to solve the wireless optimization problem. Specifically, with a series
of operations in (1), each node in $\mathcal{V}$ is embedded as a vector. With
additional MLPs or other learning models (e.g. reinforcement learning) to
further process the embedding vectors of all nodes, corresponding
node/edge/graph-level analysis tasks can be accomplished. Without loss of
generality, we adopt $\sum(\cdot)$ as the aggregation function for the
subsequent discussion of this paper, then the operations of the $k$-th layer
of the GNN are given by

$\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}=\sum_{u\in
N(v)}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu}),$
(2)
$\mbox{\boldmath{$h$}}_{v}^{(k)}=f_{U}^{(k)}(\mbox{\boldmath{$h$}}_{v}^{(k-1)},\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}),$
(3)

where $\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}$ is termed the message of node
$v$ at the $k$-th laye.

Note that the operations in (2) and (3) are naturally decentralized.
Meanwhile, deploying the inference stage of GNNs in a decentralized manner has
been actively researched in literature [23, 24, 25]. As a premise, we assume
that the GNN model is already well-trained and each node (user) in the graph
keeps a copy of it, which means that the parameters of the GNN model are
available at each node333The detailed privacy-guaranteed training algorithm
for GNNs will be discussed in Section V. During the inference stage, each node
$v\in\mathcal{V}$ can accomplish its own prediction and solve the
corresponding wireless optimization problem in a decentralized manner by
repeating the following process for $K$ times. Specifically, for the $k$-th
iteration,

  * •

Node $v$ sends transmission requests to each node $u\in N(v)$.

  * •

After receiving the request from node $v$, each node $u\in N(v)$ transmits a
signal
$\mbox{\boldmath{$w$}}_{uv}^{(k)}=\sqrt{P_{u}}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})$
to node $v$ through wireless channels, where $P_{u}$ is the maximum transmit
power of node $u$.

  * •

Node $v$ computes the sum of
$\\{f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})\\}_{u\in
N(v)}$ to get $\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}$, and then imposes
$f_{U}^{(k)}(\cdot)$ to get $\mbox{\boldmath{$h$}}_{v}^{(k)}$.

Finally, the embedding vector for node $v$, i.e.,
$\mbox{\boldmath{$h$}}_{v}^{(K)}$, can be obtained for further analysis.

###  III-C Wireless Communication Model

The information exchanges among neighbors are achieved through wireless
channels. In this paper, we consider a single-antenna multiple-access system
with slow fading and independent and identically distributed (i.i.d.) Gaussian
noise, which indicates that the channel gain remains static within the
inference while the noise is i.i.d over different iterations. We further
assume that the channel state information (CSI) is available to both the
transmitter and receiver. With the Aircomp technique, the sum of
$\\{f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})\\}_{u\in
N(v)}$ is computed during the communication process. Therefore, the received
signal of node $v$ at the $k$-th iteration is given by

$\displaystyle\mbox{\boldmath{$R$}}_{v}^{(k)}$ $\displaystyle=\sum_{u\in
N(v)}g_{uv}\mbox{\boldmath{$w$}}_{uv}^{(k)}+\mbox{\boldmath{$n$}}_{v}^{(k)},$
$\displaystyle=\sum_{u\in
N(v)}g_{uv}\sqrt{P_{u}}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})+\mbox{\boldmath{$n$}}_{v}^{(k)},$

where $g_{uv}=|g_{uv}|e^{j\varphi_{uv}}$ is the complex valued channel
coefficient from node $u$ to node $v$, and $\mbox{\boldmath{$n$}}_{v}^{(k)}$
is the Gaussian noise vector whose elements are i.i.d drawn from
$\mathcal{N}(0,\sigma_{v}^{2})$ for node $v$ at the $k$-th
iteration444Following existing literature about the Aircomp, neither
interference nor channel coding is considered in this work so as to focus on
the main theme of privacy protection in GNN inference. The proposed mechanism
can be naturally extended to scenarios involving interference and channel
coding with some minor modifications..

The above transmission scheme exhibits the following two issues. First, the
received signal $\mbox{\boldmath{$R$}}_{v}^{(k)}$ is contaminated by fading
and noise, and therefore cannot be directly used to estimate
$\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}$ in (2). Moreover, the personal
features of each node, i.e. $\mbox{\boldmath{$x$}}_{u}$(or say
$\mbox{\boldmath{$h$}}_{u}^{(0)})$, may be inferred/detected by honest-but-
curious neighbors and possibly anonymous hackers from the transmitting signal
$\mbox{\boldmath{$w$}}_{uv}^{(1)}$. In the following, we propose novel
techniques, including privacy-preserving wireless signaling and privacy-
guaranteed training algorithm, to overcome the above two challenges to achieve
privacy-preserving decentralized inference with GNNs in wireless networks.

##  IV Privacy-Preserving Wireless Signaling

In this section, we introduce the privacy-preserving wireless signaling aiming
at privacy-preserving decentralized inference with GNNs in wireless networks.
We first formulate the privacy-preserving wireless signaling problem and then
derive its optimal solution, based on which the SNR-privacy trade-off is
analyzed to provide performance upper bound.

###  IV-A Problem Formulation

####  IV-A1 The Last $K-1$ Iterations

Our focus is to protect the privacy of node features. For the last $K-1$
iterations during the inference, node features are not directly involved in
the computation of exchanged information, i.e.
$\\{\mbox{\boldmath{$w$}}_{uv}^{(k)}\\}_{k=2}^{K}$. Therefore, node features
are difficult to be inferred if the information of the first iteration is
missing. Based on this fact, no privacy leakage exists for the last $K-1$
iterations555If one still wants to enhance the privacy for the last $K-1$
iterations, the proposed privacy-preserving wireless signaling can still help
with optimizing the signal in a similar way as the first iteration. and the
corresponding goal of signal design is to correct channel fading and noise to
get unbiased and accurate estimations on
$\\{\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}\\}_{k=2}^{K}$. Thus, we propose the
following signal for node $u$ communicating with node $v$ at the $k$-th
iteration

$\mbox{\boldmath{$\tilde{w}$}}_{uv}^{(k)}=e^{-j\varphi_{uv}}\sqrt{\gamma_{uv}P_{u}}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu}),$
(4)

where the multiplication factor $e^{-j\varphi_{uv}}$ is used to correct the
phase shift induced by the wireless channel, while $\gamma_{uv}\in(0,1]$ is a
parameter to be optimized. With this newly designed signal, the received
signal of node $v$ at the $k$-th iteration is given by

$\displaystyle\mbox{\boldmath{$\tilde{R}$}}_{v}^{(k)}$
$\displaystyle=\sum_{u\in
N(v)}g_{uv}\mbox{\boldmath{$\tilde{w}$}}_{uv}^{(k)}+\mbox{\boldmath{$n$}}_{v}^{(k)},$
(5) $\displaystyle=\sum_{u\in
N(v)}|g_{uv}|\sqrt{\gamma_{uv}P_{u}}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})+\mbox{\boldmath{$n$}}_{v}^{(k)}.$

By following the rules of Aircomp, the amplitudes of all neighbors’
information need to be aligned as a constant to obtain an unbiased estimation
on $\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}$, i.e.,
$|g_{uv}|\sqrt{\gamma_{uv}P_{u}}=\text{constant},\forall u\in N(v)$. On the
other hand, the aligned constant needs to be maximized to enhance the
estimation accuracy. Therefore, the optimal solution for $\gamma_{uv}$ is
given by

$\gamma_{uv}=\frac{\min_{u\in N(v)}|g_{uv}|^{2}P_{u}}{|g_{uv}|^{2}P_{u}}.$ (6)

####  IV-A2 The First Iteration

For the first iteration, the proposed wireless signaling is supposed to not
only enable the estimation on $\mbox{\boldmath{$\hat{h}$}}_{v}^{(1)}$ but also
provide privacy guarantee on the features of neighbors, i.e.
$\\{\mbox{\boldmath{$x$}}_{u}\\}_{u\in N(v)}$. As introduced in Section II-B,
Gaussian mechanism is efficient for numerical data to achieve
$(\epsilon,\delta)$-LDP. Therefore, by adding Gaussian noise to the raw
transmitting signal $\mbox{\boldmath{$w$}}_{uv}^{(1)}$, the privacy-preserving
transmitting signal from node $u$ to node $v$ at the first iteration is
proposed as

$\mbox{\boldmath{$\tilde{w}$}}_{uv}^{(1)}=e^{-j\varphi_{uv}}[\sqrt{\alpha_{uv}P_{u}}\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})+\sqrt{\beta_{uv}P_{u}}\mbox{\boldmath{$m$}}_{uv}],$
(7)

where $\mbox{\boldmath{$m$}}_{uv}$ is the artificial Gaussian noise vector for
privacy preservation whose elements are i.i.d and follow the normal
distribution, $\mathcal{N}(0,1)$.
$\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})$
is the normalized version of
$f_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})$,
i.e.,
$||\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})||_{2}=1$.
Moreover, $\alpha_{uv}$ and $\beta_{uv}$ denote the fractions of power
assigned to the information of node $u$ and the artificial Gaussian noise,
respectively, which satisfies $0<\alpha_{uv}\leq 1$ and $0\leq\beta_{uv}\leq
1-\alpha_{uv}$666Note that different from existing signaling,
$\alpha_{uv}+\beta_{uv}=1$ does not always hold in our considered problem,
which will be further validated by the following analysis. . By adopting the
newly designed signal, the received signal of node $v$ at the first iteration
is given by

$\displaystyle\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}=$
$\displaystyle\sum_{u\in
N(v)}|g_{uv}|\sqrt{\alpha_{uv}P_{u}}\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})$
(8) $\displaystyle+\sum_{u\in
N(v)}|g_{uv}|\sqrt{\beta_{uv}P_{u}}\mbox{\boldmath{$m$}}_{uv}+\mbox{\boldmath{$n$}}_{v}^{(1)},$

where the first part is used for estimating
$\mbox{\boldmath{$\hat{h}$}}_{v}^{(1)}$ while the last two noisy parts are
used for privacy preservation.

