Stat.Privacy.Staircase

Measurable fourteen-ray staircase refinements for four-input locally private Markov kernels.

Basic 10 core · 10 supporting This module fixes the fourteen nonconstant staircase patterns for four inputs and states the finite cone and measurable-selection facts needed to refine a private output density. ★ measurable_ray_selector

Four-input local privacy cone

This module fixes the fourteen nonconstant staircase patterns for four inputs and states the finite cone and measurable-selection facts needed to refine a private output density.

abbrev RayIndex reviewed
Causalean.Stat.Privacy.Staircase

A staircase ray is indexed by a nonempty proper subset of the four inputs.

Definition (Lean source)
RayIndex :
Type
{S : Finset (Fin 4) // S.Nonempty ∧ S ≠ univ}
Causalean.Stat.Privacy.Staircase.RayIndex · Causalean/Stat/Privacy/Staircase/Basic.lean:19
def ray reviewed
Causalean.Stat.Privacy.Staircase

The staircase pattern equals r on its indexing subset and one elsewhere.

Definition (Lean source)
r :
ℝ
S :
i :
Fin 4
ray r S i :
ℝ
if i ∈ S.val then r else 1
Causalean.Stat.Privacy.Staircase.ray · Causalean/Stat/Privacy/Staircase/Basic.lean:28 · uses RayIndex
def PrivateCone reviewed
Causalean.Stat.Privacy.Staircase

A vector of four real coordinates belongs to the nonnegative four-input local-privacy cone at ratio r when every coordinate is nonnegative and every coordinate is at most r times every other coordinate.

Definition (Lean source)
r :
ℝ
f :
Fin 4 → ℝ
PrivateCone r f :
Prop
clause 1
i :
0 ≤ f i
clause 2
i j :
f i ≤ r * f j
Causalean.Stat.Privacy.Staircase.PrivateCone · Causalean/Stat/Privacy/Staircase/Basic.lean:32
def distinguishedRay reviewed
Causalean.Stat.Privacy.Staircase

The first fixed ray used to replace the two constant cube patterns: the ray indexed by the subset containing only the first of the four inputs.

Definition (Lean source)
distinguishedRay :
⟨{0}, by decide, by decide⟩
Causalean.Stat.Privacy.Staircase.distinguishedRay · Causalean/Stat/Privacy/Staircase/Basic.lean:38 · uses RayIndex
def complementaryRay reviewed
Causalean.Stat.Privacy.Staircase

The complementary fixed ray used to replace the two constant cube patterns: the ray indexed by the subset of the last three of the four inputs.

Definition (Lean source)
complementaryRay :
⟨{1, 2, 3}, by decide, by decide⟩
Causalean.Stat.Privacy.Staircase.complementaryRay · Causalean/Stat/Privacy/Staircase/Basic.lean:42 · uses RayIndex
def cubeRayCoeff reviewed
Causalean.Stat.Privacy.Staircase

The coefficient of a nonconstant ray in the product-weight cube expansion. The two constant patterns contribute a common additional coefficient (cubeWeight t ∅ + r * cubeWeight t univ) / (r + 1) to the fixed complementary pair.

Definition (Lean source)
r :
ℝ
t :
Fin 4 → ℝ
S :
cubeRayCoeff r t S :
ℝ
cubeWeight t S.val + if S
= distinguishedRay then (cubeWeight t ∅ + r * cubeWeight t univ) / (r + 1) else if S = complementaryRay then (cubeWeight t ∅ + r * cubeWeight t univ) / (r + 1) else 0
Causalean.Stat.Privacy.Staircase.cubeRayCoeff · Causalean/Stat/Privacy/Staircase/Basic.lean:46 · uses RayIndex
def coneBase reviewed
Causalean.Stat.Privacy.Staircase

The least of the four coordinates supplies the scale for a vector in the four-input local-privacy cone.

Definition (Lean source)
f :
Fin 4 → ℝ
coneBase f :
ℝ
min (f 0) (min (f 1) (min (f 2) (f 3)))
Causalean.Stat.Privacy.Staircase.coneBase · Causalean/Stat/Privacy/Staircase/Basic.lean:158
def coneCubeCoord reviewed
Causalean.Stat.Privacy.Staircase

Normalize a privacy-cone vector to a cube coordinate: the coordinate divided by the least coordinate, minus one, all divided by r - 1; the value is zero whenever the least coordinate is zero, which for a vector in the cone happens only at the zero vector. The formula is evaluated for arbitrary real vectors as well.

Definition (Lean source)
r :
ℝ
f :
Fin 4 → ℝ
i :
Fin 4
coneCubeCoord r f i :
ℝ
if coneBase f = 0 then 0 else (f i / coneBase f - 1) / (r - 1)
Causalean.Stat.Privacy.Staircase.coneCubeCoord · Causalean/Stat/Privacy/Staircase/Basic.lean:163
def coneRayCoeff reviewed
Causalean.Stat.Privacy.Staircase

The explicit coefficient of a privacy-cone vector is its least coordinate times the corresponding fourteen-ray coefficient of its normalized cube point.

Definition (Lean source)
r :
ℝ
f :
Fin 4 → ℝ
S :
coneRayCoeff r f S :
ℝ
Causalean.Stat.Privacy.Staircase.coneRayCoeff · Causalean/Stat/Privacy/Staircase/Basic.lean:241 · uses RayIndex
theorem measurable_ray_selector reviewed
Causalean.Stat.Privacy.Staircase

With a privacy ratio greater than one for the supplied ratio, the measurable ray selector exists: a single rule assigning fourteen ray coefficients to every real four-vector, each coefficient a measurable function of the vector, such that for every vector in the four-input privacy cone the coefficients are nonnegative and the vector equals the corresponding combination of the fourteen nonconstant staircase rays.

