*3.1. Demand Shaping*

User demand shaping uses external energy storage devices (such as a large rechargeable battery (RB) [7,35–42], renewable energy system (RES) [43–46]), or load shifting [47–49] to distort the real power consumption curves. The RB and RES method can be treated as a noise-adding approach at the physical layer, as the original power demand is distorted, the utility cannot infer sensitive information from the smart meter data. An RB system contains a smart meter, a battery, and an energy managemen<sup>t</sup> unit (EMU), the EMU controls battery to implement optimal energy managemen<sup>t</sup> policy (EMP), with the injection of power from the RB *Bt*, the mismatching between the power supplied by the grid *Yt* and consumers' power demand *Xt* provide privacy guarantee to consumers. The works conclude that the larger the battery capacity size, the better privacy can be guaranteed. However, the RB is a finite capacity energy storage device with capacity ranges from 2 kWh to 20 kWh [50], therefore there exists a lower and upper bound (*P* ˆ *c* and *P* ˆ *d*) to limit the performance of the mechanism. The optimal EMP, such as best-effort (BE) algorithm [7], water -filling algorithm [51], Q -Learning algorithm [1], non-intrusive load-leveling (NILL) algorithm [52] are introduced to optimize the charging/discharging process, these algorithms control the battery either hide, smooth, or obfuscate the load signature [7]. NILL algorithms are designed to blind the NILM [52], instead of only one target load, the NILL has two states, a steady-state and recovery state if the battery capacity cannot enable the load to maintain steady-state, the load is switched to the recovery state. A privacy-versus-cost trade-off strategy considering the TOU tariff is proposed by Giaconi et.al in 2017 [53]. Instead of a constant load target, a piecewise load target referring to the current TOU price is generated, the cost of the electricity is minimized, and the consumers can also sell extra energy to the grid to reduce the cost further.

RES utilizes rooftop PV, small wind turbine, and even Electric Vehicle (EV) [54] to replace the conventional battery. To overcome the difficulty to roll -out expensive RES and RB facilities, Reference [55] proposed a multiuser shared RSE strategy that enables serval users to share one RES and one EMU. The EMU control the RES to allocate the energy from the RES to each user. In this case, the target of the system is to minimize the overall privacy loss of all users rather than an individual user. EV is another scheme to reduce the reliance of the RB [54] since the charging period is almost overlapping with the peak load, it can mask other appliance signatures. However, the EV can only be used when the consumers are at home, the consumers are still under real-time surveillance since the adversary would obtain information when the residents leave their home.

To summarize, in RB/RES methods, researchers view the identification information of the load curve as the variation of the load measurements of two neighboring measure points *Yt* − *Yt*−1. The ideal situation for the grid curve is a constant value *Ct* which will not reveal any sensitive features of the demand, the modified load curve *Yt* is then compared to *Ct*, the more similarities between these two curves, better privacy can be guaranteed. To quantify the privacy loss, Mean Squared-Error (MSE) [53], Mutual Information (MI), Fisher Information (FI) [35], KL divergence [7], Empirical MI [37] are adopted in related works. However, user demand shaping also has drawbacks: Firstly, extra energy storage systems and renewable energy sources are required to implement the demand shaping strategy; these devices are prohibitively expensive and can be di fficult to roll-out, the batteries need to be renewed frequently. Secondly, the energy storage system blinds demand response, which is one of the most important functions of the smart grid.

As the drawbacks of RB/RES methods are obvious, another demand shaping method named load shifting is proposed to replace the RB/RES techniques. This method hides sensitive information by shifting the controllable loads [47–49]. The loads can be divided into uncontrollable loads (e.g., lighting, microvan, kettle) and controllable loads (e.g., heating, ventilation, and air conditioning (HVAC) systems, EV, dishwasher, washing machine). The operation time and model of the controllable loads can be scheduled by consumers to prevent occupancy detection. In [49], combined heat and privacy (CHPr) are proposed, thermal energy storage such as electric water heater is adopted to mask occupancy. Compared with the RB approach, CHPr neither requires expensive devices nor increase electricity cost. There are several limitations of the load shifting technique, firstly, some of the controllable loads have limited operation modes and cannot be interrupted; secondly, there are restrictions for the thermal loads to store energy.