Goal 1-Estimation: Similar to the analysis in Section IV-A1, the amplitudes of
all neighbors’ information need to be aligned as a constant $C_{v}$ to obtain
the estimation on $\mbox{\boldmath{$\hat{h}$}}_{v}^{(1)}$, i.e.,

$|g_{uv}|\sqrt{\alpha_{uv}P_{u}}=C_{v},\forall u\in N(v).$ (9)

On the other hand, to enhance the accuracy of the estimation on
$\mbox{\boldmath{$\hat{h}$}}_{v}^{(1)}$, the SNR of
$\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$, defined as the ratio between the
power of efficient signal and noise, needs to be maximized. Specifically, the
SNR of $\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$, denoted as $\rho_{v}$, is
mathematically given by

$\rho_{v}=\frac{C_{v}^{2}}{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}.$ (10)

Goal 2-Privacy preservation: We introduce the following theorem for analyzing
the privacy guarantee achieved by $\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$
for each node in $N(v)$, which is proved in Appendix A.

Theorem 1: For each node $u$ in $N(v)$,
$\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$ achieves $(\epsilon_{v},\delta)$-LDP
when predicting node $v$’s result, where

$\epsilon_{v}=\frac{2C_{v}}{\sqrt{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}.$

To achieve privacy-preserving inference, the privacy guarantee $\epsilon_{v}$
needs to be smaller than a pre-given target budget $\epsilon_{v}^{*}$.

Based on above analysis, the signal design problem for the first iteration can
be formulated as follows

$\rho_{v}^{\max}\triangleq\max_{\\{\alpha_{uv},\beta_{uv}\\}_{u\in
N(v)}}\rho_{v}=\frac{C_{v}^{2}}{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}},$ (11)

subject to (9) and

$\displaystyle 0<\alpha_{uv}\leq 1,0\leq\beta_{uv}\leq 1-\alpha_{uv},\forall
u\in N(v),$ (11a) $\displaystyle\frac{2C_{v}}{\sqrt{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}\leq\epsilon_{v}^{*}.$
(11b)

###  IV-B Optimal Solution for Problem (11)

In this subsection, we will develop the optimal solution for Problem (11).
First, we will make use of the aligned amplitude to transform Problem (11)
into a more tractable form. Then, we will discuss and derive the optimal
solution when $\epsilon_{v}^{*}$ is in different ranges.

Specifically, from (9), there exists one-to-one correspondence between the
values of $\\{\alpha_{uv}\\}_{u\in N(v)}$ and $C_{v}$. Therefore, (11a) can be
rewritten as

$\displaystyle\left\\{\begin{array}[]{lr}0<C_{v}\leq\min_{u\in
N(v)}\sqrt{|g_{uv}|^{2}P_{u}},\\\ 0\leq\beta_{uv}\leq
1-\frac{C_{v}^{2}}{|g_{uv}|^{2}P_{u}},\forall u\in N(v).\end{array}\right.$
(12)

With the above analysis, Problem (11) can be rewritten as

$\rho_{v}^{\max}\triangleq\max_{C_{v},\\{\beta_{uv}\\}_{u\in
N(v)}}\rho_{v}=\frac{C_{v}^{2}}{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}},$ (13)

subject to (11b) and (12).

By looking into (12), we have

$\displaystyle\rho_{v}$ $\displaystyle\leq\frac{(\min_{u\in
N(v)}(\sqrt{|g_{uv}|^{2}P_{u}})^{2}}{\sum_{u\in N(v)}|g_{uv}|^{2}\times
0\times P_{u}+\sigma_{v}^{2}}=\frac{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{\sigma_{v}^{2}}.$

On the other hand, with (11b), we have
$\rho_{v}\leq{\epsilon_{v}^{*}}^{2}/(8\ln\frac{1.25}{\delta})$. Therefore,

$\rho_{v}^{\max}=\min\\{\frac{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{\sigma_{v}^{2}},\frac{{\epsilon_{v}^{*}}^{2}}{8\ln\frac{1.25}{\delta}}\\}.$

The two upper bounds coincide with each other when

$\epsilon_{v}^{*}=\sqrt{\frac{8\ln\frac{1.25}{\delta}\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{\sigma_{v}^{2}}}\triangleq\epsilon_{v}^{(0)}.$

In the following, we discuss the solution to Problem (13) under two different
cases.

####  IV-B1 $\epsilon_{v}^{*}>\epsilon_{v}^{(0)}$

When $\epsilon_{v}^{*}>\epsilon_{v}^{(0)}$ holds, we have
$\rho_{v}^{\max}=\min_{u\in N(v)}|g_{uv}|^{2}P_{u}/\sigma_{v}^{2}$ with
$C_{v}=\min_{u\in N(v)}\sqrt{|g_{uv}|^{2}P_{u}},$ and $\beta_{uv}=0,\forall
u\in N(v).$ The solution indicates that no artificial noise is needed and the
target privacy guarantee can be satisfied by only exploiting the channel
noise777In case 1, $\alpha_{uv}$ depends on the worst-case received power from
neighbors, i.e, $\min_{u\in N(v)}|g_{uv}|^{2}P_{u}$. Meanwhile $\beta_{uv}=0$
because the privacy-preserving requirement is weak. With the above solutions,
$\alpha_{uv}+\beta_{uv}=1$ does not always hold for all neighbors in $N(v)$,
which validates the statement in Section IV-A..

####  IV-B2 $\epsilon_{v}^{*}\leq\epsilon_{v}^{(0)}$

When $\epsilon_{v}^{*}\leq\epsilon_{v}^{(0)}$ holds, we have
$\rho_{v}^{\max}={\epsilon_{v}^{*}}^{2}/(8\ln\frac{1.25}{\delta})$. The
feasible solutions of $C_{v}$ and $\\{\beta_{uv}\\}_{u\in N(v)}$ fall into the
set given by (14a) - (14c),

$\displaystyle\Phi_{v}=$ $\displaystyle 0<C_{v}\leq\min\\{\min_{u\in
N(v)}\sqrt{|g_{uv}|^{2}P_{u}},\epsilon_{v}^{*}\sqrt{\frac{\sigma_{v}^{2}+\sum_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{8\ln\frac{1.25}{\delta}+|N(v)|{\epsilon_{v}^{*}}^{2}}}\\},$
(14a) $\displaystyle\Phi_{v}=$ $\displaystyle 0\leq\beta_{uv}\leq
1-\frac{C_{v}^{2}}{|g_{uv}|^{2}P_{u}},\forall u\in N(v),$ (14b)
$\displaystyle\Phi_{v}=$ $\displaystyle\frac{2C_{v}}{\sqrt{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}=\epsilon_{v}^{*},$
(14c)

whose mathematical derivation can be found in Appendix B. When adopting the
Aircomp technique, the aligned amplitude, i.e., $C_{v}$, is preferred to be as
large as possible [33]. Therefore, the solution of $C_{v}$ is given by

$\displaystyle C_{v}$
$\displaystyle=\left\\{\begin{array}[]{lr}\epsilon_{v}^{*}\sqrt{\frac{\sigma_{v}^{2}+\sum_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{8\ln\frac{1.25}{\delta}+|N(v)|{\epsilon_{v}^{*}}^{2}}},\text{if
}\epsilon_{v}^{*}\leq\epsilon_{v}^{(1)},\\\ \min_{u\in
N(v)}\sqrt{|g_{uv}|^{2}P_{u}},\text{if
}\epsilon_{v}^{(1)}\leq\epsilon_{v}^{*}\leq\epsilon_{v}^{(0)},\end{array}\right.$
(15)

where

$\epsilon_{v}^{(1)}\triangleq\sqrt{\frac{{8\ln\frac{1.25}{\delta}\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}}{\sum_{u\in
N(v)}|g_{uv}|^{2}P_{u}+\sigma_{v}^{2}-|N(v)|\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}}.$