Formal statement
r :
ℝ
hr :
1 < r
∃ c : (Fin 4 → ℝ) → RayIndex → ℝ,
conclusion 1
S :
Measurable fun f => c f S
conclusion 2
f :
S :
0 ≤ c f S
i :
f i = ∑ S, c f S * ray r S i
Proof (Lean source)
theorem measurable_ray_selector (r : ℝ) (hr : 1 < r) : ∃ c : (Fin 4 → ℝ) → RayIndex → ℝ, (∀ S, Measurable fun f => c f S) ∧ ∀ f, PrivateCone r f → (∀ S, 0 ≤ c f S) ∧ ∀ i, f i = ∑ S, c f S * ray r S i := by exact ⟨coneRayCoeff r, measurable_coneRayCoeff r, fun f hf => coneRayCoeff_decomposition r hr f hf⟩
Causalean.Stat.Privacy.Staircase.measurable_ray_selector · Causalean/Stat/Privacy/Staircase/Basic.lean:311 · uses PrivateCone , RayIndex , ray
10 supporting declarations (lemmas, instances)
Density 4 core · 4 supporting The sum of the four output laws dominates every row. ★ measurable_density_decomposition

Dominating measure and private row densities

The sum of the four output laws dominates every row. Radon–Nikodym reconstruction and setwise privacy transfer the privacy inequalities to their measurable real densities.

def SetwisePrivate reviewed
Causalean.Stat.Privacy.Staircase

Setwise local privacy bounds every row measure by r times every other row measure.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
r :
ℝ
i j s :
SetwisePrivate Q r :
Prop
Q i s ≤ ofReal r * Q j s
Causalean.Stat.Privacy.Staircase.SetwisePrivate · Causalean/Stat/Privacy/Staircase/Density.lean:21
def rowSum reviewed
Causalean.Stat.Privacy.Staircase

The sum of the four row measures is a finite common dominating measure.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
rowSum Q :
∑ i : Fin 4, Q i
Causalean.Stat.Privacy.Staircase.rowSum · Causalean/Stat/Privacy/Staircase/Density.lean:25
def rowDensity reviewed
Causalean.Stat.Privacy.Staircase

The real Radon–Nikodym density of one row relative to the row sum.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
i :
Fin 4
z :
Z
rowDensity Q i z :
ℝ
((Q i).rnDeriv (rowSum Q) z).toReal
Causalean.Stat.Privacy.Staircase.rowDensity · Causalean/Stat/Privacy/Staircase/Density.lean:29
theorem measurable_density_decomposition reviewed
Causalean.Stat.Privacy.Staircase

For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and setwise local privacy, a measurable nonnegative coefficient field that decomposes all four row densities exists under their common dominating measure.

