Stat.Privacy.Staircase
Measurable fourteen-ray staircase refinements for four-input locally private Markov kernels.
Basic 10 core · 10 supporting This module fixes the fourteen nonconstant staircase patterns for four inputs and states the finite cone and measurable-selection facts needed to refine a private output density. ★ measurable_ray_selector
Four-input local privacy cone
This module fixes the fourteen nonconstant staircase patterns for four inputs and states the finite cone and measurable-selection facts needed to refine a private output density.
A staircase ray is indexed by a nonempty proper subset of the four inputs.
The staircase pattern equals r on its indexing subset and one elsewhere.
A vector of four real coordinates belongs to the nonnegative four-input local-privacy cone at ratio r when every coordinate is nonnegative and every coordinate is at most r times every other coordinate.
Definition (Lean source)
The first fixed ray used to replace the two constant cube patterns: the ray indexed by the subset containing only the first of the four inputs.
Definition (Lean source)
The complementary fixed ray used to replace the two constant cube patterns: the ray indexed by the subset of the last three of the four inputs.
Definition (Lean source)
The coefficient of a nonconstant ray in the product-weight cube expansion. The two constant patterns contribute a common additional coefficient (cubeWeight t ∅ + r * cubeWeight t univ) / (r + 1) to the fixed complementary pair.
Definition (Lean source)
The least of the four coordinates supplies the scale for a vector in the four-input local-privacy cone.
Normalize a privacy-cone vector to a cube coordinate: the coordinate divided by the least coordinate, minus one, all divided by r - 1; the value is zero whenever the least coordinate is zero, which for a vector in the cone happens only at the zero vector. The formula is evaluated for arbitrary real vectors as well.
The explicit coefficient of a privacy-cone vector is its least coordinate times the corresponding fourteen-ray coefficient of its normalized cube point.
Definition (Lean source)
With a privacy ratio greater than one for the supplied ratio, the measurable ray selector exists: a single rule assigning fourteen ray coefficients to every real four-vector, each coefficient a measurable function of the vector, such that for every vector in the four-input privacy cone the coefficients are nonnegative and the vector equals the corresponding combination of the fourteen nonconstant staircase rays.
Formal statement
Proof (Lean source)
10 supporting declarations (lemmas, instances)
-
instMeasurableSpaceRayIndexinstanceinstancegiven by⊤ -
cubeRayCoeff_nonnegtheorem — Every coefficient in the explicit fourteen-ray cube expansion is nonnegative when the cube coordinates lie in the unit interval and the privacy ratio exceeds one.hypothesesconclusion0 ≤ cubeRayCoeff r t SProof (Lean source)
theorem cubeRayCoeff_nonneg (r : ℝ) (hr : 1 < r) (t : Fin 4 → ℝ) (ht : ∀ i, 0 ≤ t i ∧ t i ≤ 1) (S : RayIndex) : 0 ≤ cubeRayCoeff r t S := by have hr0 : 0 ≤ r := by linarith have hden : 0 ≤ (cubeWeight t ∅ + r * cubeWeight t univ) / (r + 1) := by apply div_nonneg · exact add_nonneg (cubeWeight_nonneg t ht ∅) (mul_nonneg hr0 (cubeWeight_nonneg t ht univ)) · linarith unfold cubeRayCoeff split_ifs <;> apply add_nonneg (cubeWeight_nonneg t ht S.val) <;> first | exact hden | positivity -
cubeRayCoeff_coordinatetheorem — The explicit fourteen-ray coefficients reconstruct each coordinate of the privacy-scaled cube, including zero weights and tied coordinates.hypothesesconclusion1 + (r - 1) * t i = ∑ S, cubeRayCoeff r t S * ray r S iProof (Lean source)