To be more specific, when $\epsilon_{v}^{*}\leq\epsilon_{v}^{(1)}$ holds, by
putting the value of $C_{v}$ into (14c), the values of $\\{\beta_{uv}\\}_{u\in
N(v)}$ are given by $\beta_{uv}=1-C_{v}^{2}/(|g_{uv}|^{2}P_{u}),\forall u\in
N(v).$ On the other hand, when
$\epsilon_{v}^{(1)}\leq\epsilon_{v}^{*}\leq\epsilon_{v}^{(0)}$ holds, the
values of $\\{\beta_{uv}\\}_{u\in N(v)}$ should satisfy

$\displaystyle 0\leq\beta_{uv}\leq 1-\frac{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{|g_{uv}|^{2}P_{u}}\triangleq\beta_{uv}^{U},\forall
u\in N(v),$ (16a) $\displaystyle\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}=\frac{8\ln\frac{1.25}{\delta}\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{{\epsilon_{v}^{*}}^{2}}-\sigma_{v}^{2},$ (16b)

and can be solved by a water-filling alike algorithm summarized as Algorithm
I. The key idea is allocating the right-hand-side of (16b) among $|N(v)|$
neighbors, where $\mathbbm{1}_{A}$ is the indicator function defined as
follows

$\displaystyle\mathbbm{1}_{A}=\left\\{\begin{array}[]{rcl}1,&\text{if event
}A\text{ occurs},\\\ 0,&\text{otherwise}.\\\ \end{array}\right.$ (19)

Algorithm 1 Water-Filling Alike Algorithm for $\\{\beta_{uv}\\}_{u\in N(v)}$

1: initialization

  * •

Set $D=\frac{8\ln\frac{1.25}{\delta}\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{{\epsilon_{v}^{*}}^{2}}-\sigma_{v}^{2}$, $I=N(v)$.

2: while $D>0$ do

3: Computing Water-filling Threshold: $\bar{D}=\frac{D}{|I|}$.

4: Deciding Filling Strategy:

5: if $|g_{uv}|^{2}\beta_{uv}^{U}P_{u}\geq\bar{D},\forall u\in I$ then

6: Set $\beta_{uv}=\frac{\bar{D}}{|g_{uv}|^{2}P_{u}},\forall u\in I.$

7: Set $D=0$.

8: else

9: Set
$\beta_{uv}=\beta_{uv}^{U}\mathbbm{1}_{|g_{uv}|^{2}\beta_{uv}^{U}P_{u}\leq\bar{D}},\forall
u\in I$.

10: Update $D=D-\sum_{u\in
I}|g_{uv}|^{2}\beta_{uv}^{U}P_{u}\mathbbm{1}_{|g_{uv}|^{2}\beta_{uv}^{U}P_{u}\leq\bar{D}}.$

11: Pop out $u$ with $|g_{uv}|^{2}\beta_{uv}^{U}P_{u}\leq\bar{D}$ from $I$.

12: end if

13: end while

Based on the above analysis, the optimal solutions for Problem (11) can be
summarized as follows

$\displaystyle\alpha_{uv}$
$\displaystyle=\left\\{\begin{array}[]{lr}\frac{{\epsilon_{v}^{*}}^{2}(\sigma_{v}^{2}+\sum_{u\in
N(v)}|g_{uv}|^{2}P_{u})}{|g_{uv}|^{2}P_{u}(8\ln\frac{1.25}{\delta}+|N(v)|{\epsilon_{v}^{*}}^{2})},\text{if
}\epsilon_{v}^{*}\leq\epsilon_{v}^{(1)},\\\ \frac{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{|g_{uv}|^{2}P_{u}},\text{if
}\epsilon_{v}^{*}>\epsilon_{v}^{(1)}.\end{array}\right.$ (20)
$\displaystyle\beta_{uv}$
$\displaystyle=\left\\{\begin{array}[]{lr}1-\alpha_{uv},\text{if
}\epsilon_{v}^{*}\leq\epsilon_{v}^{(1)},\\\ \text{given by Algorithm I},\text{
if }\epsilon_{v}^{(1)}\leq\epsilon_{v}^{*}\leq\epsilon_{v}^{(0)},\\\
0,\text{if }\epsilon_{v}^{*}>\epsilon_{v}^{(0)}.\end{array}\right.$ (21)

###  IV-C SNR-Privacy Trade-off and Performance Analysis

In this part, we analyze the performance of the proposed privacy-preserving
wireless signaling. Specifically, we focus on the trade-off between the SNR of
$\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$ and the achieved privacy guarantee
at the first iteration when predicting node $v$’s result. These two metrics
influence the inference performance and privacy, respectively. With the
solutions in (20) and (21), the SNR of the received signal
$\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$ is maximized while
$\epsilon_{v}^{*}$ is satisfied and the maximum value is given by

$\displaystyle\rho_{v}^{\max}$
$\displaystyle=\left\\{\begin{array}[]{lr}\frac{{\epsilon_{v}^{*}}^{2}}{8\ln\frac{1.25}{\delta}},\text{if
}\epsilon_{v}^{*}\leq\epsilon_{v}^{(0)},\\\ \frac{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{\sigma_{v}^{2}},\text{if
}\epsilon_{v}^{*}>\epsilon_{v}^{(0)},\end{array}\right.$ (22)

which serves as the upper bound of the received SNR with a given privacy
requirement, i.e., a given target privacy budget. In the following, we define
the SNR-privacy trade-off function and the achievable (SNR, privacy guarantee)
pair.

Definition 3: (SNR-Privacy Trade-off Function) During decentralized inference
with GNNs in wireless networks, the SNR-privacy trade-off function of node $v$
is given by

$\displaystyle\rho_{v}^{\max}(\epsilon_{v})$
$\displaystyle=\left\\{\begin{array}[]{lr}\frac{\epsilon_{v}^{2}}{8\ln\frac{1.25}{\delta}},\text{if
}\epsilon_{v}\leq\epsilon_{v}^{(0)},\\\ \frac{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{\sigma_{v}^{2}},\text{if
}\epsilon_{v}>\epsilon_{v}^{(0)},\end{array}\right.$ (23)

where a ($\rho_{v},\epsilon_{v}$) pair is defined as achievable if
$\rho_{v}\leq\rho_{v}^{\max}(\epsilon_{v})$ holds. Note that the statement
that a ($\rho_{v},\epsilon_{v}$) pair is achievable means that there exists at
least a signal design solution, i.e., $\\{\alpha_{uv},\beta_{uv}\\}_{u\in
N(v)}$, such that the SNR of $\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$ is
$\rho_{v}$ while $(\epsilon_{v},\delta)$-LDP is achieved.

The graphical illustration of the SNR-privacy trade-off function is shown in
Fig. 3. As suggested by the graph, the SNR-privacy trade-off function divides
the whole space into achievable and unachievable regions, which are marked by
blue and orange slashes, respectively. Moreover, the achievable region can be
further divided into two sub-regions. Specifically, when
$\epsilon_{v}\leq\epsilon_{v}^{(0)}$ holds, the upper bound of $\rho_{v}$ only
depends on the hyperparameters of privacy requirements, i.e., $\epsilon_{v}$
and $\delta$. From Fig. 3, the upper bound of the received SNR increases with
$\epsilon_{v}$, which indicates that the performance of decentralized
inference with GNNs can be enhanced by the loss of privacy. Therefore, this
sub-region is termed as privacy-limited region, which is marked with blue
forward slashes. On the other hand, when $\epsilon_{v}>\epsilon_{v}^{(0)}$
holds, the upper bound of $\rho_{v}$ only depends on the hyperparameters of
wireless communications, including $\sigma_{v}^{2}$ and the worst-case
received power from neighbors, i.e, $\min_{u\in N(v)}|g_{uv}|^{2}P_{u}$.
Increasing $\epsilon_{v}$ in this sub-region does not lead to SNR gain, and
the performance of decentralized inference with GNNs can only be enhanced by
more abundant wireless resources. Therefore, this sub-region is termed as SNR-
limited region, which is marked with blue backslashes. The above analysis will
be further validated by the simulation results in Section VII-D.

Figure 3: A graphical illustration of the SNR-privacy trade-off function.

##  V  Privacy-Guaranteed Training Algorithm

To achieve privacy-preserving decentralized inference, both artificial and
channel noise are exploited in the wireless signaling proposed above.
Unfortunately, they may deteriorate the estimation accuracy on
$\\{\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}\\}_{k=1}^{K}$, and therefore cause
inference performance loss, such as lower accuracy or higher mean squared
error, compared to the case with perfect wireless transmission and no privacy
guarantee. Although we maximize the SNR of
$\\{\mbox{\boldmath{$\tilde{R}$}}_{v}^{(k)}\\}_{k=1}^{K}$ with the solutions
in (6), (20), and (21) to enhance the estimation accuracy on
$\\{\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}\\}_{k=1}^{K}$, the inference
performance loss induced by noise and fading still exists. Traditional
training algorithms, however, do not take wireless environments into
consideration and cannot overcome the above issue. In this section, we modify
the training process of GNNs based on the privacy-preserving wireless
signaling mentioned in Section IV to mitigate the impact of noise and fading
and enhance the inference performance of decentralized GNNs under a certain
privacy guarantee.

The basic idea is training with noise and fading, where noise includes both
artificial and channel noise. Compared with the traditional training algorithm
of GNNs, there are three improvements/differences in the proposed privacy-
guaranteed training algorithm as follows.