Formal statement
Z :
Type u_1
shared
r :
ℝ
hr :
1 < r
hpriv :
SetwisePrivate Q r
∃ c : Z → RayIndex → ℝ,
conclusion 1
S :
Measurable fun z => c z S
conclusion 2
z S :
0 ≤ c z S
conclusion 3
∀ᵐ z ∂rowSum Q, ∀ i, rowDensity Q i z = ∑ S, c z S * ray r S i
Proof (Lean source)
theorem measurable_density_decomposition (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (hpriv : SetwisePrivate Q r) : ∃ c : Z → RayIndex → ℝ, (∀ S, Measurable fun z => c z S) ∧ (∀ z S, 0 ≤ c z S) ∧ ∀ᵐ z ∂rowSum Q, ∀ i, rowDensity Q i z = ∑ S, c z S * ray r S i := by let c : Z → RayIndex → ℝ := fun z S => max 0 (coneRayCoeff r (fun i => rowDensity Q i z) S) have hdensity : Measurable (fun z => fun i : Fin 4 => rowDensity Q i z) := by rw [measurable_pi_iff] intro i exact ((Q i).measurable_rnDeriv (rowSum Q)).ennreal_toReal refine ⟨c, ?_, ?_, ?_⟩ · intro S exact measurable_const.max ((measurable_coneRayCoeff r S).comp hdensity) · intro z S exact le_max_left _ _ · filter_upwards [ae_privateCone Q r hr hpriv] with z hz have hcoeff := (coneRayCoeff_decomposition r hr (fun i => rowDensity Q i z) hz) intro i calc rowDensity Q i z = ∑ S, coneRayCoeff r (fun j => rowDensity Q j z) S * ray r S i := hcoeff.2 i _ = ∑ S, c z S * ray r S i := by apply Finset.sum_congr rfl intro S _ simp only [c, max_eq_right (hcoeff.1 S)]
Causalean.Stat.Privacy.Staircase.measurable_density_decomposition · Causalean/Stat/Privacy/Staircase/Density.lean:95 · uses RayIndex , SetwisePrivate , ray , rowDensity , rowSum
4 supporting declarations (lemmas, instances)
  • rowSum_finite theorem — The common dominating measure has finite total mass for a Markov kernel.
    Z :
    Type u_1
    shared
    IsFiniteMeasure (rowSum Q)
    Proof (Lean source)
    theorem rowSum_finite (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] : IsFiniteMeasure (rowSum Q) := by unfold rowSum infer_instance
    Causalean.Stat.Privacy.Staircase.rowSum_finite · Causalean/Stat/Privacy/Staircase/Density.lean:33
  • row_absolutelyContinuous theorem — Each row is absolutely continuous with respect to the sum of all rows.
    Z :
    Type u_1
    shared
    Q :
    Kernel (Fin 4) Z
    i :
    Fin 4
    Q i ≪ rowSum Q
    Proof (Lean source)
    theorem row_absolutelyContinuous (Q : Kernel (Fin 4) Z) (i : Fin 4) : Q i ≪ rowSum Q := by unfold rowSum rw [← Measure.sum_fintype] exact Measure.absolutelyContinuous_sum_right i (Measure.absolutelyContinuous_refl _)
    Causalean.Stat.Privacy.Staircase.row_absolutelyContinuous · Causalean/Stat/Privacy/Staircase/Density.lean:39
  • row_eq_withDensity theorem — The Radon–Nikodym density reconstructs each Markov row exactly.
    Z :
    Type u_1
    shared
    i :
    Fin 4
    Q i = (rowSum Q).withDensity (fun z => ofReal (rowDensity Q i z))
    Proof (Lean source)
    theorem row_eq_withDensity (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (i : Fin 4) : Q i = (rowSum Q).withDensity (fun z => ofReal (rowDensity Q i z)) := by haveI : IsFiniteMeasure (rowSum Q) := rowSum_finite Q haveI : IsFiniteMeasure (Q i) := inferInstance have h : ∀ᵐ z ∂rowSum Q, (Q i).rnDeriv (rowSum Q) z ≠ ⊤ := (Q i).rnDeriv_ne_top (rowSum Q) have heq : (fun z => ofReal (rowDensity Q i z)) =ᵐ[rowSum Q] (Q i).rnDeriv (rowSum Q) := by filter_upwards [h] with z hz simp only [rowDensity, ENNReal.ofReal_toReal hz] rw [← Measure.withDensity_rnDeriv_eq (Q i) (rowSum Q) (row_absolutelyContinuous Q i)] exact withDensity_congr_ae heq.symm
    Causalean.Stat.Privacy.Staircase.row_eq_withDensity · Causalean/Stat/Privacy/Staircase/Density.lean:46
  • ae_privateCone theorem — The four real row densities satisfy the finite privacy cone almost everywhere.
    Z :
    Type u_1
    shared
    r :
    ℝ
    hr :
    1 < r
    hpriv :
    SetwisePrivate Q r
    ∀ᵐ z ∂rowSum Q, PrivateCone r (fun i => rowDensity Q i z)
    Proof (Lean source)
    theorem ae_privateCone (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (hpriv : SetwisePrivate Q r) : ∀ᵐ z ∂rowSum Q, PrivateCone r (fun i => rowDensity Q i z) := by haveI : IsFiniteMeasure (rowSum Q) := rowSum_finite Q have hpair (i j : Fin 4) : ∀ᵐ z ∂rowSum Q, rowDensity Q i z ≤ r * rowDensity Q j z := by have hle : (Q i).rnDeriv (rowSum Q) ≤ᵐ[rowSum Q] fun z => ofReal r * (Q j).rnDeriv (rowSum Q) z := by apply ae_le_of_forall_setLIntegral_le_of_sigmaFinite ((Q i).measurable_rnDeriv (rowSum Q)) intro s hs _ rw [lintegral_const_mul _ ((Q j).measurable_rnDeriv (rowSum Q))] have hi := Measure.withDensity_rnDeriv_eq (Q i) (rowSum Q) (row_absolutelyContinuous Q i) have hj := Measure.withDensity_rnDeriv_eq (Q j) (rowSum Q) (row_absolutelyContinuous Q j) rw [← withDensity_apply ((Q i).rnDeriv (rowSum Q)) hs, hi, ← withDensity_apply ((Q j).rnDeriv (rowSum Q)) hs, hj] exact hpriv i j s hs filter_upwards [hle, (Q j).rnDeriv_ne_top (rowSum Q)] with z hz hzj rw [← ENNReal.ofReal_toReal hzj, ← ENNReal.ofReal_mul (by linarith : 0 ≤ r)] at hz exact ENNReal.toReal_le_of_le_ofReal (mul_nonneg (by linarith) ENNReal.toReal_nonneg) hz have hpair_all : ∀ᵐ z ∂rowSum Q, ∀ i j : Fin 4, rowDensity Q i z ≤ r * rowDensity Q j z := by rw [ae_all_iff] intro i rw [ae_all_iff] exact hpair i filter_upwards [hpair_all] with z hz exact ⟨fun i => ENNReal.toReal_nonneg, hz⟩
    Causalean.Stat.Privacy.Staircase.ae_privateCone · Causalean/Stat/Privacy/Staircase/Density.lean:61
Coefficient­Measures 2 core · 3 supporting This module separates the measure-theoretic step of staircase refinement from the construction of its finite release and postprocessing kernels. ★ coefficient_normalized

Integrable staircase coefficients and row measures

This module separates the measure-theoretic step of staircase refinement from the construction of its finite release and postprocessing kernels. A coefficient field represents every row density almost everywhere; its coefficients are integrable, reconstruct each row as a sum of density measures, and have normalized ray masses.

structure CoefficientField reviewed
Causalean.Stat.Privacy.Staircase

A nonnegative measurable field of fourteen ray coefficients represents all four row densities almost everywhere under their common dominating measure.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
r :
ℝ
c :
Z → RayIndex → ℝ
measurable :
∀ S, Measurable fun z => c z S
nonneg :
∀ z S, 0 ≤ c z S
reconstruct :
∀ᵐ z ∂rowSum Q, ∀ i, rowDensity Q i z = ∑ S, c z S * ray r S i
Causalean.Stat.Privacy.Staircase.CoefficientField · Causalean/Stat/Privacy/Staircase/CoefficientMeasures.lean:24
theorem coefficient_normalized reviewed
Causalean.Stat.Privacy.Staircase

For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, a measurable staircase coefficient field, and an input coordinate, the integrated ray weights have unit weighted row sum.