theorem cubeRayCoeff_coordinate (r : ℝ) (hr : 1 < r) (t : Fin 4 → ℝ) (i : Fin 4) : 1 + (r - 1) * t i = ∑ S, cubeRayCoeff r t S * ray r S i := by classical let s : Finset (Finset (Fin 4)) := (Finset.univ.erase ∅).erase Finset.univ have hs (S : Finset (Fin 4)) : S ∈ s ↔ S.Nonempty ∧ S ≠ Finset.univ := by simp [s, Finset.nonempty_iff_ne_empty, and_comm] have hsum (f : Finset (Fin 4) → ℝ) : (∑ S : RayIndex, f S.val) = (∑ S : Finset (Fin 4), f S) - f ∅ - f Finset.univ := by have h := Finset.sum_subtype (F := inferInstanceAs (Fintype RayIndex)) s hs f rw [← h] change (∑ S ∈ (Finset.univ.erase ∅).erase Finset.univ, f S) = (∑ S : Finset (Fin 4), f S) - f ∅ - f Finset.univ rw [Finset.sum_erase_eq_sub (by decide : (Finset.univ : Finset (Fin 4)) ∈ (Finset.univ.erase ∅))] rw [Finset.sum_erase_eq_sub (by simp : (∅ : Finset (Fin 4)) ∈ Finset.univ)] let k : ℝ := (cubeWeight t ∅ + r * cubeWeight t Finset.univ) / (r + 1) have hpair : ray r distinguishedRay i + ray r complementaryRay i = r + 1 := by fin_cases i <;> simp [ray, distinguishedRay, complementaryRay] <;> ring have hf (S : Finset (Fin 4)) : cubeWeight t S * (if i ∈ S then r else 1) = cubeWeight t S + (r - 1) * (cubeWeight t S * (if i ∈ S then 1 else 0)) := by split_ifs <;> ring have hall : (∑ S : Finset (Fin 4), cubeWeight t S * (if i ∈ S then r else 1)) = 1 + (r - 1) * t i := by simp_rw [hf] rw [Finset.sum_add_distrib, ← Finset.mul_sum, cubeWeight_sum, cubeWeight_coordinate] have hbase : (∑ S : RayIndex, cubeWeight t S.val * ray r S i) = 1 + (r - 1) * t i - cubeWeight t ∅ - r * cubeWeight t Finset.univ := by rw [show (∑ S : RayIndex, cubeWeight t S.val * ray r S i) = ∑ S : RayIndex, cubeWeight t S.val * (if i ∈ S.val then r else 1) from rfl] rw [hsum (fun S => cubeWeight t S * (if i ∈ S then r else 1)), hall] simp ring have hcorr : (∑ S : RayIndex, ((if S = distinguishedRay then k * ray r S i else 0) + (if S = complementaryRay then k * ray r S i else 0))) = cubeWeight t ∅ + r * cubeWeight t Finset.univ := by rw [Finset.sum_add_distrib, Fintype.sum_ite_eq', Fintype.sum_ite_eq'] rw [← mul_add, hpair] dsimp [k] field_simp have hterm (S : RayIndex) : cubeRayCoeff r t S * ray r S i = cubeWeight t S.val * ray r S i + ((if S = distinguishedRay then k * ray r S i else 0) + (if S = complementaryRay then k * ray r S i else 0)) := by have hdc : distinguishedRay ≠ complementaryRay := by decide by_cases hd : S = distinguishedRay · subst S simp [cubeRayCoeff, k, hdc] ring · by_cases hc : S = complementaryRay · subst S simp [cubeRayCoeff, k, hdc.symm] ring · simp [cubeRayCoeff, hd, hc] simp_rw [hterm] rw [Finset.sum_add_distrib, hbase, hcorr] ring -
cube_ray_decompositiontheorem — Every point of the four-dimensional unit cube yields a nonnegative combination of the fourteen nonconstant staircase rays equal to 1 + (r - 1) * t coordinatewise.hypothesesProof (Lean source)
theorem cube_ray_decomposition (r : ℝ) (hr : 1 < r) (t : Fin 4 → ℝ) (ht : ∀ i, 0 ≤ t i ∧ t i ≤ 1) : ∃ c : RayIndex → ℝ, (∀ S, 0 ≤ c S) ∧ ∀ i, 1 + (r - 1) * t i = ∑ S, c S * ray r S i := by exact ⟨cubeRayCoeff r t, cubeRayCoeff_nonneg r hr t ht, cubeRayCoeff_coordinate r hr t⟩ -
coneBase_geometrytheorem — For a private nonnegative vector, its least coordinate is nonnegative, bounds every coordinate between itself and r times itself, and can vanish only when the whole vector vanishes.hypothesesProof (Lean source)
theorem coneBase_geometry (r : ℝ) (f : Fin 4 → ℝ) (hf : PrivateCone r f) : 0 ≤ coneBase f ∧ (∀ i, coneBase f ≤ f i ∧ f i ≤ r * coneBase f) ∧ (coneBase f = 0 → ∀ i, f i = 0) := by have hnonneg : ∀ i, 0 ≤ f i := hf.1 have hmin : ∃ j : Fin 4, coneBase f = f j := by unfold coneBase simp only [min_def] split_ifs <;> first | exact ⟨0, rfl⟩ | exact ⟨1, rfl⟩ | exact ⟨2, rfl⟩ | exact ⟨3, rfl⟩ have hle : ∀ i, coneBase f ≤ f i := by intro i fin_cases i <;> simp [coneBase, min_le_left, min_le_right] obtain ⟨j, hj⟩ := hmin have hupper (i : Fin 4) : f i ≤ r * coneBase f := by rw [hj] exact hf.2 i j refine ⟨?_, fun i => ⟨hle i, hupper i⟩, ?_⟩ · rw [hj] exact hnonneg j · intro hzero i have hi := hupper i rw [hzero, mul_zero] at hi exact le_antisymm hi (hnonneg i) -
coneCubeCoord_boundstheorem — Normalizing a private vector by its least coordinate puts each coordinate in the unit interval, including the zero vector.hypothesesProof (Lean source)