1\. Enhanced training samples: For the traditional training algorithm, a
training sample corresponds to a graph data, including its graph adjacency
matrix and the node/edge features. However, in our proposed training
algorithm, parameters of wireless transmissions and privacy preservation are
also included in a training sample. Specifically, parameters of wireless
transmissions consist of channel coefficients $g_{uv}$, channel noise
variances $\sigma_{v}^{2}$, and transmit power limits $P_{v}$ for all users,
while parameters of privacy preservation refer to $\epsilon_{v}^{*}$ and
$\delta$.

2\. Pre-processing on training samples: Before training,
$\\{\gamma_{uv},\alpha_{uv},\beta_{uv}\\}$ is computed based on (6), (20), and
(21) for each training sample.

3\. Modified forward pass: In the traditional training algorithm, the forward
pass refers to the computation and storage of intermediate variables and
outputs following the operations defined in (2) and (3) from the first layer
to the $K$-th layer. To resist the influence of noise and fading, we inject
noise and fading during the forward pass in our proposed training algorithm by
following the idea of adversarial training. Therefore, the operations in (2)
during the forward pass are modified as (24).

$\displaystyle\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}$
$\displaystyle=\left\\{\begin{array}[]{lr}\sum_{u\in
N(v)}[\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})+\frac{|g_{uv}|}{C_{v}}\sqrt{\beta_{uv}P_{u}}\mbox{\boldmath{$m$}}_{uv}]+\frac{\mbox{\boldmath{$n$}}_{v}^{(1)}}{C_{v}},\text{if
}k=1,\\\ \sum_{u\in
N(v)}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})+\frac{\mbox{\boldmath{$n$}}_{v}^{(k)}}{\sqrt{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}},\text{otherwise}.\end{array}\right.$ (24)

The backward gradient propagation keeps the same as the traditional training
algorithm and therefore the convergence of the proposed training algorithm can
be guaranteed.

The main process of the proposed privacy-guaranteed training algorithm is
summarized in Fig. 4, whose advantage will be validated by the simulation
results in Section VII-C.

Figure 4: A graphical illustration of the privacy-guaranteed training
algorithm.

##  VI Extension to systems without Aircomp

This paper thus far proposes the optimal wireless signal design, performance
upper bound analysis, and modified training algorithms for privacy-preserving
decentralized inference with GNNs. All above mentioned design and analysis
have universality, which are not only applicable for different wireless
applications but also for different wireless communication models. On the
other hand, the Aircomp technique sometimes may fail since it relies on the
high-accurate synchronization among users888Node synchronization technique is
out of the scope of this paper but has been well studied in literature, such
as [46, 47].. Moreover, some aggregation functions of GNNs, such as
$\max(\cdot)$, cannot be achieved by the Aircomp technique. To not only
validate the universality of our design and analysis but also avoid the
possible system failure induced by the Aircomp technique, in this section, we
extend our design and analysis to the wireless system without the Aircomp
technique, and meanwhile further emphasize the superiority of the Aircomp
technique for privacy-preserving decentralized inference with GNNs.

###  VI-A Wireless Communication Model

Without the Aircomp technique, we consider a single-antenna orthogonal system
with slow fading and i.i.d Gaussian noise. The CSI is still available to both
the transmitter and receiver. During decentralized inference with GNNs, the
received signal of node $v$ from its neighbor $u\in N(v)$ at the $k$-th
iteration, denoted as $\mbox{\boldmath{$R$}}_{uv}^{(k)}$, is given by

$\displaystyle\mbox{\boldmath{$R$}}_{uv}^{(k)}$
$\displaystyle=g_{uv}\mbox{\boldmath{$w$}}_{uv}^{(k)}+\mbox{\boldmath{$n$}}_{uv}^{(k)}=g_{uv}\sqrt{P_{u}}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})+\mbox{\boldmath{$n$}}_{uv}^{(k)},$

where the elements in $\mbox{\boldmath{$n$}}_{uv}^{(k)}$ are i.i.d drawn from
$\mathcal{N}(0,\sigma_{v}^{2})$. Similar to the analysis in Section III-C,
directly transmitting $\mbox{\boldmath{$w$}}_{uv}^{(k)}$ makes it difficult to
achieve privacy-preserving inference, which indicates the necessity of novel
wireless signaling.

###  VI-B Privacy-Preserving Wireless Signaling

Similar to the analysis in Section IV, the transmitting signals for the last
$K-1$ iterations only aim at accurate estimations on
$\\{f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})\\}_{k=2}^{K}$.
To achieve this goal, we can adopt the signal proposed in (4) and setting
$\gamma_{uv}=1$ since there is no amplitude alignment constraint for the
system without the Aircomp technique.

On the other hand, for the first iteration, the transmitting signal should
provide privacy guarantee. Therefore, we can adopt the signal designed in (7),
and the received signal of node $v$ from its neighbor $u\in N(v)$ at the first
iteration, denoted as $\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}$, is given by

$\displaystyle\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}=$
$\displaystyle|g_{uv}|\sqrt{\alpha_{uv}P_{u}}\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})$
(25)
$\displaystyle+|g_{uv}|\sqrt{\beta_{uv}P_{u}}\mbox{\boldmath{$m$}}_{uv}+\mbox{\boldmath{$n$}}_{uv}^{(1)}.$

We introduce the following theorem to analyze the privacy guarantee achieved
by $\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}$ for node $u$, whose proof can be
found in Appendix C.

Theorem 2: For node $u$ in $N(v)$, $\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}$
achieves $(\epsilon_{uv},\delta)$-LDP when predicting node $v$’s result, where

$\epsilon_{uv}=\frac{2|g_{uv}|\sqrt{\alpha_{uv}P_{u}}}{\sqrt{|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}.$

Furthermore, without the help of the Aircomp technique, node $v$ needs to
first estimate
$\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})$
from $\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}$ for all neighbors in $N(v)$,
and then compute the sum of
$\\{\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})\\}_{u\in
N(v)}$ to estimate $\mbox{\boldmath{$\hat{h}$}}_{v}^{(1)}$ as follows

$\displaystyle\sum_{u\in
N(v)}\frac{\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}}{|g_{uv}|\sqrt{\alpha_{uv}P_{u}}}=$
$\displaystyle\sum_{u\in
N(v)}\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})$
(26) $\displaystyle+\sum_{u\in
N(v)}[\sqrt{\frac{\beta_{uv}}{\alpha_{uv}}}\mbox{\boldmath{$m$}}_{uv}+\frac{\mbox{\boldmath{$n$}}_{uv}^{(1)}}{|g_{uv}|\sqrt{\alpha_{uv}P_{u}}}].$

To enhance the accuracy of the estimation on
$\mbox{\boldmath{$\hat{h}$}}_{v}^{(1)}$, the SNR of the estimation result in
(26), defined as the ratio between the power of efficient signal and the
noise, needs to be maximized. Specifically, the SNR of the estimation result
in (26), denoted by $\hat{\rho}_{v}$, is mathematically given by

$\hat{\rho}_{v}=\frac{1}{\sum_{u\in
N(v)}\frac{|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}{|g_{uv}|^{2}\alpha_{uv}P_{u}}}.$
(27)

With above analysis, the signal design problem for the system without the
Aircomp technique is formulated as

$\hat{\rho}_{v}^{\max}\triangleq\max_{\\{\alpha_{uv},\beta_{uv}\\}_{u\in
N(v)}}\hat{\rho}_{v}=\frac{1}{\sum_{u\in
N(v)}\frac{|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}{|g_{uv}|^{2}\alpha_{uv}P_{u}}\triangleq\hat{\rho}_{uv}},$
(28)

subject to (11a) and

$\displaystyle\frac{2|g_{uv}|\sqrt{\alpha_{uv}P_{u}}}{\sqrt{|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}\leq\epsilon_{v}^{*},\forall
u\in N(v),$ (28a)

where $\hat{\rho}_{uv}$ is the SNR of
$\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}$ defined as the ratio between the
power of
$\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})$
and the corresponding noise.