Formal statement
Z :
Type u_1
shared
r :
ℝ
hr :
1 < r
i :
Fin 4
(∑ S : RayIndex, (∫ z, D.c z S ∂rowSum Q) * ray r S i) = 1
Proof (Lean source)
theorem coefficient_normalized (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) (i : Fin 4) : (∑ S : RayIndex, (∫ z, D.c z S ∂rowSum Q) * ray r S i) = 1 := by have hint (S : RayIndex) : Integrable (fun z => D.c z S * ray r S i) (rowSum Q) := (coefficient_integrable Q r hr D S).mul_const _ have : IsFiniteMeasure (rowSum Q) := rowSum_finite Q calc (∑ S : RayIndex, (∫ z, D.c z S ∂rowSum Q) * ray r S i) = ∫ z, ∑ S : RayIndex, D.c z S * ray r S i ∂rowSum Q := by rw [integral_finsetSum] · congr 1 ext S rw [integral_mul_const] · intro S _ exact hint S _ = ∫ z, rowDensity Q i z ∂rowSum Q := by apply integral_congr_ae filter_upwards [D.reconstruct] with z hz exact (hz i).symm _ = 1 := by change (∫ z, ((Q i).rnDeriv (rowSum Q) z).toReal ∂rowSum Q) = 1 rw [Measure.integral_toReal_rnDeriv (row_absolutelyContinuous Q i)] simp [measureReal_def]
3 supporting declarations (lemmas, instances)
  • exists_coefficientField theorem — Every private Markov kernel has a measurable nonnegative coefficient field representing all four row densities simultaneously.
    Z :
    Type u_1
    shared
    r :
    ℝ
    hr :
    1 < r
    hpriv :
    SetwisePrivate Q r
    Nonempty (CoefficientField Q r)
    Proof (Lean source)
    theorem exists_coefficientField (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (hpriv : SetwisePrivate Q r) : Nonempty (CoefficientField Q r) := by obtain ⟨c, hm, hn, heq⟩ := measurable_density_decomposition Q r hr hpriv exact ⟨⟨c, hm, hn, heq⟩⟩
    Causalean.Stat.Privacy.Staircase.exists_coefficientField · Causalean/Stat/Privacy/Staircase/CoefficientMeasures.lean:33
  • coefficient_integrable theorem — Each measurable ray coefficient is integrable against the finite row-sum measure, including coefficients that vanish identically.
    Z :
    Type u_1
    shared
    r :
    ℝ
    hr :
    1 < r
    S :
    Integrable (fun z => D.c z S) (rowSum Q)
    Proof (Lean source)
    theorem coefficient_integrable (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) (S : RayIndex) : Integrable (fun z => D.c z S) (rowSum Q) := by have hrow : Integrable (rowDensity Q 0) (rowSum Q) := by have hmeas : Measurable (fun z => ofReal (rowDensity Q 0 z)) := by exact ((Q 0).measurable_rnDeriv (rowSum Q)).ennreal_toReal.ennreal_ofReal have hfinite : Integrable (fun _ : Z => (1 : ℝ)) ((rowSum Q).withDensity (fun z => ofReal (rowDensity Q 0 z))) := by rw [← row_eq_withDensity Q 0] exact integrable_const 1 have h := (integrable_withDensity_iff hmeas (by simp)).1 hfinite convert h using 1 funext z simpa using (ENNReal.toReal_ofReal (show 0 ≤ rowDensity Q 0 z from ENNReal.toReal_nonneg)).symm refine Integrable.mono' hrow (D.measurable S).aestronglyMeasurable ?_ filter_upwards [D.reconstruct] with z hz have hbound : D.c z S ≤ rowDensity Q 0 z := by rw [hz 0] have hsum : D.c z S * ray r S 0 ≤ ∑ T : RayIndex, D.c z T * ray r T 0 := by exact Finset.single_le_sum (s := univ) (f := fun T : RayIndex => D.c z T * ray r T 0) (by intro T _ exact mul_nonneg (D.nonneg z T) (by unfold ray split_ifs <;> linarith)) (Finset.mem_univ S) have hray : 1 ≤ ray r S 0 := by unfold ray split_ifs <;> linarith have hcoeff := D.nonneg z S nlinarith have hrow_nonneg : 0 ≤ rowDensity Q 0 z := ENNReal.toReal_nonneg simpa [Real.norm_eq_abs, abs_of_nonneg (D.nonneg z S), abs_of_nonneg hrow_nonneg] using hbound
    Causalean.Stat.Privacy.Staircase.coefficient_integrable · Causalean/Stat/Privacy/Staircase/CoefficientMeasures.lean:41
  • coefficient_row_measure theorem — Each Markov row is the finite sum of ray-scaled coefficient measures.
    Z :
    Type u_1
    shared
    r :
    ℝ
    hr :
    1 < r
    i :
    Fin 4
    Q i
    = ∑ S : RayIndex, ofReal (ray r S i) • (rowSum Q).withDensity (fun z => ofReal (D.c z S))
    Proof (Lean source)
    theorem coefficient_row_measure (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) (i : Fin 4) : Q i = ∑ S : RayIndex, ofReal (ray r S i) • (rowSum Q).withDensity (fun z => ofReal (D.c z S)) := by let f : RayIndex → Z → ℝ≥0∞ := fun S z => ofReal (ray r S i) * ofReal (D.c z S) have hf (S : RayIndex) : Measurable (f S) := measurable_const.mul ((D.measurable S).ennreal_ofReal) have hpoint : (fun z => ofReal (rowDensity Q i z)) =ᵐ[rowSum Q] fun z => ∑ S : RayIndex, f S z := by filter_upwards [D.reconstruct] with z hz rw [hz i, ENNReal.ofReal_sum_of_nonneg] · apply Finset.sum_congr rfl intro S _ rw [ENNReal.ofReal_mul (D.nonneg z S), mul_comm] · intro S _ exact mul_nonneg (D.nonneg z S) (by unfold ray split_ifs <;> linarith) calc Q i = (rowSum Q).withDensity (fun z => ofReal (rowDensity Q i z)) := row_eq_withDensity Q i _ = (rowSum Q).withDensity (fun z => ∑ S : RayIndex, f S z) := withDensity_congr_ae hpoint _ = ∑ S : RayIndex, (rowSum Q).withDensity (f S) := by have hfun : (fun z => ∑ S : RayIndex, f S z) = (∑' S : RayIndex, f S) := by funext z rw [ENNReal.tsum_apply, tsum_fintype] rw [hfun, withDensity_tsum hf, Measure.sum_fintype] _ = ∑ S : RayIndex, ofReal (ray r S i) • (rowSum Q).withDensity (fun z => ofReal (D.c z S)) := by apply Finset.sum_congr rfl intro S _ exact withDensity_smul _ ((D.measurable S).ennreal_ofReal)
    Causalean.Stat.Privacy.Staircase.coefficient_row_measure · Causalean/Stat/Privacy/Staircase/CoefficientMeasures.lean:84
Normalized­Coefficients 2 core · 1 supporting The measurable staircase coefficients define finite measures on the output space. ★ exists_coefficientPostprocess