theorem coneCubeCoord_bounds (r : ℝ) (hr : 1 < r) (f : Fin 4 → ℝ) (hf : PrivateCone r f) : ∀ i, 0 ≤ coneCubeCoord r f i ∧ coneCubeCoord r f i ≤ 1 := by obtain ⟨hb0, hbounds, _⟩ := coneBase_geometry r f hf intro i by_cases hbase : coneBase f = 0 · simp [coneCubeCoord, hbase] have hbpos : 0 < coneBase f := lt_of_le_of_ne hb0 (Ne.symm hbase) have hlo : 1 ≤ f i / coneBase f := (le_div_iff₀ hbpos).2 (by simpa using (hbounds i).1) have hhi : f i / coneBase f ≤ r := (div_le_iff₀ hbpos).2 (hbounds i).2 unfold coneCubeCoord rw [if_neg hbase] constructor · exact div_nonneg (by linarith) (by linarith) · exact (div_le_iff₀ (by linarith : 0 < r - 1)).2 (by linarith) -
coneCubeCoord_scaletheorem — Scaling the normalized cube coordinate by the least private-cone coordinate recovers the original coordinate, including when the entire vector is zero.hypothesesconclusionf i = coneBase f * (1 + (r - 1) * coneCubeCoord r f i)Proof (Lean source)
theorem coneCubeCoord_scale (r : ℝ) (hr : 1 < r) (f : Fin 4 → ℝ) (hf : PrivateCone r f) (i : Fin 4) : f i = coneBase f * (1 + (r - 1) * coneCubeCoord r f i) := by by_cases hbase : coneBase f = 0 · have hzero := (coneBase_geometry r f hf).2.2 hbase i simp [coneCubeCoord, hbase, hzero] · have hrne : r - 1 ≠ 0 := by linarith simp only [coneCubeCoord, if_neg hbase] field_simp ring -
measurable_coneRayCoefftheorem — Each explicit ray coefficient is a measurable function of the four input densities, including where the least coordinate is zero.Proof (Lean source)
theorem measurable_coneRayCoeff (r : ℝ) (S : RayIndex) : Measurable fun f : Fin 4 → ℝ => coneRayCoeff r f S := by have hcoord (i : Fin 4) : Measurable (fun f : Fin 4 → ℝ => f i) := measurable_pi_apply i have hbase : Measurable (fun f : Fin 4 → ℝ => coneBase f) := by unfold coneBase exact (hcoord 0).min ((hcoord 1).min ((hcoord 2).min (hcoord 3))) have hcube (i : Fin 4) : Measurable (fun f : Fin 4 → ℝ => coneCubeCoord r f i) := by unfold coneCubeCoord apply Measurable.ite (measurableSet_eq_fun hbase measurable_const) · exact measurable_const · exact (((hcoord i).div hbase).sub measurable_const).div measurable_const have hweight (T : Finset (Fin 4)) : Measurable (fun f : Fin 4 → ℝ => cubeWeight (coneCubeCoord r f) T) := by unfold cubeWeight apply Finset.measurable_prod intro i hi by_cases hit : i ∈ T <;> simp [hit] <;> fun_prop have hcoeff : Measurable (fun f : Fin 4 → ℝ => cubeRayCoeff r (coneCubeCoord r f) S) := by unfold cubeRayCoeff split_ifs · exact (hweight S.val).add (((hweight ∅).add (measurable_const.mul (hweight univ))).div measurable_const) · exact (hweight S.val).add (((hweight ∅).add (measurable_const.mul (hweight univ))).div measurable_const) · exact (hweight S.val).add measurable_const unfold coneRayCoeff exact hbase.mul hcoeff -
coneRayCoeff_decompositiontheorem — The explicit measurable coefficients reconstruct every vector in the four-input privacy cone as a nonnegative fourteen-ray combination.hypothesesconclusionProof (Lean source)
theorem coneRayCoeff_decomposition (r : ℝ) (hr : 1 < r) (f : Fin 4 → ℝ) (hf : PrivateCone r f) : (∀ S, 0 ≤ coneRayCoeff r f S) ∧ ∀ i, f i = ∑ S, coneRayCoeff r f S * ray r S i := by constructor · intro S unfold coneRayCoeff exact mul_nonneg (coneBase_geometry r f hf).1 (cubeRayCoeff_nonneg r hr (coneCubeCoord r f) (coneCubeCoord_bounds r hr f hf) S) · intro i calc f i = coneBase f * (1 + (r - 1) * coneCubeCoord r f i) := coneCubeCoord_scale r hr f hf i _ = coneBase f * ∑ S, cubeRayCoeff r (coneCubeCoord r f) S * ray r S i := by rw [cubeRayCoeff_coordinate r hr (coneCubeCoord r f) i] _ = ∑ S, coneRayCoeff r f S * ray r S i := by rw [Finset.mul_sum] apply Finset.sum_congr rfl intro S _ unfold coneRayCoeff ring
Density 4 core · 4 supporting The sum of the four output laws dominates every row. ★ measurable_density_decomposition
Dominating measure and private row densities
The sum of the four output laws dominates every row. Radon–Nikodym reconstruction and setwise privacy transfer the privacy inequalities to their measurable real densities.
Setwise local privacy bounds every row measure by r times every other row measure.
Definition (Lean source)
The sum of the four row measures is a finite common dominating measure.
The real Radon–Nikodym density of one row relative to the row sum.
For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and setwise local privacy, a measurable nonnegative coefficient field that decomposes all four row densities exists under their common dominating measure.