Note that Problem (28) can be decomposed into $|N(v)|$ sub-problems since no
amplitude alignment is needed and the optimal signal design is independent
among different neighbors. The solving process of each sub-problem is almost
the same as that of Problem (11) in Section IV-B. Due to the page limit, we
omit the detailed derivation but directly give out the optimal solutions of
Problem (28) as follows

$\displaystyle\alpha_{uv}$
$\displaystyle=\left\\{\begin{array}[]{lr}\frac{{\epsilon_{v}^{*}}^{2}(\sigma_{v}^{2}+|g_{uv}|^{2}P_{u})}{|g_{uv}|^{2}P_{u}(8\ln\frac{1.25}{\delta}+{\epsilon_{v}^{*}}^{2})},\text{if
}\epsilon_{v}^{*}\leq\epsilon_{uv}^{(0)},\\\ 1,\text{if
}\epsilon_{v}^{*}>\epsilon_{uv}^{(0)},\end{array}\right.$ (29)
$\displaystyle\beta_{uv}$ $\displaystyle=1-\alpha_{uv},$ (30)

where
$\epsilon_{uv}^{(0)}=\sqrt{8\ln\frac{1.25}{\delta}|g_{uv}|^{2}P_{u}/\sigma_{v}^{2}}.$

With the optimal signal design given by (29) and (30), the SNR of the received
signal $\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}$ and the SNR of the
estimation result in (26) are simultaneously maximized while
$\epsilon_{v}^{*}$ is satisfied, whose maximum values are given by

$\displaystyle\hat{\rho}_{uv}^{\max}$
$\displaystyle=\left\\{\begin{array}[]{lr}\frac{{\epsilon_{v}^{*}}^{2}}{8\ln\frac{1.25}{\delta}},\text{if
}\epsilon_{v}^{*}\leq\epsilon_{uv}^{(0)},\\\
\frac{|g_{uv}|^{2}P_{u}}{\sigma_{v}^{2}},\text{if
}\epsilon_{v}^{*}>\epsilon_{uv}^{(0)},\end{array}\text{and
}\right.\hat{\rho}_{v}^{\max}=\frac{1}{\sum_{u\in
N(v)\frac{1}{\hat{\rho}_{uv}^{\max}}}},$

respectively. Therefore, the SNR-privacy trade-off function of node $v$ is
given by

$\displaystyle\hat{\rho}_{v}^{\max}(\epsilon_{v})=\frac{1}{\sum_{u\in
N(v)\frac{1}{\hat{\rho}_{uv}^{\max}(\epsilon_{v})}}},$ (31)

where

$\displaystyle\hat{\rho}_{uv}^{\max}(\epsilon_{v})$
$\displaystyle=\left\\{\begin{array}[]{lr}\frac{\epsilon_{v}^{2}}{8\ln\frac{1.25}{\delta}},\text{if
}\epsilon_{v}\leq\epsilon_{uv}^{(0)},\\\
\frac{|g_{uv}|^{2}P_{u}}{\sigma_{v}^{2}},\text{if
}\epsilon_{v}>\epsilon_{uv}^{(0)}.\end{array}\right.$

Compared with the SNR-privacy trade-off function defined in (23) for the
system with the Aricomp technique, we find that
$\rho_{v}^{\max}>\hat{\rho}_{v}^{\max}$ always holds. This conclusion
indicates that adopting the Aricomp technique can enhance the SNR of the
estimation result on $\mbox{\boldmath{$\hat{h}$}}_{v}^{(1)}$ during
decentralized inference with GNNs while achieving the same privacy target. The
reasons are as follows. Without the Aircomp technique, all signals are
transmitted in orthogonal and the privacy of each neighbor is only preserved
by the artificial and channel noise. However, in the system with the Aircomp
technique, the signals from all neighbors are mixed. Therefore, the privacy of
each neighbor is not only preserved by the artificial and channel noise, but
also the transmitting signals of other users. In this way, it is more
difficult for a honest-but-curious neighbor or an adversary to successfully
detect the personal features of each user. Therefore, the Aircomp technique
can not only enhance communication and computation efficiency but also improve
the performance/privacy of decentralized inference with GNNs, which will be
further validated by the simulation results in Section VII-F.

###  VI-C Privacy-Guaranteed Training Algorithm

The privacy-guaranteed training algorithm for the system without the Aircomp
technique is similar to that in Section V. The only difference is that the
operations in (24) are modified as (32).

$\displaystyle\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}$
$\displaystyle=\left\\{\begin{array}[]{lr}\sum_{u\in
N(v)}[\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})+\sqrt{\frac{\beta_{uv}}{\alpha_{uv}}}\mbox{\boldmath{$m$}}_{uv}+\frac{\mbox{\boldmath{$n$}}_{uv}^{(1)}}{|g_{uv}|\sqrt{\alpha_{uv}P_{u}}}],\text{if
}k=1,\\\ \sum_{u\in
N(v)}[f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})+\frac{\mbox{\boldmath{$n$}}_{uv}^{(k)}}{\sqrt{|g_{uv}|^{2}P_{u}}}],\text{otherwise}.\end{array}\right.$
(32)

##  VII Simulation Results

In this section, we use simulation results to validate the efficiency of our
proposed privacy-preserving wireless signaling and privacy-guaranteed training
algorithm. Although our proposed mechanism is a general framework and can be
applied for various wireless optimization problems, we use the sum rate
maximization problem in the Gaussian interference channel as an example for
the following simulation, which serves as a classic application for GNN based
wireless techniques [7, 9]. We first briefly introduce the system model and
graphical model of the sum rate maximization problem. Then we present the
testing results for this application.

###  VII-A Sum Rate Maximization Problem

(a) Wireless system model.

(b) Graphical model.

Figure 5: Wireless system model and graphical model for the sum rate
maximization problem.

As shown in Fig. 5(a), we consider a system with $N$ mutually interfering
single-antenna device-to-device (D2D) pairs. Let $g_{j,i}$ denote the complex
valued channel coefficient from transmitter $j$ to receiver $i$, which is
drawn from the complex Gaussian distribution $\mathcal{CN}(0,1)$. With
additive Gaussian noise i.i.d drawn from $\mathcal{N}(0,\sigma_{i}^{2})$, the
signal-to-interference-plus-noise ratio (SINR) for receiver $i$ is given by
$SINR_{i}=|g_{i,i}|^{2}p_{i}/(\sum_{j\neq
i}|g_{j,i}|^{2}p_{j}+\sigma_{i}^{2})$, where $p_{i}$ is the transmit power of
transmitter $i$ and needs to be optimized to maximize the sum rate of all $N$
receivers. In this way, the mathematical formulation of the sum rate
maximization problem is given by

$\max_{\\{p_{i}\\}_{i=1}^{N}}\sum_{i=1}^{N}\log(1+SINR_{i}),$ (33)

subject to

$\displaystyle 0\leq p_{i}\leq P^{\max},i=1,2,...N,$ (33a)

where $P^{\max}$ is the maximum transmit power of each transmitter for the sum
rate maximization problem.

Note that hyperparameters $\\{g_{uv},\sigma_{v}^{2},P_{v}\\}$ for
decentralized inference with GNNs have different physical meanings from
hyperparameters $\\{g_{i,j},\sigma_{i}^{2},P^{\max}\\}$ in the sum rate
maximization problem (33). The former ones are for decentralized
control/management with GNNs while the latter ones are for the subsequent
transmission after decentralized control/management. However, in the
simulation throughout this paper, $g_{i,j}=g_{vu}$ and
$\sigma_{v}^{2}=\sigma_{i}^{2}$ hold since the wireless environment remains
the same for the control and transmission stages.

The graphical model of the sum rate maximization problem in (33) is shown as
Fig. 5(b), where each node corresponds to a D2D pair and two nodes are
connected by an edge if the corresponding D2D pairs interfere with each other.
Since all D2D pairs are mutually interfering with each other, the
corresponding graphical model is fully-connected. For each node $i$, the node
features999If node features are detected, hackers can transmit noise with
certain power (calculated with detected parameters) to interfere with the
following communication and crash the communication system, which indicates
the necessity of privacy preservation. consist of $|g_{i,i}|$ and
$\sigma_{i}^{2}$. And for each edge between node $i$ and node $j$, the edge
features refer to $|g_{i,j}|$ and $|g_{j,i}|$. With this graphical model, the
sum rate maximization problem is converted to a node-level regression problem
over the graph in Fig. 5(b).

###  VII-B Simulation Setup

All codes are implemented in python 3.9, which run on the Ubuntu system with
two 16-core Intel 2.90GHz CPUs and one GeForce RTX 3080.

####  VII-B1 Parameters for Sum Rate Maximization Problem

We consider a system with $N=10$ D2D pairs, and set $P^{\max}=30$ dBm and
$\sigma_{i}=1$ for all transmitters.

####  VII-B2 Parameters for Decentralized Inference with GNNs

We adopt a 3-layer GNN for the sum rate maximization problem. All
$\\{f_{M}^{(k)},f_{U}^{(k)}\\}_{k=1}^{3}$ are realized through MLPs, whose
structures101010{a,b,c} in Table II indicates that the corresponding MLP has 3
layers, and the number of neurons at each layer is a, b, and c, respectively.
are summarized in Table II. Moreover, we adopt the ReLU function as the
activation function for each layer in the MLPs except the output layer of
$f_{U}^{(3)}(\cdot)$, where the Sigmoid function serves as the activation
function.

TABLE II: The Structure of MLPs for Local Message and Update Functions in GNNs Function | Number of Neurons in Corresponding MLP
---|---
$f_{M}^{(1)}$ | {4,16,32}
$f_{M}^{(2)}$ | {34,64,32}
$f_{M}^{(3)}$ | {34,64,32}
$f_{U}^{(1)}$ | {34,16,32}
$f_{U}^{(2)}$ | {64,64,32}
$f_{U}^{(3)}$ | {64,64,16,1}

During the training process of the GNN model, we use the negative of the sum
rate as the loss function. Therefore, the GNN model is trained in the
unsupervised manner, where labeled training samples that are difficult to
obtain in wireless networks are not needed. Throughout the simulation, 10,000
unlabeled network layouts are used for training with the batch size as 64.
According to [9], each unlabeled network layout is a fully-connected graph
with 10 nodes and the corresponding complex valued channel coefficients
$\\{g_{i,j}\\}$ are generated by following $\mathcal{CN}(0,1)$. Moreover, the
Adam optimizer [48] is adopted with a learning rate of 0.001. We also use
batch normalization to avoid vanishing gradient issue. The training process
will come to an end after 400 training epochs.