Normalizing coefficient measures

The measurable staircase coefficients define finite measures on the output space. Their masses are the ray weights, and each measure is a weight times a probability measure. A zero-mass coefficient uses an arbitrary Markov row as its fallback.

def coefficientMeasure reviewed
Causalean.Stat.Privacy.Staircase

The contribution measure of one nonconstant staircase ray is its coefficient as a density against the common sum of the four Markov rows.

Definition (Lean source)
Z :
Type u_1
shared
r :
ℝ
shared
Q :
Kernel (Fin 4) Z
S :
coefficientMeasure Q D S :
(rowSum Q).withDensity (fun z => ofReal (D.c z S))
Causalean.Stat.Privacy.Staircase.coefficientMeasure · Causalean/Stat/Privacy/Staircase/NormalizedCoefficients.lean:23 · uses CoefficientField , RayIndex
theorem exists_coefficientPostprocess reviewed
Causalean.Stat.Privacy.Staircase

For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and a measurable staircase coefficient field, a Markov postprocessing kernel representing every ray coefficient measure exists, including zero-weight rays.

Formal statement
Z :
Type u_1
shared
r :
ℝ
hr :
1 < r
conclusion 1
S :
coefficientMeasure Q D S = ofReal (∫ z, D.c z S ∂rowSum Q) • K S
Proof (Lean source)
theorem exists_coefficientPostprocess (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) : ∃ K : Kernel RayIndex Z, IsMarkovKernel K ∧ ∀ S : RayIndex, coefficientMeasure Q D S = ofReal (∫ z, D.c z S ∂rowSum Q) • K S := by let : Nonempty Z := nonempty_of_isProbabilityMeasure (Q 0) let ν : RayIndex → FiniteMeasure Z := fun S => ⟨coefficientMeasure Q D S, isFiniteMeasure_withDensity_ofReal (coefficient_integrable Q r hr D S).hasFiniteIntegral⟩ let K : Kernel RayIndex Z := Kernel.ofFunOfCountable fun S => if (ν S).mass = 0 then Q 0 else (ν S).normalize refine ⟨K, ?_, ?_⟩ · constructor intro S change IsProbabilityMeasure (if (ν S).mass = 0 then Q 0 else ((ν S).normalize : Measure Z)) split_ifs <;> infer_instance · intro S have hmass : ((ν S).mass : ℝ≥0∞) = ofReal (∫ z, D.c z S ∂rowSum Q) := by rw [FiniteMeasure.ennreal_mass] exact coefficientMeasure_mass Q r hr D S change (ν S : Measure Z) = ofReal (∫ z, D.c z S ∂rowSum Q) • K S rw [← hmass] by_cases hzero : (ν S).mass = 0 · have hν : ν S = 0 := (ν S).mass_zero_iff.mp hzero simp [K, hν] · apply Measure.ext intro s hs simp only [K, Kernel.ofFunOfCountable, Kernel.coe_mk, if_neg hzero] rw [Measure.smul_apply, smul_eq_mul] have h := congrArg (fun x : ℝ≥0 => (x : ℝ≥0∞)) ((ν S).self_eq_mass_mul_normalize s) simpa only [ENNReal.coe_mul, FiniteMeasure.ennreal_coeFn_eq_coeFn_toMeasure, ProbabilityMeasure.ennreal_coeFn_eq_coeFn_toMeasure] using h
1 supporting declaration (lemmas, instances)
Factorization 2 core · 1 supporting Integrating the measurable ray coefficients gives a finite staircase channel. ★ exists_refinement

Measurable staircase refinement and exact postprocessing

Integrating the measurable ray coefficients gives a finite staircase channel. Conditional normalization of each coefficient measure gives a Markov postprocessing kernel, including zero-weight rays, whose composition is the original kernel.

structure Refinement reviewed
Causalean.Stat.Privacy.Staircase

A staircase refinement records normalized ray weights, the finite release, and an output postprocessing kernel whose composition is the original four-input kernel.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
r :
ℝ
alpha :
RayIndex → ℝ≥0
T :
markovT :
markovK :
normalized :
∀ i, (∑ S, (alpha S : ℝ) * ray r S i) = 1
release_singleton :
∀ i S, T i {S} = (alpha S : ℝ≥0∞) * ofReal (ray r S i)
factorizes :
Q = K ∘ₖ T
Causalean.Stat.Privacy.Staircase.Refinement · Causalean/Stat/Privacy/Staircase/Factorization.lean:23
theorem exists_refinement reviewed
Causalean.Stat.Privacy.Staircase

For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and setwise local privacy, a fourteen-ray staircase refinement with exact Markov postprocessing exists on any measurable output space.