Formal statement
Proof (Lean source)
4 supporting declarations (lemmas, instances)
-
rowSum_finitetheorem — The common dominating measure has finite total mass for a Markov kernel.Proof (Lean source)
theorem rowSum_finite (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] : IsFiniteMeasure (rowSum Q) := by unfold rowSum infer_instance -
row_absolutelyContinuoustheorem — Each row is absolutely continuous with respect to the sum of all rows.Proof (Lean source)
theorem row_absolutelyContinuous (Q : Kernel (Fin 4) Z) (i : Fin 4) : Q i ≪ rowSum Q := by unfold rowSum rw [← Measure.sum_fintype] exact Measure.absolutelyContinuous_sum_right i (Measure.absolutelyContinuous_refl _) -
row_eq_withDensitytheorem — The Radon–Nikodym density reconstructs each Markov row exactly.hypothesesconclusionQ i = (rowSum Q).withDensity (fun z => ofReal (rowDensity Q i z))Proof (Lean source)
theorem row_eq_withDensity (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (i : Fin 4) : Q i = (rowSum Q).withDensity (fun z => ofReal (rowDensity Q i z)) := by haveI : IsFiniteMeasure (rowSum Q) := rowSum_finite Q haveI : IsFiniteMeasure (Q i) := inferInstance have h : ∀ᵐ z ∂rowSum Q, (Q i).rnDeriv (rowSum Q) z ≠ ⊤ := (Q i).rnDeriv_ne_top (rowSum Q) have heq : (fun z => ofReal (rowDensity Q i z)) =ᵐ[rowSum Q] (Q i).rnDeriv (rowSum Q) := by filter_upwards [h] with z hz simp only [rowDensity, ENNReal.ofReal_toReal hz] rw [← Measure.withDensity_rnDeriv_eq (Q i) (rowSum Q) (row_absolutelyContinuous Q i)] exact withDensity_congr_ae heq.symm -
ae_privateConetheorem — The four real row densities satisfy the finite privacy cone almost everywhere.hypothesesZ :sharedType u_1Q :r :ℝhr :1 < rhpriv :SetwisePrivate Q rconclusion∀ᵐ z ∂rowSum Q, PrivateCone r (fun i => rowDensity Q i z)Proof (Lean source)
theorem ae_privateCone (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (hpriv : SetwisePrivate Q r) : ∀ᵐ z ∂rowSum Q, PrivateCone r (fun i => rowDensity Q i z) := by haveI : IsFiniteMeasure (rowSum Q) := rowSum_finite Q have hpair (i j : Fin 4) : ∀ᵐ z ∂rowSum Q, rowDensity Q i z ≤ r * rowDensity Q j z := by have hle : (Q i).rnDeriv (rowSum Q) ≤ᵐ[rowSum Q] fun z => ofReal r * (Q j).rnDeriv (rowSum Q) z := by apply ae_le_of_forall_setLIntegral_le_of_sigmaFinite ((Q i).measurable_rnDeriv (rowSum Q)) intro s hs _ rw [lintegral_const_mul _ ((Q j).measurable_rnDeriv (rowSum Q))] have hi := Measure.withDensity_rnDeriv_eq (Q i) (rowSum Q) (row_absolutelyContinuous Q i) have hj := Measure.withDensity_rnDeriv_eq (Q j) (rowSum Q) (row_absolutelyContinuous Q j) rw [← withDensity_apply ((Q i).rnDeriv (rowSum Q)) hs, hi, ← withDensity_apply ((Q j).rnDeriv (rowSum Q)) hs, hj] exact hpriv i j s hs filter_upwards [hle, (Q j).rnDeriv_ne_top (rowSum Q)] with z hz hzj rw [← ENNReal.ofReal_toReal hzj, ← ENNReal.ofReal_mul (by linarith : 0 ≤ r)] at hz exact ENNReal.toReal_le_of_le_ofReal (mul_nonneg (by linarith) ENNReal.toReal_nonneg) hz have hpair_all : ∀ᵐ z ∂rowSum Q, ∀ i j : Fin 4, rowDensity Q i z ≤ r * rowDensity Q j z := by rw [ae_all_iff] intro i rw [ae_all_iff] exact hpair i filter_upwards [hpair_all] with z hz exact ⟨fun i => ENNReal.toReal_nonneg, hz⟩
CoefficientMeasures 2 core · 3 supporting This module separates the measure-theoretic step of staircase refinement from the construction of its finite release and postprocessing kernels. ★ coefficient_normalized
Integrable staircase coefficients and row measures
This module separates the measure-theoretic step of staircase refinement from the construction of its finite release and postprocessing kernels. A coefficient field represents every row density almost everywhere; its coefficients are integrable, reconstruct each row as a sum of density measures, and have normalized ray masses.
A nonnegative measurable field of fourteen ray coefficients represents all four row densities almost everywhere under their common dominating measure.
Definition (Lean source)
For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, a measurable staircase coefficient field, and an input coordinate, the integrated ray weights have unit weighted row sum.