As for the inference stage of the GNN model, 1,000 network layouts are used
and all tables/figures in this section report the average performance over all
testing network layouts. Meanwhile, unless otherwise stated, the privacy
requirement is set as ($\epsilon_{v}^{*}=1,\delta=10^{-4}$)-LDP and the
maximum transmit power for inference is set as $P_{v}=10$ dBm for all users.
Furthermore, as mentioned above, $g_{i,j}=g_{vu}$ while
$\sigma_{v}^{2}=\sigma_{i}^{2}=1$ throughout the simulation in this section.

###  VII-C Performance of Privacy-Guaranteed Training Algorithm

In this part, we focus on the performance of the proposed privacy-guaranteed
training algorithm in Section V. We consider the following benchmarks for
comparison111111No state-of-the-art techniques are available for our
considered problem. The simulation is conducted by comparing with some basic
benchmarks..

  * •

Classic training algorithm: The forward pass follows the operations defined in
(2) and (3), where fading and noise, including artificial and channel noise,
are not considered during the training process.

  * •

Training without artificial noise: The forward pass only takes channel fading
and channel noise into consideration, where operations in (2) are modified as

$\mbox{\boldmath{$\hat{h}$}}_{v}^{(k)}=\sum_{u\in
N(v)}f_{M}^{(k)}(\mbox{\boldmath{$h$}}_{u}^{(k-1)},\mbox{\boldmath{$e$}}_{vu})+\frac{\mbox{\boldmath{$n$}}_{v}^{(k)}}{\min_{u\in
N(v)}\sqrt{|g_{uv}|^{2}P_{u}}},\forall k.$

We consider this training algorithm because it only depends on hyperparameters
of wireless transmission {$g_{uv},\sigma_{v}^{2},P_{v}$}, which can be
estimated from $\\{g_{i,j},\sigma_{i}^{2},P^{\max}\\}$, i.e., the node and
edge features of the graphical model for the sum rate maximization problem as
introduced in Section VII-A. Therefore, this training algorithm is feasible in
practice with minor signaling and computation overhead than the privacy-
guaranteed training algorithm.

The testing results are summarized in Table III, where sum rates are
normalized by the sum rate of running the classic weighted minimum mean square
error (WMMSE) algorithm [49] for 100 iterations. In literature, WMMSE
algorithm generally serves as a good performance upper bound for the sum rate
maximization problem with interfering users [2, 9]. Therefore, we use the
normalized sum rate as a performance metric in the remainder of this paper.

TABLE III: Performance of Different Training Algorithms Training Algorithm | Normalized Sum Rate
---|---
Classic training | 0.3701
Training without artificial noise | 0.9549
Privacy-guaranteed training | 0.9587

From Table III, our proposed privacy-guaranteed training algorithm outperforms
both benchmarks, especially the classic training algorithm. This indicates the
effectiveness of our proposed training algorithm. Another interesting finding
is that the performance achieved by the training algorithm without the
artificial noise has minor loss (less than 1%) compared with the proposed
privacy-guaranteed training algorithm. This indicates that we can adopt the
training algorithm without artificial noise when the signaling/computation
resource is limited in practice, which leads to marginal performance loss.

###  VII-D Validation on SNR-Privacy Trade-off

In this part, we discuss and validate the SNR-privacy trade-off defined in
Section IV-C. Specifically, we pay attention to three metrics in this part.
The first metric is the normalized sum rate introduced above. The second one
is the percentage of users in the privacy-limited region. The final one is the
SNR of the received signal $\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$ in (8)
during the first iteration of the inference stage, whose value is normalized
by corresponding maximum121212Normalizing the SNR is for better graphical
illustration..

(a) SNR-privacy trade-off.

(b) The impact of the maximum transmit power for inference.

Figure 6: SNR-privacy trade-off for decentralized inference with GNNs in
wireless networks.

To validate the SNR-privacy trade-off, we adopt the privacy-guaranteed
training algorithm and change the value of the target privacy budget. The
testing results are summarized in Fig. 6(a). From the graph, the tendency of
the received SNR changing with the target privacy budget matches with our
theoretical analysis in Fig. 3. Meanwhile, the normalized sum rate first
increases and then fluctuates around a certain value with the increase of
$\epsilon_{v}^{*}$. This result validates our discussion in Section IV-C. We
draw the conclusion that increasing the target privacy budget to enhance the
inference performance only holds when the target privacy budget is smaller
than a threshold, where most users are in the privacy-limited region.
Otherwise, increasing target privacy budget only leads to weaker privacy
guarantee but no performance gain, where most users are in the SNR-limited
region.

As analyzed in Section IV-C, the performance of decentralized inference with
GNNs for users in the SNR-limited region can only be enhanced by more abundant
wireless resources. This conclusion is then validated by the simulation
results in Fig. 6(b), where we conduct simulation with different maximum
transmit powers for inference, i.e, $P_{v}$. From this figure, when the
percentage of users in the privacy-limited region is small, most users are in
the SNR-limited region, where increasing the maximum transmit power for
inference can enhance the received SNR and the normalized sum rate
simultaneously. The simulation results also indicate that increasing the
maximum transmit power for inference over certain threshold (around 40 dBm in
our simulation) makes all users in the privacy-limited region, which leads to
no inference performance gain but only larger consumption on wireless
resources. This conclusion sheds lights on power control for practical
systems.

Furthermore, from both Figs. 6(a) and 6(b), the normalized sum rate reaches
the maximum value much faster than the received SNR. The reason is that GNN
itself has some robustness/tolerance to the fading and noise as demonstrated
by [13]. The results also indicate that maximizing the received SNR during the
inference stage is sufficient for optimizing the inference performance, which
shows the rationality of our formulated problem (11).

###  VII-E Performance of Privacy-Preserving Wireless Signaling

(a) Normalized SNR.

(b) Normalized sum rate.

Figure 7: Performance comparison between systems on privacy-preserving
wireless signaling with optimal and non-optimal solutions.

In this part, we aim to verify the performance of our proposed privacy-
preserving wireless signaling and conduct simulation on the following two
signal design settings.

  * •

Privacy-preserving wireless signaling with optimal solutions given by (6),
(20) and (21).

  * •

Privacy-preserving wireless signaling with non-optimal solutions by replacing
(6) and (21) with $\gamma_{uv}=\frac{\min_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{2|g_{uv}|^{2}P_{u}}$ and
$\beta_{uv}=1-\alpha_{uv},\forall\epsilon_{v}^{*}$, respectively.

The simulation results are summarized in Fig. 7. When $\epsilon_{v}^{*}$ is
small, $\beta_{uv}=1-\alpha_{uv}$ is the optimal solution according to (21).
Therefore, there is no performance difference between the above two signal
design settings in terms of the received SNR of
$\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$ in (8). However, with the increase
of $\epsilon_{v}^{*}$, the differences between the optimal and non-optimal
solutions gradually become large, which causes performance loss on both the
received SNR and the normalized sum rate when using the privacy-preserving
signal with non-optimal solutions. The simulation results indicate the
necessity and superiority of the proposed privacy-preserving wireless
signaling especially in the SNR-limited region.

###  VII-F Validation on the Advantage of Aircomp

(a) Normalized SNR.

(b) Normalized sum rate.

Figure 8: Performance comparison between systems with and without Aircomp.

In this part, we use simulation results to validate the advantage of the
Aircomp technique and the simulation results are summarized in Fig. 8. As
suggested by Fig. 8, the Aircomp technique can efficiently enhance the
received SNR and the normalized sum rate of each node especially under
stringent privacy target, i.e., in the privacy-limited region. Therefore, the
simulation results are consistent with and validate our theoretical analysis
in Section VI-B.

##  VIII Conclusion

Regarding decentralized control/management in the next-generation wireless
communications, GNN is a potential technique since its inference stage can be
naturally implemented in a decentralized manner. To achieve decentralized
inference with GNNs, information exchanges among neighbors through wireless
channels are inevitable, which however may lead to privacy leakage on personal
features. To overcome this issue, this paper analyzes and enhances the privacy
of decentralized inference with GNNs in wireless networks. We first design
novel privacy-preserving wireless signaling for privacy-preserving
decentralized inference with GNNs, based on which we analyze the SNR-privacy
trade-off and the corresponding performance upper bound. Then the privacy-
guaranteed training algorithm is proposed to further enhance decentralized
inference performance with GNNs in wireless networks. Furthermore, we
theoretically demonstrate that the Aircomp technique can simultaneously
enhance the communication and computation efficiency as well as the privacy
preservation. Extensive simulation results validate our theoretically analysis
about the SNR-privacy trade-off and the performance gain brought by the
Aircomp technique. The results also suggest that our proposed privacy-
preserving wireless signaling and privacy-guaranteed training algorithm work
well for privacy-preserving decentralized inference with GNNs in wireless
networks.