Formal statement
Z :
Type u_1
shared
r :
ℝ
hr :
1 < r
hpriv :
SetwisePrivate Q r
Nonempty (Refinement Q r)
Proof (Lean source)
theorem exists_refinement (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (hpriv : SetwisePrivate Q r) : Nonempty (Refinement Q r) := by obtain ⟨D⟩ := exists_coefficientField Q r hr hpriv obtain ⟨α, T, hmarkovT, hα, hnorm, hT⟩ := exists_coefficientRelease Q r hr D obtain ⟨K, hmarkovK, hK⟩ := exists_coefficientPostprocess Q r hr D exact ⟨⟨α, T, K, hmarkovT, hmarkovK, hnorm, hT, coefficient_factorizes Q r hr D α T K hα hT hK⟩⟩
Causalean.Stat.Privacy.Staircase.exists_refinement · Causalean/Stat/Privacy/Staircase/Factorization.lean:64 · uses Refinement , SetwisePrivate
1 supporting declaration (lemmas, instances)
Cube­Weights 2 core · 2 supporting Independent two-point weights on four coordinates express every point of the unit cube as a convex combination of its sixteen vertices. ★ cubeWeight_coordinate

Finite cube product weights

Independent two-point weights on four coordinates express every point of the unit cube as a convex combination of its sixteen vertices. These identities are the algebraic input to the measurable staircase selector.

def cubeWeight reviewed
Causalean.Stat.Privacy.Staircase

The product weight of a subset selects t i on its members and 1 - t i on its complement.

Definition (Lean source)
t :
Fin 4 → ℝ
S :
cubeWeight t S :
ℝ
∏ i : Fin 4, if i ∈ S then t i else 1 - t i
Causalean.Stat.Privacy.Staircase.cubeWeight · Causalean/Stat/Privacy/Staircase/CubeWeights.lean:18
theorem cubeWeight_coordinate reviewed
Causalean.Stat.Privacy.Staircase

Given four real coordinates and one selected coordinate, the weighted coordinate indicator has expectation equal to that coordinate under the product weights on the sixteen cube vertices: summing the product weight over the subsets that contain the selected coordinate returns that coordinate's value. No unit-cube restriction is needed.

Formal statement
t :
Fin 4 → ℝ
i :
Fin 4
(∑ S : Finset (Fin 4), cubeWeight t S * (if i ∈ S then 1 else 0)) = t i
Proof (Lean source)
theorem cubeWeight_coordinate (t : Fin 4 → ℝ) (i : Fin 4) : (∑ S : Finset (Fin 4), cubeWeight t S * (if i ∈ S then 1 else 0)) = t i := by let g : Fin 4 → ℝ := fun j => if j = i then 0 else 1 - t j have hterm (S : Finset (Fin 4)) : cubeWeight t S * (if i ∈ S then 1 else 0) = ∏ j : Fin 4, if j ∈ S then t j else g j := by by_cases hi : i ∈ S · simp only [if_pos hi, mul_one] unfold cubeWeight apply Finset.prod_congr rfl intro j _ by_cases hji : j = i <;> simp [g, hji, hi] · simp only [if_neg hi, mul_zero] exact (Finset.prod_eq_zero (Finset.mem_univ i) (by simp [g, hi])).symm have hweight (S : Finset (Fin 4)) : (∏ j : Fin 4, if j ∈ S then t j else g j) = (∏ j ∈ S, t j) * ∏ j ∈ Sᶜ, g j := by have h : (Finset.univ.filter (fun j : Fin 4 => j ∉ S)) = Sᶜ := by ext j simp simp [Finset.prod_ite, h] calc (∑ S : Finset (Fin 4), cubeWeight t S * (if i ∈ S then 1 else 0)) = ∏ j : Fin 4, (t j + g j) := by rw [Fintype.prod_add] simp only [← hweight, ← hterm] _ = t i := by have h : (fun j : Fin 4 => t j + g j) = (fun j => if j = i then t i else 1) := by funext j by_cases hji : j = i <;> simp [g, hji] rw [h] simp [Finset.prod_ite_eq']
Causalean.Stat.Privacy.Staircase.cubeWeight_coordinate · Causalean/Stat/Privacy/Staircase/CubeWeights.lean:54 · uses cubeWeight
2 supporting declarations (lemmas, instances)
Information 9 core · 4 supporting This module states the finite-dimensional conditional-variance inequality for staircase postprocessing and its equality case: rays with distinct projected scores induce mutually singular output laws. ★ fisher_gap_nonneg★ equality_rigidity

Fisher information monotonicity and equality rigidity

This module states the finite-dimensional conditional-variance inequality for staircase postprocessing and its equality case: rays with distinct projected scores induce mutually singular output laws.

def projectedScore reviewed
Causalean.Stat.Privacy.Staircase

Project a finite-dimensional input score onto one real direction.

Definition (Lean source)
d :
ℕ
u :
Fin 4 → Fin d → ℝ
v :
Fin d → ℝ
i :
Fin 4
projectedScore u v i :
ℝ
∑ k, v k * u i k
Causalean.Stat.Privacy.Staircase.projectedScore · Causalean/Stat/Privacy/Staircase/Information.lean:24
def releaseMass reviewed
Causalean.Stat.Privacy.Staircase

The mixture mass of a finite release atom under input probabilities p.

Definition (Lean source)
T :
p :
Fin 4 → ℝ
S :
releaseMass T p S :
ℝ
∑ i, p i * (T i {S}).toReal
def releaseScore reviewed
Causalean.Stat.Privacy.Staircase

The projected score of an active finite release atom under input probabilities p.

Definition (Lean source)
T :
p u :
Fin 4 → ℝ
S :
releaseScore T p u S :
ℝ
(∑ i, p i * (T i {S}).toReal * u i) / releaseMass T p S
def finiteFisher reviewed
Causalean.Stat.Privacy.Staircase

Directional Fisher information of the finite staircase release, with zero-mass atoms contributing zero by the division convention.