Formal statement
Proof (Lean source)
3 supporting declarations (lemmas, instances)
-
exists_coefficientFieldtheorem — Every private Markov kernel has a measurable nonnegative coefficient field representing all four row densities simultaneously.hypothesesZ :sharedType u_1Q :r :ℝhr :1 < rhpriv :SetwisePrivate Q rconclusionNonempty (CoefficientField Q r)Proof (Lean source)
theorem exists_coefficientField (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (hpriv : SetwisePrivate Q r) : Nonempty (CoefficientField Q r) := by obtain ⟨c, hm, hn, heq⟩ := measurable_density_decomposition Q r hr hpriv exact ⟨⟨c, hm, hn, heq⟩⟩ -
coefficient_integrabletheorem — Each measurable ray coefficient is integrable against the finite row-sum measure, including coefficients that vanish identically.hypothesesconclusionIntegrable (fun z => D.c z S) (rowSum Q)Proof (Lean source)
theorem coefficient_integrable (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) (S : RayIndex) : Integrable (fun z => D.c z S) (rowSum Q) := by have hrow : Integrable (rowDensity Q 0) (rowSum Q) := by have hmeas : Measurable (fun z => ofReal (rowDensity Q 0 z)) := by exact ((Q 0).measurable_rnDeriv (rowSum Q)).ennreal_toReal.ennreal_ofReal have hfinite : Integrable (fun _ : Z => (1 : ℝ)) ((rowSum Q).withDensity (fun z => ofReal (rowDensity Q 0 z))) := by rw [← row_eq_withDensity Q 0] exact integrable_const 1 have h := (integrable_withDensity_iff hmeas (by simp)).1 hfinite convert h using 1 funext z simpa using (ENNReal.toReal_ofReal (show 0 ≤ rowDensity Q 0 z from ENNReal.toReal_nonneg)).symm refine Integrable.mono' hrow (D.measurable S).aestronglyMeasurable ?_ filter_upwards [D.reconstruct] with z hz have hbound : D.c z S ≤ rowDensity Q 0 z := by rw [hz 0] have hsum : D.c z S * ray r S 0 ≤ ∑ T : RayIndex, D.c z T * ray r T 0 := by exact Finset.single_le_sum (s := univ) (f := fun T : RayIndex => D.c z T * ray r T 0) (by intro T _ exact mul_nonneg (D.nonneg z T) (by unfold ray split_ifs <;> linarith)) (Finset.mem_univ S) have hray : 1 ≤ ray r S 0 := by unfold ray split_ifs <;> linarith have hcoeff := D.nonneg z S nlinarith have hrow_nonneg : 0 ≤ rowDensity Q 0 z := ENNReal.toReal_nonneg simpa [Real.norm_eq_abs, abs_of_nonneg (D.nonneg z S), abs_of_nonneg hrow_nonneg] using hbound -
coefficient_row_measuretheorem — Each Markov row is the finite sum of ray-scaled coefficient measures.hypothesesProof (Lean source)
theorem coefficient_row_measure (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) (i : Fin 4) : Q i = ∑ S : RayIndex, ofReal (ray r S i) • (rowSum Q).withDensity (fun z => ofReal (D.c z S)) := by let f : RayIndex → Z → ℝ≥0∞ := fun S z => ofReal (ray r S i) * ofReal (D.c z S) have hf (S : RayIndex) : Measurable (f S) := measurable_const.mul ((D.measurable S).ennreal_ofReal) have hpoint : (fun z => ofReal (rowDensity Q i z)) =ᵐ[rowSum Q] fun z => ∑ S : RayIndex, f S z := by filter_upwards [D.reconstruct] with z hz rw [hz i, ENNReal.ofReal_sum_of_nonneg] · apply Finset.sum_congr rfl intro S _ rw [ENNReal.ofReal_mul (D.nonneg z S), mul_comm] · intro S _ exact mul_nonneg (D.nonneg z S) (by unfold ray split_ifs <;> linarith) calc Q i = (rowSum Q).withDensity (fun z => ofReal (rowDensity Q i z)) := row_eq_withDensity Q i _ = (rowSum Q).withDensity (fun z => ∑ S : RayIndex, f S z) := withDensity_congr_ae hpoint _ = ∑ S : RayIndex, (rowSum Q).withDensity (f S) := by have hfun : (fun z => ∑ S : RayIndex, f S z) = (∑' S : RayIndex, f S) := by funext z rw [ENNReal.tsum_apply, tsum_fintype] rw [hfun, withDensity_tsum hf, Measure.sum_fintype] _ = ∑ S : RayIndex, ofReal (ray r S i) • (rowSum Q).withDensity (fun z => ofReal (D.c z S)) := by apply Finset.sum_congr rfl intro S _ exact withDensity_smul _ ((D.measurable S).ennreal_ofReal)
NormalizedCoefficients 2 core · 1 supporting The measurable staircase coefficients define finite measures on the output space. ★ exists_coefficientPostprocess
Normalizing coefficient measures
The measurable staircase coefficients define finite measures on the output space. Their masses are the ray weights, and each measure is a weight times a probability measure. A zero-mass coefficient uses an arbitrary Markov row as its fallback.
The contribution measure of one nonconstant staircase ray is its coefficient as a density against the common sum of the four Markov rows.
For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and a measurable staircase coefficient field, a Markov postprocessing kernel representing every ray coefficient measure exists, including zero-weight rays.
Formal statement
Proof (Lean source)
1 supporting declaration (lemmas, instances)
-
coefficientMeasure_masstheorem — The total mass of a staircase coefficient measure equals the real integral of its coefficient, embedded in the extended nonnegative reals.Proof (Lean source)
theorem coefficientMeasure_mass (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) (S : RayIndex) : coefficientMeasure Q D S univ = ofReal (∫ z, D.c z S ∂rowSum Q) := by rw [coefficientMeasure, withDensity_apply _ MeasurableSet.univ, setLIntegral_univ] exact (ofReal_integral_eq_lintegral_ofReal (coefficient_integrable Q r hr D S) (Filter.Eventually.of_forall fun z => D.nonneg z S)).symm
Factorization 2 core · 1 supporting Integrating the measurable ray coefficients gives a finite staircase channel. ★ exists_refinement
Measurable staircase refinement and exact postprocessing
Integrating the measurable ray coefficients gives a finite staircase channel. Conditional normalization of each coefficient measure gives a Markov postprocessing kernel, including zero-weight rays, whose composition is the original kernel.