To the best of our knowledge, we are among the first to study privacy-
preserving decentralized inference with GNNs over noisy and fading wireless
channels. As mentioned above, facilitating decentralized inference with GNNs
is crucial for bringing GNN based wireless techniques from theory to practice.
Unfortunately, related work is relatively rare in literature and some open
problems still need further research endeavors. First, one can consider other
techniques, such as the adaptive modulation and coding, the joint source-
channel coding, or other LDP mechanisms to further enhance the privacy of
decentralized inference with GNNs in wireless networks. Moreover, one can also
pay attention to other obstacles for the practical implementation of GNNs in
wireless communications, such as the synchronization among neighbors. Finally,
this paper uses SNR to implicitly represent the performance of decentralized
inference with GNNs in wireless networks. How to build a direct connection
between the inference performance and the wireless environment is worth future
investigation.

##  Appendix A Proof of Theorem 1

With the help of Definition 2, the achieved privacy guarantee by adopting the
Gaussian mechanism depends on the $l_{2}$ sensitivity of the protected
function and the variance of added Gaussian noise. By looking into (8), the
variance of noise, including artificial and channel noise, is given by
$\sigma_{vm}^{2}=\sum_{u\in N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}$.
Furthermore, by considering two adjacent sub-graph data $G_{v}$ and
$G^{\prime}_{v}$ for node $v$ where only one neighbor feature differs, the
$l_{2}$ sensitivity of the protected signal part is derived as follows

$\displaystyle\Delta_{2v}$
$\displaystyle=\max_{G_{v},G^{\prime}_{v}}||\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}(G_{v})-\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}(G_{v}^{\prime})||_{2}$
$\displaystyle=C_{v}\max_{\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)}}||\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})-\check{f}_{M}^{(1)}(\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})||_{2},$
$\displaystyle\leq
C_{v}\max_{\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)}}||\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})||_{2}+||\check{f}_{M}^{(1)}(\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})||_{2}\overset{(a)}{=}2C_{v},$

where step (a) depends on the fact that
$||\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})||_{2}$
$=1$. In this way, for each node $u$ in $N(v)$,
$\mbox{\boldmath{$\tilde{R}$}}_{v}^{(1)}$ achieves $(\epsilon_{v},\delta)$-LDP
when predicting node $v$’s result, where

$\displaystyle\epsilon_{v}$
$\displaystyle=\frac{\Delta_{2v}}{\sigma_{vm}}\sqrt{2\ln\frac{1.25}{\delta}}=\frac{2C_{v}}{\sqrt{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}.$

##  Appendix B Proof of (14a) - (14c)

When $\epsilon_{v}^{*}\leq\epsilon_{v}^{(0)}$ holds,
$\rho_{v}^{\max}={\epsilon_{v}^{*}}^{2}/(8\ln\frac{1.25}{\delta})$. The
feasible solutions of $C_{v}$ and $\\{\beta_{uv}\\}_{u\in N(v)}$ fall into the
set defined as

$\displaystyle 0<C_{v}\leq\min_{u\in N(v)}\sqrt{|g_{uv}|^{2}P_{u}},$ (34a)
$\displaystyle 0\leq\beta_{uv}\leq
1-\frac{C_{v}^{2}}{|g_{uv}|^{2}P_{u}},\forall u\in N(v),$ (34b)
$\displaystyle\frac{2C_{v}}{\sqrt{\sum_{u\in
N(v)}|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}=\epsilon_{v}^{*}.$
(34c)

By combining (34b) and (34c), we have

$\displaystyle\epsilon_{v}^{*}$
$\displaystyle\geq\frac{2C_{v}}{\sqrt{\sum_{u\in
N(v)}|g_{uv}|^{2}(1-\frac{C_{v}^{2}}{|g_{uv}|^{2}P_{u}})P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}$
$\displaystyle\rightarrow
C_{v}\leq\epsilon_{v}^{*}\sqrt{\frac{\sigma_{v}^{2}+\sum_{u\in
N(v)}|g_{uv}|^{2}P_{u}}{8\ln\frac{1.25}{\delta}+|N(v)|{\epsilon_{v}^{*}}^{2}}}.$

Thus, the feasible solution set can be rewritten as (14a) - (14c).

##  Appendix C Proof of Theorem 2

The proof is similar to that in Appendix A. By looking into (25), the variance
of noise, including artificial and channel noise, is given by
$\sigma_{vum}^{2}=|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}$. Furthermore,
the $l_{2}$ sensitivity of the protected signal part is similarly derived as
(35).

$\displaystyle\Delta_{2vu}$
$\displaystyle=\max_{\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)}}|||g_{uv}|\sqrt{\alpha_{uv}P_{u}}\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})-|g_{uv}|\sqrt{\alpha_{uv}P_{u}}\check{f}_{M}^{(1)}(\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})||_{2},$
(35)
$\displaystyle=|g_{uv}|\sqrt{\alpha_{uv}P_{u}}\max_{\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)}}||\check{f}_{M}^{(1)}(\mbox{\boldmath{$h$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})-\check{f}_{M}^{(1)}(\mbox{\boldmath{$h^{\prime}$}}_{u}^{(0)},\mbox{\boldmath{$e$}}_{vu})||_{2}\leq
2|g_{uv}|\sqrt{\alpha_{uv}P_{u}}.$

In this way, for node $u$ in $N(v)$,
$\mbox{\boldmath{$\tilde{R}$}}_{uv}^{(1)}$ achieves
$(\epsilon_{uv},\delta)$-LDP when predicting node $v$’s result, where

$\displaystyle\epsilon_{uv}$
$\displaystyle=\frac{\Delta_{2vu}}{\sigma_{vum}}\sqrt{2\ln\frac{1.25}{\delta}}=\frac{2|g_{uv}|\sqrt{\alpha_{uv}P_{u}}}{\sqrt{|g_{uv}|^{2}\beta_{uv}P_{u}+\sigma_{v}^{2}}}\sqrt{2\ln\frac{1.25}{\delta}}.$