Definition (Lean source)
T :
p u :
Fin 4 → ℝ
finiteFisher T p u :
ℝ
∑ S, (∑ i, p i * (T i {S}).toReal * u i) ^ 2 / releaseMass T p S
def outputFisher reviewed
Causalean.Stat.Privacy.Staircase

Directional Fisher information of the general output kernel, expressed using the common dominating row-sum measure and its four measurable densities.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
p u :
Fin 4 → ℝ
outputFisher Q p u :
ℝ
∫ z, (∑ i, p i * rowDensity Q i z * u i) ^ 2 / (∑ i, p i * rowDensity Q i z) ∂rowSum Q
Causalean.Stat.Privacy.Staircase.outputFisher · Causalean/Stat/Privacy/Staircase/Information.lean:41
def outputScore reviewed
Causalean.Stat.Privacy.Staircase

The projected score after observing the general output, defined to be zero where the output mixture density vanishes.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
p u :
Fin 4 → ℝ
z :
Z
outputScore Q p u z :
ℝ
(∑ i, p i * rowDensity Q i z * u i) / (∑ i, p i * rowDensity Q i z)
Causalean.Stat.Privacy.Staircase.outputScore · Causalean/Stat/Privacy/Staircase/Information.lean:47
def varianceGap reviewed
Causalean.Stat.Privacy.Staircase

The conditional-variance expression for information lost through the postprocessing kernel.

Definition (Lean source)
Z :
Type u_1
shared
Q :
Kernel (Fin 4) Z
r :
ℝ
R :
p u :
Fin 4 → ℝ
varianceGap Q r R p u :
ℝ
∑ S, releaseMass R.T p S * ∫ z, (releaseScore R.T p u S - outputScore Q p u z) ^ 2 ∂(R.K S)
Causalean.Stat.Privacy.Staircase.varianceGap · Causalean/Stat/Privacy/Staircase/Information.lean:53 · uses Refinement
theorem fisher_gap_nonneg reviewed
Causalean.Stat.Privacy.Staircase

Given a four-input Markov kernel, a privacy ratio, a staircase refinement, strictly positive input weights, which need not sum to one, a finite-dimensional input score, and a score direction, the directional Fisher-information gap is nonnegative.

Formal statement
Z :
Type u_1
shared
d :
ℕ
r :
ℝ
R :
p :
Fin 4 → ℝ
hp :
∀ i, 0 < p i
u :
Fin 4 → Fin d → ℝ
v :
Fin d → ℝ
Proof (Lean source)
theorem fisher_gap_nonneg {d : ℕ} (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (R : Refinement Q r) (p : Fin 4 → ℝ) (hp : ∀ i, 0 < p i) (u : Fin 4 → Fin d → ℝ) (v : Fin d → ℝ) : 0 ≤ finiteFisher R.T p (projectedScore u v) - outputFisher Q p (projectedScore u v) := by rw [fisher_gap_eq_variance Q r R p (projectedScore u v) hp] unfold varianceGap apply Finset.sum_nonneg intro S _ apply mul_nonneg · unfold releaseMass apply Finset.sum_nonneg intro i _ exact mul_nonneg (le_of_lt (hp i)) ENNReal.toReal_nonneg · exact integral_nonneg fun z => sq_nonneg _
theorem equality_rigidity reviewed
Causalean.Stat.Privacy.Staircase

Given a four-input Markov kernel, a privacy ratio, a staircase refinement, strictly positive input weights, which need not sum to one, a finite-dimensional input score, a score direction, a zero directional Fisher gap, two rays with positive release mass, and different projected scores, the two postprocessing laws are mutually singular.