A staircase refinement records normalized ray weights, the finite release, and an output postprocessing kernel whose composition is the original four-input kernel.
Definition (Lean source)
For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and setwise local privacy, a fourteen-ray staircase refinement with exact Markov postprocessing exists on any measurable output space.
Formal statement
Proof (Lean source)
1 supporting declaration (lemmas, instances)
-
coefficient_factorizestheorem — If release singleton masses are the integrated ray coefficients and each coefficient measure is its weight times a postprocessing row, the original kernel is exactly the composition of the finite release and postprocessing kernels.hypothesesZ :sharedType u_1Q :r :ℝhr :1 < rD :CoefficientField Q rα :RayIndex → ℝ≥0hα :∀ S, (α S : ℝ) = ∫ z, D.c z S ∂rowSum QhK :∀ S, coefficientMeasure Q D S = ofReal (∫ z, D.c z S ∂rowSum Q) • K SconclusionQ = K ∘ₖ TProof (Lean source)
theorem coefficient_factorizes (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) (α : RayIndex → ℝ≥0) (T : Kernel (Fin 4) RayIndex) (K : Kernel RayIndex Z) (hα : ∀ S, (α S : ℝ) = ∫ z, D.c z S ∂rowSum Q) (hT : ∀ i S, T i {S} = (α S : ℝ≥0∞) * ofReal (ray r S i)) (hK : ∀ S, coefficientMeasure Q D S = ofReal (∫ z, D.c z S ∂rowSum Q) • K S) : Q = K ∘ₖ T := by ext i A hA rw [coefficient_row_measure Q r hr D i, Kernel.comp_apply' K T i hA, lintegral_fintype] rw [Measure.coe_finsetSum, Finset.sum_apply] apply Finset.sum_congr rfl intro S _ rw [← coefficientMeasure, hK S, hT i S] simp only [Measure.smul_apply, smul_eq_mul] rw [← hα S, ENNReal.ofReal_coe_nnreal] ac_rfl
CubeWeights 2 core · 2 supporting Independent two-point weights on four coordinates express every point of the unit cube as a convex combination of its sixteen vertices. ★ cubeWeight_coordinate
Finite cube product weights
Independent two-point weights on four coordinates express every point of the unit cube as a convex combination of its sixteen vertices. These identities are the algebraic input to the measurable staircase selector.
The product weight of a subset selects t i on its members and 1 - t i on its complement.
Given four real coordinates and one selected coordinate, the weighted coordinate indicator has expectation equal to that coordinate under the product weights on the sixteen cube vertices: summing the product weight over the subsets that contain the selected coordinate returns that coordinate's value. No unit-cube restriction is needed.
Formal statement
Proof (Lean source)
2 supporting declarations (lemmas, instances)
-
cubeWeight_nonnegtheorem — Every cube vertex has nonnegative product weight when all four coordinates lie in the unit interval.hypothesesconclusion0 ≤ cubeWeight t SProof (Lean source)
theorem cubeWeight_nonneg (t : Fin 4 → ℝ) (ht : ∀ i, 0 ≤ t i ∧ t i ≤ 1) (S : Finset (Fin 4)) : 0 ≤ cubeWeight t S := by unfold cubeWeight apply Finset.prod_nonneg intro i _ split · exact (ht i).1 · linarith [(ht i).2] -
cubeWeight_sumtheorem — The product weights of all sixteen cube vertices sum to one.Proof (Lean source)
theorem cubeWeight_sum (t : Fin 4 → ℝ) : (∑ S : Finset (Fin 4), cubeWeight t S) = 1 := by have hweight (S : Finset (Fin 4)) : cubeWeight t S = (∏ j ∈ S, t j) * ∏ j ∈ Sᶜ, (1 - t j) := by have h : (Finset.univ.filter (fun j : Fin 4 => j ∉ S)) = Sᶜ := by ext j simp simp [cubeWeight, Finset.prod_ite, h] calc (∑ S : Finset (Fin 4), cubeWeight t S) = ∏ j : Fin 4, (t j + (1 - t j)) := by rw [Fintype.prod_add] simp only [hweight] _ = 1 := by simp
Information 9 core · 4 supporting This module states the finite-dimensional conditional-variance inequality for staircase postprocessing and its equality case: rays with distinct projected scores induce mutually singular output laws. ★ fisher_gap_nonneg★ equality_rigidity
Fisher information monotonicity and equality rigidity
This module states the finite-dimensional conditional-variance inequality for staircase postprocessing and its equality case: rays with distinct projected scores induce mutually singular output laws.
Project a finite-dimensional input score onto one real direction.
The mixture mass of a finite release atom under input probabilities p.
The projected score of an active finite release atom under input probabilities p.
Directional Fisher information of the finite staircase release, with zero-mass atoms contributing zero by the division convention.