## References

  * [1] W. Saad, M. Bennis, and M. Chen, “A vision of 6G wireless systems: Applications, trends, technologies, and open research problems,” _IEEE Netw._ , vol. 34, no. 3, pp. 134–142, May/Jun. 2020.
  * [2] H. Sun, X. Chen, Q. Shi, M. Hong, X. Fu, and N. D. Sidiropoulos, “Learning to optimize: Training deep neural networks for interference management,” _IEEE Trans. Signal Process._ , vol. 66, no. 20, pp. 5438–5453, Oct. 2018.
  * [3] Y. Shen, Y. Shi, J. Zhang, and K. B. Letaief, “LORM: Learning to optimize for resource management in wireless networks with few training samples,” _IEEE Trans. Wireless Commun._ , vol. 19, no. 1, pp. 665–679, Jan. 2020.
  * [4] M. Lee, G. Yu, and G. Y. Li, “Learning to branch: Accelerating resource allocation in wireless networks,” _IEEE Trans. Veh. Technol._ , vol. 69, no. 1, pp. 958–970, Jan. 2020.
  * [5] W. Cui, K. Shen, and W. Yu, “Spatial deep learning for wireless scheduling,” _IEEE J. Sel. Areas Commun._ , vol. 37, no. 6, pp. 1248–1261, Jun. 2019.
  * [6] M. Lee, G. Yu, H. Dai, and G. Y. Li, “Graph neural networks meet wireless communications: Motivation, applications, and future directions,” _IEEE Wirel. Commun._ , vol. 29, no.5, pp. 12–19, Oct. 2022.
  * [7] M. Lee, G. Yu, and G. Y. Li, “Graph embedding based wireless link scheduling with few training samples,” _IEEE Trans. Wireless Commun._ , vol. 20, no. 4, pp. 2282–2294, Apr. 2021.
  * [8] M. Eisen and A. R. Ribeiro, “Optimal wireless resource allocation with random edge graph neural networks,” _IEEE Trans. Signal Process._ , vol. 68, pp. 2977–2991, Apr. 2020.
  * [9] Y. Shen, Y. Shi, J. Zhang, and K. B. Letaief, “Graph neural networks for scalable radio resource management: Architecture design and theoretical analysis,” _IEEE J. Sel. Areas Commun._ , vol. 39, no. 1, pp. 101–115, Jan. 2021.
  * [10] R. Liu, M. Lee, G. Yu, and G. Y. Li, “User association for millimeter-wave networks: A machine learning approach,” _IEEE Trans. Commun._ , vol. 67, no. 7, pp. 4162–4174, Jul. 2020.
  * [11] M. Lee, S. Hosseinalipour, C. Brinton, G. Yu, and H. Dai, “A fast graph neural network-based method for winner determination in multi-unit combinatorial auctions,” _IEEE Trans. Cloud Comput._ , vol. 10, no. 4, pp. 2264–2280, Oct.-Dec. 2022.
  * [12] X. Xu, Q. Chen, X. Mu, Y. Liu, and H. Jiang, “Graph-embedded multi-agent learning for smart reconfigurable THz MIMO-NOMA networks,” _IEEE J. Sel. Areas Commun._ , vol. 40, no. 1, pp. 259–275, Jan. 2022.
  * [13] M. Lee, G. Yu, and H. Dai, “Decentralized inference with graph neural networks in wireless communication systems,” _IEEE Trans. Mobile Comput._ , vol. 22, no. 5, pp. 2582–2598, May 2023.
  * [14] M. Wang, Y. Cui, X. Wang, S. Xiao, and J. Jiang, “Machine learning for networking: WorkFlow, advances and opportunities,” _IEEE Netw._ , vol. 32, no. 2, pp. 92–99, Mar./Apr. 2018.
  * [15] E. Zeydan, E. Bastug, M. Bennis, M. A. Kader, I. A. Karatepe, A. S. Er, and M. Debbah, “Big data caching for networking: Moving from cloud to edge,” _IEEE Commun. Mag._ , vol. 54, no. 9, pp. 36–42, Sep. 2016.
  * [16] T. O’Shea and J. Hoydis, “An introduction to deep learning for the physical layer,” _IEEE Trans. Cogn. Commun. Netw._ , vol. 3, no. 4, pp. 563–575, Dec. 2017.
  * [17] Z. Qin, H. Ye, G. Y. Li, and B.-H. F. Juang, “Deep learning in physical layer communications,” _IEEE Wireless Commun._ , vol. 26, no. 2, pp. 93–99, Apr. 2019.
  * [18] T. Jiang, H. V. Cheng, and W. Yu, “Learning to reflect and to beamform for intelligent reflecting surface with implicit channel esti- mation,” _IEEE J. Sel. Areas Commun._ , vol. 39, no. 7, pp. 1931–1945, May 2021.
  * [19] K. Tekbiyik, G. K. Kurt, C. Huang, A. R. Ekti, and H. Yanikomeroglu, “Channel estimation for full-duplex RIS-assisted HAPS backhauling with graph attention networks,” in _Proc. IEEE ICC_ , Jun. 2021, pp. 1–6.
  * [20] A. Scotti, N. N. Moghadam, D. Liu, K. Gafvert, and J. Huang, “Graph neural networks for massive MIMO detection,” _arXiv preprint arXiv:2007.05703_ , Jul. 2020.
  * [21] Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and P. S. Yu, “A comprehensive survey on graph neural networks,” _IEEE Trans. Neural Netw. Learn. Syst._ , vol. 32, no. 1, pp. 4–24, Jan. 2021.
  * [22] J. Zhou, G. Cui, S. Hu, Z. Zhang, C. Yang, Z. Liu, L. Wang, C. Li, and M. Sun, “Graph neural networks: A review of methods and applications,” _arXiv preprint arXiv:1812.08434_ , Jul. 2019.
  * [23] E. Tolstaya, F. Gama, J. Paulos, G. Pappas, V. Kumar, and A. Ribeiro, “Learning decentralized controllers for robot swarms with graph neural networks,” in _Proc. Conf. Robot Learn._ , 2020, pp. 671–682.
  * [24] Q. Li, F. Gama, A. Ribeiro, and A. Prorok, “Graph neural networks for decentralized multi-robot path planning,” in _Proc. IEEE/RSJ Int. Conf. Intell. Robots Syst._ , Oct. 2020, pp. 1–8.
  * [25] F. Gama, E. Tolstaya, and A. Ribeiro, “Graph neural networks for decentralized controllers,” in _ICASSP 2021-2021 IEEE Int. Conf. on coust., Speech and Signal Process._ , Jun. 2021, pp. 5260–5264.
  * [26] Z. Gao, Y. Shao, D. Gündüz, and A. Prorok, “Decentralized channel management in WLANs with graph neural networks,” _arXiv preprint arXiv:2210.16949_ , Oct. 2022.
  * [27] C. Wu, F. Wu, Y. Cao, Y. Huang, and X. Xie, “FedGNN: Federated graph neural network for privacy-preserving recommendation,” _arXiv preprint arXiv:2102.04925_ , Mar. 2021.
  * [28] C. Shan, H. Jiao, and J. Fu, “Towards representation identical privacy-preserving graph neural network via split learning,” _arXiv preprint arXiv:2107.05917_ , Jul. 2021.
  * [29] T. T. Mueller, J. C. Paetzold, C. Prabhakar, D. Usynin, D. Rueckert, and G. Kaissis, “Differentially private graph classification with GNNs,” _arXiv preprint arXiv:2202.02575_ , Feb. 2022.
  * [30] T. Igamberdiev and I. Habernal, “Privacy-preserving graph convolutional networks for text classification,” _arXiv preprint arXiv:2102.09604_ , Jul. 2021.
  * [31] A. Daigavane, G. Madan, A. Sinha, A. G. Thakurta, G. Aggarwal, and P. Jain, “Node-level differentially private graph neural networks,” _arXiv preprint arXiv:2111.15521_ , Dec. 2021.
  * [32] S. Sajadmanesh and D. Gatica-Perez, “Locally private graph neural networks,” in _Proc. 2021 ACM SIGSAC_ , Nov. 2021, pp. 2130–2145.
  * [33] M. Seif, R. Tandon, and M. Li, “Wireless federated learning with local differential privacy,” in _2020 IEEE Int. Symp. Inf. Theory_ , Jun. 2020, pp. 2604–2609.
  * [34] A. Sonee, S. Rini, and Y.-C. Huang, “Wireless federated learning with limited communication and differential privacy,” _arXiv preprint arXiv:2106.00564_ , Jun. 2021.
  * [35] S. Chen, D. Yu, Y. Zou, J. Yu, and X. Cheng, “Decentralized wireless federated learning with differential privacy,” _IEEE Trans. Industr. Inform._ , vol. 18, no. 9, pp. 6273–6282, Sep. 2022.
  * [36] D. Liu and O. Simeone, “Privacy for free: Wireless federated learning via uncoded transmission with adaptive power control,” _IEEE J. Sel. Areas Commun._ , vol. 39, no. 1, pp. 170–185, 2021.
  * [37] Y. Koda, K. Yamamoto, T. Nishio, and M. Morikura, “Differentially private aircomp federated learning with power adaptation harnessing receiver noise,” _arXiv preprint arXiv:2004.06337_ , 2020.
  * [38] K.Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V. Poor, “Federated learning with differential privacy: Algorithms and performance analysis,” _IEEE Trans. Inf. Forensics Secur._ , 2020.
  * [39] A. Sonee and S. Rini, “Efficient federated learning over multiple access channel with differential privacy constraints,” empharXiv preprint arXiv:2005.07776, 2020.
  * [40] Ú. Erlingsson, V. Pihur, and A. Korolova, “RAPPOR: Randomized aggregatable privacy-preserving ordinal response,” in _Proc. ACM SIGSAC Conf. Comput. Commun. Secur._ , Scottsdale, AZ, USA, Nov. 2014, pp. 1054–1067.
  * [41] B. Ding, J. Kulkarni, and S. Yekhanin, “Collecting telemetry data privately,” in _Proc. Adv. Neural Inf. Process. Syst._ , 2017, pp. 3571–3580.
  * [42] C. Dwork and A. Roth, “The Algorithmic Foundations of Differential Privacy,” _Foundations and Trends ® in Theoretical Computer Science_, vol. 9, no. 3-4, pp. 211–407, Aug. 2014.
  * [43] Y. Zhao, J. Zhao, M. Yang, T. Wang, N. Wang, L. Lyu, D. Niyato, and K.-Y. Lam, “Local differential privacy-based federated learning for Internet of Things,” _IEEE Internet Things J._ , vol. 8, no. 11, pp. 8836–8853, Jun. 2021.
  * [44] G. Zhu, Y. Wang, and K. Huang, “Low-latency broadband analog aggregation for federated edge learning,” _IEEE Trans. Wireless Commun._ , vol. 19, no. 1, pp. 491–506, Jan. 2020.
  * [45] K. Yang, T. Jiang, Y. Shi, and Z. Ding, “Federated learning via over-the-air computation,” _IEEE Trans. Wireless Commun._ , vol. 19, no. 3, pp. 2022–2035, Mar. 2020.
  * [46] M. Goldenbaum and S. Stanczak, “Robust analog function computation via wireless multiple-access channels,” _IEEE Trans. Commun._ , vol. 61, no. 9, pp. 3863–3877, Aug. 2013.
  * [47] O. Abari, H. Rahul, D. Katabi, and M. Pant, “Airshare: Distributed coherent transmission made seamless,” in _2015 IEEE INFOCOM_ , Apr. 2015, pp. 1742–1750.
  * [48] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” in _Proc. 3rd Int. Conf. Learn. Represent. (ICLR)_ , May 2014, pp. 1–6.
  * [49] Q. Shi, M. Razaviyayn, Z.-Q. Luo, and C. He, “An iteratively weighted MMSE approach to distributed sum-utility maximization for a MIMO interfering broadcast channel,” _IEEE Trans. Signal Process._ , vol. 59, no.9, pp. 4331–4340, Sept. 2011.