Formal statement
Z :
Type u_1
shared
d :
ℕ
r :
ℝ
R :
p :
Fin 4 → ℝ
hp :
∀ i, 0 < p i
u :
Fin 4 → Fin d → ℝ
v :
Fin d → ℝ
hgap :
S U :
hS :
0 < releaseMass R.T p S
hU :
0 < releaseMass R.T p U
hdiff :
releaseScore R.T p (projectedScore u v) S ≠ releaseScore R.T p (projectedScore u v) U
R.K S ⟂ₘ R.K U
Proof (Lean source)
theorem equality_rigidity {d : ℕ} (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (R : Refinement Q r) (p : Fin 4 → ℝ) (hp : ∀ i, 0 < p i) (u : Fin 4 → Fin d → ℝ) (v : Fin d → ℝ) (hgap : finiteFisher R.T p (projectedScore u v) - outputFisher Q p (projectedScore u v) = 0) (S U : RayIndex) (hS : 0 < releaseMass R.T p S) (hU : 0 < releaseMass R.T p U) (hdiff : releaseScore R.T p (projectedScore u v) S ≠ releaseScore R.T p (projectedScore u v) U) : R.K S ⟂ₘ R.K U := by let w := projectedScore u v have hvar : (∑ V, releaseMass R.T p V * ∫ z, (releaseScore R.T p w V - outputScore Q p w z) ^ 2 ∂(R.K V)) = 0 := by simpa only [varianceGap] using ((fisher_gap_eq_variance Q r R p w hp).symm.trans hgap) have hterm_nonneg (V : RayIndex) : 0 ≤ releaseMass R.T p V * ∫ z, (releaseScore R.T p w V - outputScore Q p w z) ^ 2 ∂(R.K V) := by apply mul_nonneg · unfold releaseMass apply Finset.sum_nonneg intro i _ exact mul_nonneg (le_of_lt (hp i)) ENNReal.toReal_nonneg · exact integral_nonneg fun z => sq_nonneg _ have hscore (V : RayIndex) (hV : 0 < releaseMass R.T p V) : ∀ᵐ z ∂(R.K V), outputScore Q p w z = releaseScore R.T p w V := by have hterm : releaseMass R.T p V * ∫ z, (releaseScore R.T p w V - outputScore Q p w z) ^ 2 ∂(R.K V) = 0 := ((Finset.sum_eq_zero_iff_of_nonneg (fun V _ => hterm_nonneg V)).mp hvar) V (Finset.mem_univ V) have hint : (∫ z, (releaseScore R.T p w V - outputScore Q p w z) ^ 2 ∂(R.K V)) = 0 := (mul_eq_zero.mp hterm).resolve_left (ne_of_gt hV) letI : IsMarkovKernel R.K := R.markovK have hscoreInt : Integrable (outputScore Q p w) (R.K V) := outputScore_integrable Q p w (fun i => le_of_lt (hp i)) _ have hscoreSqInt : Integrable (fun z => (outputScore Q p w z) ^ 2) (R.K V) := outputScore_sq_integrable Q p w (fun i => le_of_lt (hp i)) _ have hfi : Integrable (fun z => (releaseScore R.T p w V - outputScore Q p w z) ^ 2) (R.K V) := by have hfun : (fun z => (releaseScore R.T p w V - outputScore Q p w z) ^ 2) = (fun z => (releaseScore R.T p w V) ^ 2 - (2 * releaseScore R.T p w V) * outputScore Q p w z + (outputScore Q p w z) ^ 2) := by funext z ring rw [hfun] exact ((integrable_const _).sub (hscoreInt.const_mul _)).add hscoreSqInt have hae := (integral_eq_zero_iff_of_nonneg (fun z => sq_nonneg _) hfi).mp hint filter_upwards [hae] with z hz have hz' : (releaseScore R.T p w V - outputScore Q p w z) ^ 2 = 0 := by simpa only [Pi.zero_apply] using hz have hz0 : releaseScore R.T p w V - outputScore Q p w z = 0 := (mul_self_eq_zero.mp (by simpa only [pow_two] using hz')) linarith have hm : Measurable (outputScore Q p w) := by unfold outputScore rowDensity fun_prop let s : Set Z := {z | outputScore Q p w z ≠ releaseScore R.T p w S} refine ⟨s, ?_, ?_, ?_⟩ · exact (measurableSet_eq_fun hm measurable_const).compl · have h := ae_iff.mp (hscore S hS) simpa only [s, Set.compl_setOf, not_not] using h · have h : ∀ᵐ z ∂(R.K U), outputScore Q p w z ≠ releaseScore R.T p w S := by filter_upwards [hscore U hU] with z hz intro heq exact hdiff (heq.symm.trans hz) have h0 := ae_iff.mp h simpa only [s, Set.compl_setOf, not_not] using h0
4 supporting declarations (lemmas, instances)
Release 1 core · 0 supporting The integrated coefficients define a probability distribution on the fourteen rays for each input. ★ exists_coefficientRelease

Finite release from normalized staircase coefficients

The integrated coefficients define a probability distribution on the fourteen rays for each input. This module isolates the finite release construction from output postprocessing.

theorem exists_coefficientRelease reviewed
Causalean.Stat.Privacy.Staircase

For a four-input Markov kernel, a privacy ratio greater than one at the supplied ratio, and a measurable staircase coefficient field, a finite Markov release with the integrated ray weights exists.

Formal statement
Z :
Type u_1
shared
r :
ℝ
hr :
1 < r
∃ (α : RayIndex → ℝ≥0) (T : Kernel (Fin 4) RayIndex),
conclusion 1
S :
(α S : ℝ) = ∫ z, D.c z S ∂rowSum Q
conclusion 2
i :
∑ S, (α S : ℝ) * ray r S i = 1
conclusion 3
i S :
T i {S} = (α S : ℝ≥0∞) * ofReal (ray r S i)
Proof (Lean source)
theorem exists_coefficientRelease (Q : Kernel (Fin 4) Z) [IsMarkovKernel Q] (r : ℝ) (hr : 1 < r) (D : CoefficientField Q r) : ∃ (α : RayIndex → ℝ≥0) (T : Kernel (Fin 4) RayIndex), IsMarkovKernel T ∧ (∀ S, (α S : ℝ) = ∫ z, D.c z S ∂rowSum Q) ∧ (∀ i, ∑ S, (α S : ℝ) * ray r S i = 1) ∧ ∀ i S, T i {S} = (α S : ℝ≥0∞) * ofReal (ray r S i) := by let α : RayIndex → ℝ≥0 := fun S => ⟨∫ z, D.c z S ∂rowSum Q, integral_nonneg (fun z => D.nonneg z S)⟩ have hα (S : RayIndex) : (α S : ℝ) = ∫ z, D.c z S ∂rowSum Q := rfl have hnorm (i : Fin 4) : ∑ S, (α S : ℝ) * ray r S i = 1 := by simpa only [hα] using coefficient_normalized Q r hr D i let T : Kernel (Fin 4) RayIndex := Kernel.ofFunOfCountable fun i => Measure.sum fun S : RayIndex => ofReal ((α S : ℝ) * ray r S i) • Measure.dirac S refine ⟨α, T, ?_, hα, hnorm, ?_⟩ · constructor intro i change IsProbabilityMeasure (Measure.sum fun S : RayIndex => ofReal ((α S : ℝ) * ray r S i) • Measure.dirac S) apply HasSum.isProbabilityMeasure_sum_dirac · intro S exact mul_nonneg (α S).property (by unfold ray split_ifs <;> linarith) · simpa only [hnorm i] using (hasSum_fintype (fun S : RayIndex => (α S : ℝ) * ray r S i)) · intro i S change (Measure.sum fun U : RayIndex => ofReal ((α U : ℝ) * ray r U i) • Measure.dirac U) {S} = _ rw [Measure.sum_smul_dirac_singleton] simpa using ENNReal.ofReal_mul (α S).property (y := ray r S i)