Directional Fisher information of the general output kernel, expressed using the common dominating row-sum measure and its four measurable densities.
The projected score after observing the general output, defined to be zero where the output mixture density vanishes.
The conditional-variance expression for information lost through the postprocessing kernel.
Definition (Lean source)
Given a four-input Markov kernel, a privacy ratio, a staircase refinement, strictly positive input weights, which need not sum to one, a finite-dimensional input score, and a score direction, the directional Fisher-information gap is nonnegative.
Formal statement
Proof (Lean source)
Given a four-input Markov kernel, a privacy ratio, a staircase refinement, strictly positive input weights, which need not sum to one, a finite-dimensional input score, a score direction, a zero directional Fisher gap, two rays with positive release mass, and different projected scores, the two postprocessing laws are mutually singular.
Formal statement
Proof (Lean source)
4 supporting declarations (lemmas, instances)
-
finite_score_second_momenttheorem — The second moment of the finite release score, integrated through each postprocessing row, is the directional Fisher information of the release.hypothesesconclusion(∑ S, releaseMass R.T p S * ∫ z : Z, (releaseScore R.T p u S) ^ 2 ∂(R.K S))= finiteFisher R.T p uProof (Lean source)
theorem finite_score_second_moment (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (R : Refinement Q r) (p u : Fin 4 → ℝ) (hp : ∀ i, 0 < p i) : (∑ S, releaseMass R.T p S * ∫ z : Z, (releaseScore R.T p u S) ^ 2 ∂(R.K S)) = finiteFisher R.T p u := by letI : IsMarkovKernel R.T := R.markovT letI : IsMarkovKernel R.K := R.markovK have hmass_nonneg (S : RayIndex) : 0 ≤ releaseMass R.T p S := by unfold releaseMass apply Finset.sum_nonneg intro i hi exact mul_nonneg (le_of_lt (hp i)) ENNReal.toReal_nonneg have hnum_zero (S : RayIndex) (hS : releaseMass R.T p S = 0) : (∑ i, p i * (R.T i {S}).toReal * u i) = 0 := by have hterm (i : Fin 4) : p i * (R.T i {S}).toReal = 0 := by have hle : p i * (R.T i {S}).toReal ≤ releaseMass R.T p S := by unfold releaseMass exact Finset.single_le_sum (s := univ) (f := fun j : Fin 4 => p j * (R.T j {S}).toReal) (fun j hj => mul_nonneg (le_of_lt (hp j)) ENNReal.toReal_nonneg) (Finset.mem_univ i) have hnonneg : 0 ≤ p i * (R.T i {S}).toReal := mul_nonneg (le_of_lt (hp i)) ENNReal.toReal_nonneg exact le_antisymm (hS ▸ hle) hnonneg simp [hterm] unfold finiteFisher apply Finset.sum_congr rfl intro S hS have hIntegral : (∫ z : Z, (releaseScore R.T p u S) ^ 2 ∂(R.K S)) = (releaseScore R.T p u S) ^ 2 := by simp rw [hIntegral] by_cases hm : releaseMass R.T p S = 0 · rw [hm, hnum_zero S hm] simp [releaseScore, hm] · have hmpos : 0 < releaseMass R.T p S := lt_of_le_of_ne (hmass_nonneg S) (Ne.symm hm) unfold releaseScore field_simp [ne_of_gt hmpos] -
score_cross_momenttheorem — The mixed moment of the finite release score and output score is the directional Fisher information of the postprocessed output.hypothesesconclusion= outputFisher Q p uProof (Lean source)
theorem score_cross_moment (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (R : Refinement Q r) (p u : Fin 4 → ℝ) (hp : ∀ i, 0 < p i) : (∑ S, releaseMass R.T p S * releaseScore R.T p u S * ∫ z, outputScore Q p u z ∂(R.K S)) = outputFisher Q p u := by have hK (S : RayIndex) : Integrable (outputScore Q p u) (R.K S) := by letI : IsMarkovKernel R.K := R.markovK exact outputScore_integrable Q p u (fun i => le_of_lt (hp i)) _ have hQ (i : Fin 4) : Integrable (outputScore Q p u) (Q i) := outputScore_integrable Q p u (fun i => le_of_lt (hp i)) _ calc (∑ S, releaseMass R.T p S * releaseScore R.T p u S * ∫ z, outputScore Q p u z ∂(R.K S)) = ∑ S, (∑ i, (p i * u i) * (R.T i {S}).toReal) * ∫ z, outputScore Q p u z ∂(R.K S) := by apply Finset.sum_congr rfl intro S hS rw [releaseMass_mul_releaseScore R.T p u hp S] congr 1 apply Finset.sum_congr rfl intro i hi ring _ = ∫ z, (∑ i, (p i * u i) * rowDensity Q i z) * outputScore Q p u z ∂rowSum Q := weighted_release_integral Q r R (fun i => p i * u i) (outputScore Q p u) hQ _ = outputFisher Q p u := by unfold outputFisher apply integral_congr_ae filter_upwards [] with z have hs : (∑ i, (p i * u i) * rowDensity Q i z) = ∑ i, p i * rowDensity Q i z * u i := by apply Finset.sum_congr rfl intro i hi ring rw [hs] unfold outputScore ring -
output_score_second_momenttheorem — The second moment of the output score under the postprocessed release equals the directional Fisher information of the output.hypothesesconclusionProof (Lean source)
theorem output_score_second_moment (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (R : Refinement Q r) (p u : Fin 4 → ℝ) (hp : ∀ i, 0 < p i) : (∑ S, releaseMass R.T p S * ∫ z, (outputScore Q p u z) ^ 2 ∂(R.K S)) = outputFisher Q p u := by have hK (S : RayIndex) : Integrable (fun z => (outputScore Q p u z) ^ 2) (R.K S) := by letI : IsMarkovKernel R.K := R.markovK exact outputScore_sq_integrable Q p u (fun i => le_of_lt (hp i)) _ have hQ (i : Fin 4) : Integrable (fun z => (outputScore Q p u z) ^ 2) (Q i) := outputScore_sq_integrable Q p u (fun i => le_of_lt (hp i)) _ calc (∑ S, releaseMass R.T p S * ∫ z, (outputScore Q p u z) ^ 2 ∂(R.K S)) = ∑ S, (∑ i, p i * (R.T i {S}).toReal) * ∫ z, (outputScore Q p u z) ^ 2 ∂(R.K S) := by rfl _ = ∫ z, (∑ i, p i * rowDensity Q i z) * (outputScore Q p u z) ^ 2 ∂rowSum Q := weighted_release_integral Q r R p (fun z => (outputScore Q p u z) ^ 2) hQ _ = outputFisher Q p u := by unfold outputFisher apply integral_congr_ae filter_upwards [] with z unfold outputScore by_cases hd : (∑ i, p i * rowDensity Q i z) = 0 · simp [hd] · field_simp -
fisher_gap_eq_variancetheorem — The directional Fisher-information loss is exactly the conditional variance of the release score given the postprocessed output.hypothesesconclusionProof (Lean source)
theorem fisher_gap_eq_variance (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (R : Refinement Q r) (p u : Fin 4 → ℝ) (hp : ∀ i, 0 < p i) : finiteFisher R.T p u - outputFisher Q p u = varianceGap Q r R p u := by letI : IsMarkovKernel R.K := R.markovK have hrow (S : RayIndex) : (∫ z, (releaseScore R.T p u S - outputScore Q p u z) ^ 2 ∂(R.K S)) = (∫ z, (releaseScore R.T p u S) ^ 2 ∂(R.K S)) - 2 * releaseScore R.T p u S * (∫ z, outputScore Q p u z ∂(R.K S)) + (∫ z, (outputScore Q p u z) ^ 2 ∂(R.K S)) := by have hscore : Integrable (outputScore Q p u) (R.K S) := outputScore_integrable Q p u (fun i => le_of_lt (hp i)) _ have hsq : Integrable (fun z => (outputScore Q p u z) ^ 2) (R.K S) := outputScore_sq_integrable Q p u (fun i => le_of_lt (hp i)) _ calc (∫ z, (releaseScore R.T p u S - outputScore Q p u z) ^ 2 ∂(R.K S)) = ∫ z, (releaseScore R.T p u S) ^ 2 - (2 * releaseScore R.T p u S) * outputScore Q p u z + (outputScore Q p u z) ^ 2 ∂(R.K S) := by congr 1 funext z ring _ = (∫ z, (releaseScore R.T p u S) ^ 2 ∂(R.K S)) - 2 * releaseScore R.T p u S * (∫ z, outputScore Q p u z ∂(R.K S)) + (∫ z, (outputScore Q p u z) ^ 2 ∂(R.K S)) := by calc _ = (∫ z, (releaseScore R.T p u S) ^ 2 - (2 * releaseScore R.T p u S) * outputScore Q p u z ∂(R.K S)) + ∫ z, (outputScore Q p u z) ^ 2 ∂(R.K S) := by exact integral_add ((integrable_const _).sub (hscore.const_mul _)) hsq _ = _ := by rw [integral_sub (integrable_const _) (hscore.const_mul _)] rw [integral_const_mul] unfold varianceGap calc finiteFisher R.T p u - outputFisher Q p u = (∑ S, releaseMass R.T p S * ∫ z, (releaseScore R.T p u S) ^ 2 ∂(R.K S)) - 2 * (∑ S, releaseMass R.T p S * releaseScore R.T p u S * ∫ z, outputScore Q p u z ∂(R.K S)) + (∑ S, releaseMass R.T p S * ∫ z, (outputScore Q p u z) ^ 2 ∂(R.K S)) := by rw [finite_score_second_moment Q r R p u hp, score_cross_moment Q r R p u hp, output_score_second_moment Q r R p u hp] ring _ = ∑ S, releaseMass R.T p S * ∫ z, (releaseScore R.T p u S - outputScore Q p u z) ^ 2 ∂(R.K S) := by rw [Finset.mul_sum, ← Finset.sum_sub_distrib, ← Finset.sum_add_distrib] apply Finset.sum_congr rfl intro S hS rw [hrow S] ring
Release 1 core · 0 supporting The integrated coefficients define a probability distribution on the fourteen rays for each input. ★ exists_coefficientRelease
Finite release from normalized staircase coefficients
The integrated coefficients define a probability distribution on the fourteen rays for each input. This module isolates the finite release construction from output postprocessing.
For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and a measurable staircase coefficient field, a finite Markov release with the integrated ray weights exists.